Bypassing PowerShell Strong Obfuscation, (Thu, Mar 30th)

Yesterday, I found a malicious PowerShell script that was heavily obfuscated. The filename is “B0A4.ps1"[1] (SHA256:b4814c8db16ecdd7904e81186715bf2a4b4ba28ef5853a41a8f59824f47f8f24), reported with a very low score on VirusTotal: 6/58. The file size is abnormal for a script like this (496KB). A first look at it reveals that it has been strongly obfuscated:

Article Link: https://isc.sans.edu/diary/rss/29692

1 post - 1 participant

Read full topic

bypassing file filename low malicious obfuscated obfuscation powershell powershell script score script sha256 size virustotal