PowerDecode - PowerDecode is a PowerShell-based tool that allows

项目说明

!alt text

PowerDecode

PowerDecode is a PowerShell-based tool for de-obfuscating PowerShell scripts obfuscated across multiple layers in different obfuscation forms including:

String concatenate/reorder/reverse/replace

Base64 encoding

ASCII encoding

Compression deflate/GZIP

The tool performs also code dynamic analysis, gathering useful informations about malware activity including:

HTTP response status of URLs

Declared

Payloads download attempts

Attempts to start processes

Shellcode injection attempts

WARNING:
- Dynamic analysis requires script execution. Use the tool only in a isolated execution en ( for example)
- Before de-obfuscating make sure the script is executable (automatic de-obfuscation process fails if script contains some syntax errors)
- Windows Defender might avoid the tool from working properly. Disable it temporarily if necessary.

REQUIREMENTS:
- Windows PowerShell v5.1
- OS Windows 10 64 bit

How to use the tool

- Enable scripts execution: launch PowerShell as Administrator and run the command:

- If it doesn't work, open Registry Editor as Administrator and go to:

Set the parameter "ExecutionPolicy" on value "Bypass"
- Disable any antivirus software in order to allow the tool to analyze malware without interruption.
- Click on PowerDecode.bat to start the GUI

PowerDecode can work in two different modes:

Automatic decode mode

Manual decode mode

Automatic decode mode

Obfuscation layers of an input script are automatically detected and removed. A dynamic analysis is performed on the final layer. The following options are a:

[1]-Decode a script from a single file: takes as input a file to analyze and a folder to save the report file (if this last is not set, report file will be saved in the PowerDecode folder)

[2]-Decode multiple scripts from a folder: takes as input a folder containg some files to analyze and a folder to save the report files (if this last is not set, report files will be saved in the PowerDecode folder)

[0]-Go back: returns to the previous menu

Manual decode mode

User can select a set of tasks to perform on an input script to manually remo layers. The following options are a:

[1]-Decode script by regex: regular expression supported by PowerDecode are applied to the input string to remove a single obfuscation layer

[2]-Decode script by IEX o: input string is executed in a local en where In cmdlet is replaced with Write-Output cmdlet (might execute malicious actions!)

[3]-Decode base64 encoding: remo encoding

[4]-Decode deflate payload: remo compression

[5]-Decode GZIP payload: remo compression

[6]-Replace a string (raw): replaces a piece of the loaded script with a substring entered by the user

[7]-Replace a string (e): replaces a piece of the loaded script with its execution output (might execute malicious actions!)

[8]-URLs analysis: extracts URLs and checks their HTTP response status code

[9]-Get content: extracts declared and shows their names and contents (might execute malicious actions!)

[10]-Shellcode check: extracts shellcode as hexadecimal instructions. This feature could be efficiently integrated with SCDBG. In order to activate the debugger, the scdbg.exe file must be placed on the PowerDecode\ folder

[11]-Perform static analysis and get rating: Analyzes the code without executing it and provides a description of the malware. If the API key is set shows the rating of the malware via API call

[12]-Undo last decoding task: deletes the last layer of code obtained

[13]-Report preview: shows all collected data as it will be saved on the report file

[14]-Store and export report file: saves all collected data on a .txt report file and stores the sample in the MalwareRepository.db

[0]-Go back: returns to the previous menu

Malware repository

PowerDecode includes a malware database( MalwareRepository.db) based on LiteDB. On this section, following options are a:

[1]-Query DB for a script: checks if a script from an input file is stored on DB and if it is present, shows its de-obfuscated

[2]-Query DB for a URL: checks if an input URL is stored on DB and also shows stored malwares that connect to it

[3]-Query DB for a shellcode: checks if an input shellcode(string of hex ) is stored on DB and if it is present shows stored malwares that inject it

[4]-Malware statistics: shows some statistics about malware samples stored on MalwareRepository.db

[5]-Export all original scripts: allows to export all orginal malware samples from MalwareRepository.db to an output folder. Each sample will be saved on a .txt file. WARNING: use this feature only on a isolated execution en, exported files are malicious!

[6]-Export all URLs: allows to export all stored URLs from MalwareRepository.db to an output file

[6]-Export all Shellcodes: allows to export all stored shellcodes from MalwareRepository.db to an output folder. Each sample will be saved on a .txt file

[0]-Go back: returns to the previous menu

Settings

Following parameters can be set:

[1]-Switch storage mode: if it is set to "Enabled" analyzed scripts will be stored on MalwareRepository.db

[2]-Switch step-by-step mode: if it is set to "Enabled", decoding multiple scripts from a folder, the user is asked for confirmation before continuing with the analysis of the next file

[3]-Set API key: allows to load a API key to interact with the API

[4]-Set execution timeout: allows to set the maximum time limit in seconds of script execution during de-obfuscation process

[5]-Switch logging mode: if it is set to "Enabled" log files are saved on the package\logs folder

License

GPL-3.0

Paper

G. M. Malandrone, G. , G. Giacinto , D. Maiorca. PowerDecode: a PowerShell Script Decoder Dedicated to Malware Analysis. 5th Italian Conference on CyberSecurity (ITASEC), 2021.

项目信息

开发语言：PowerShell

Star 数：236

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕PowerDecode is a PowerShell-based tool that allows to deobfuscate PowerShell scripts obfuscated across multiple layers. The tool performs code dynamic analysis, extracting malware hosting URLs and checking http response.It can also detect if the malware attempts to inject shellcode into memory.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。