# What does this POWERSHELL command do? (malware)

**URL:** <https://boards.straightdope.com/t/what-does-this-powershell-command-do-malware/837585>\
**Category:** Factual Questions\
**Created:** [July 25, 2019, 2:15am UTC](https://boards.straightdope.com/t/what-does-this-powershell-command-do-malware/837585 "2019-07-25T02:15:01Z")\
**Posts on this page:** 5\
**Page:** 2

<div class="post-metadata">

**Author:** ![CookingWithGas](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cookingwithgas/32/485_2.png) [@CookingWithGas](https://boards.straightdope.com/u/CookingWithGas)\
**Post date:** [September 22, 2021, 7:50pm UTC](https://boards.straightdope.com/t/what-does-this-powershell-command-do-malware/837585/21 "2021-09-22T19:50:36Z")

</div>

@Reply,

Are you still around? I am taking another look at this and was wondering how you extracted that. It appears to be base64 encoded _ **and** _ compressed but I couldn’t figure out how to decompress it. The base64 decoded version just looks like noise.

---

<div class="post-metadata">

**Author:** ![Melbourne](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Melbourne](https://boards.straightdope.com/u/Melbourne)\
**Post date:** [September 23, 2021, 4:23am UTC](https://boards.straightdope.com/t/what-does-this-powershell-command-do-malware/837585/22 "2021-09-23T04:23:32Z")

</div>

> [@Melbourne](#):
>
> System.io.Compression.DeflateStream([System.IO.MemoryStream[System.Convert]

The original post starts with

> POWERSHELL -Enc

So you start by decoding, which give you

> ( .(‘nEw’+’-OB’+‘j’+‘ect’) SYST `em` .io `.COMPR` E `sSiO` N.deflATe `STREAm([syStem.IO.MEMOrYstreAm]`

Correct the capitalization and string concatination, you get

> newObject  
> System.io.Compression.DeflateStream(  
> [System.IO.MemoryStream[System.Convert]::[system.convert]::FromBase64string(  
> “random stream of characters”

Now take the inner character string, and decode AGAIN, FromBase64string

After decoding the base64 again, you still need to do  
System.io.Compression.DeflateStream(

---

<div class="post-metadata">

**Author:** ![CookingWithGas](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cookingwithgas/32/485_2.png) [@CookingWithGas](https://boards.straightdope.com/u/CookingWithGas)\
**Post date:** [September 23, 2021, 12:43pm UTC](https://boards.straightdope.com/t/what-does-this-powershell-command-do-malware/837585/23 "2021-09-23T12:43:18Z")

</div>

> [@Melbourne](#):
>
> After decoding the base64 again, you still need to do  
> System.io.Compression.DeflateStream(

That is the step I was stuck on. Do I do that in PowerShell? It looks like an API call that you could also do from other languages.

---

<div class="post-metadata">

**Author:** ![gnoitall](https://avatars.discourse-cdn.com/v4/letter/g/bb73d2/32.png) [@gnoitall](https://boards.straightdope.com/u/gnoitall)\
**Post date:** [September 23, 2021, 12:58pm UTC](https://boards.straightdope.com/t/what-does-this-powershell-command-do-malware/837585/24 "2021-09-23T12:58:19Z")

</div>

PowerShell has access to .Net classes like that.

> **[DeflateStream Class (System.IO.Compression)](https://learn.microsoft.com/en-us/dotnet/api/system.io.compression.deflatestream?view=net-5.0)**
>
> Provides methods and properties for compressing and decompressing streams by using the Deflate algorithm.

These ain’t your grandpa’s .bat files.

---

<div class="post-metadata">

**Author:** ![Melbourne](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Melbourne](https://boards.straightdope.com/u/Melbourne)\
**Post date:** [September 23, 2021, 1:59pm UTC](https://boards.straightdope.com/t/what-does-this-powershell-command-do-malware/837585/25 "2021-09-23T13:59:39Z")

</div>

> [@CookingWithGas](#):
>
> That is the step I was stuck on. Do I do that in PowerShell? It looks like an API call that you could also do from other languages.

Almost any compression/decompression program.

Windows API:

BOOL Compress(  
COMPRESSOR\_HANDLE CompressorHandle,  
LPCVOID UncompressedData,  
SIZE\_T UncompressedDataSize,  
PVOID CompressedBuffer,  
SIZE\_T CompressedBufferSize,  
PSIZE\_T CompressedDataSize  
);

I think that ‘extract.exe’ had the ability to extract deflated files, but I’m not sure that ‘compact.exe’ ever supported ‘deflate/zip’ as an option.

[Previous page](https://boards.straightdope.com/t/what-does-this-powershell-command-do-malware/837585.md?page=1)