PowerShell Command Decoder

About this tool

Attackers (and some admin tools) hide PowerShell in a command line such as powershell -NoP -W Hidden -Enc SQBFAFgA... where the argument is Base64 of UTF-16 text. This tool unwraps that and keeps going while it can: it decodes [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('...')), unpacks payloads wrapped in DeflateStream or GZipStream, removes backticks (without touching real escapes such as `n in double quotes), turns [char]73 and lists of character codes (also with -bxor) into text, joins 'a'+'b' pieces, resolves ('{1}{0}' -f 'ex','i') format strings, applies plain -replace and .Replace calls and reverses strings written backwards. Each step is listed so you can see how the text changed. At the end it points out things worth a look: runs text as code, downloads, AMSI bypass, sockets, in-memory loading, Defender changes, persistence, hidden launch flags, and any web addresses and IPs, which are shown defanged so they cannot be clicked by accident. We checked the string rewrite rules by evaluating more than twenty obfuscated expressions with real PowerShell and with this tool: the results were identical, and anything that could change the meaning (such as adding numbers before joining strings) is left alone. Variables, computed names and indexing into environment variables are beyond static decoding and are reported as such. This only rewrites text. Nothing is executed or downloaded, and the text stays in your browser. Treat the output as hostile text anyway: do not paste it into a console.

How to use it

1. Paste the command line or the encoded text.
2. Press Decode.
3. Read the result and the findings, and open the steps to see each layer.
4. Copy the decoded text for your report, and defang indicators before sharing.

Example

The Base64 argument is UTF-16; the tool decodes it and lists what the script does.

powershell -NoP -W Hidden -Enc SQBFAFgAIAAoAC4ALgAuACkA

IEX (...)

Common problems

It says nothing was found to decode

The text may not be encoded, or the obfuscation uses variables or computed names that need a debugger or a sandbox.

The decoded text still contains Base64

Some layers need data this tool cannot reach (for example a key held in a variable). Decode that part by hand or in a sandbox.

I want to run it to see what it does

Do that only in an isolated lab. Never paste decoded malware into a normal console.

It says string clean-up was skipped

The text is over 15,000 characters. Base64 and compressed layers are still decoded, but the string clean-up is skipped to keep the page responsive. Decode the inner part separately if you need it.