Static | ZeroBOX
No static analysis available.
# PowerShell + HTML5 prototype. Needs audio. Run: iex (New-Object Net.WebClient).DownloadString("http://bit.ly/e0Mw9w")
if($host.Name -ne "ConsoleHost")
Start-Process powershell -ArgumentList '-noprofile -noexit -command iex (New-Object Net.WebClient).DownloadString(''http://bit.ly/e0Mw9w'')'
return
$data = 'H4sIAAAAAAAEAO29B2AcSZYlJi9tynt/SvVK1+B0oQiAYBMk2JBAEOzBiM3mkuwdaUcjKasqgcplVmVdZhZAzO2dvPfee++999577733ujudTif33/8/XGZkAWz2zkrayZ4hgKrIHz9+fB8/In638zpb5E36Wfp7biUpPR+lP/ZjvyeeH//xH/89f5x/0C9Dz4/rvz/2ex4+0kd+Ofz4k0/MewIC/3zyyScfH9Lz6PDwx3/s95T2I/Pio0O8Ii/5nX/Cb/ivcGN57BsGGfcKnuAVfcn1gtbyAr3ycfwVfklesQ+N4uNPOq+M+D8e/CH+k3af8JtoT80+1p+2l5G05v/jM3mBn48/jr4ywiNIDb1yqDT2X9Fh8D+fdF5BYzct/iv8EX7EXzGd4BWLlyHZx+EL/M7Hn0gX+goTzL3i3vjkYzsY/ONeca39Vyyl5SWlQu8V6evjT7Qffsdy5MeHOlp5xcMLvXzM73Dbj/kfDIbJaSkWIPboUBoyWh8zmvrKobxlGMbh9ejRJwYzxsiMwgB8pETmF/i/kTcY88rH+oq8Frwykp68mWFS8TsOcXnFodV9xcyle8N/ZSTI4ZVDeeHHzSuuE6bYj3sA7MedXjqvuF70gQx0MDv8xBLMUExe0bfwsXTz4zKX4JdPPu73gn91goCG6cYg9uM//nHwiocXXsIcB4ihHesL5jKn+vxXwjf0FXnL9WIHj1eUy0LEftyozd9Te/FeYXViujGY/binC90rShJp+ONWyAxizgJAkN3DL2DSuTH+wc/eK9qaWZhBE0G1ix83b8Rf4R50kCxi2odIsW+o5JWRfQGv/J6KmH3jMDBt8ortAc+P/57Sycf2jf4rwQt45cfxJ78iEvmx/4a+8uPeG3iJR/KxErjTye/5Yz/2UcQ48//ldzXEBpj9hb/pGWf+jXr65ONPhPi/J6bsUB76ynKor9P1FZ0ufkdfeuS/4rc/NKpDscU/lozWBoaG45At6yfa3NjzT/xXtKV7w2Ik78g
## Decompress the frames, which declare an array of strings
$binaryData = [System.Convert]::FromBase64String($data)
$ms = New-Object System.IO.MemoryStream
$ms.Write($binaryData, 0, $binaryData.Length)
$ms.Seek(0,0) | Out-Null
$cs = New-Object System.IO.Compression.GZipStream($ms, [System.IO.Compression.CompressionMode]"Decompress")
$sr = New-Object System.IO.StreamReader($cs)
$structure = $sr.ReadToEnd()
iex $structure
## Go through the frames, and re-scale them so that they have the
## proper aspect ratio in the console
for($counter = 0; $counter -lt $frames.Count; $counter++)
$frame = $frames[$counter]
$expansion = (@('$1') + (('$2','$3','$2','$3') | Get-Random -Count 4 | Sort)) -join ''
$frame = (($frame -split "`t") -replace '(.)(.)(.)',$expansion) -join "`t"
$frames[$counter] = $frame
## Prepare the screen
$counter = 0
$maxCounter = $frames.Count - 1
$host.UI.RawUI.BackgroundColor = "White"
$host.UI.RawUI.ForegroundColor = "Black"
$host.UI.RawUI.WindowSize = New-Object System.Management.Automation.Host.Size 83,45
catch {}
$host.UI.RawUI.BufferSize = New-Object System.Management.Automation.Host.Size 83,45
} catch {}
$host.UI.RawUI.WindowSize = New-Object System.Management.Automation.Host.Size 83,45
} catch {}
$host.UI.RawUI.BufferSize = New-Object System.Management.Automation.Host.Size 83,45
} catch {}
## Open the background song
$script = @'
$player = New-Object -ComObject 'MediaPlayer.MediaPlayer'
$player.Open("http://www.leeholmes.com/projects/ps_html5/background.mp3")
$player
## ... in a background MTA-threaded PowerShell because
## the MediaPlayer COM object doesn't like STA
$runspace = [RunspaceFactory]::CreateRunspace()
$runspace.ApartmentState = "MTA"
$bgPowerShell = [PowerShell]::Create()
$bgPowerShell.Runspace = $runspace
$runspace.Open()
$player = @($bgPowerShell.AddScript($script).Invoke())[0]
## Wait for it to buffer (or error out)
while($true)
Start-Sleep -m 500
if($player.HasError -or ($player.ReadyState -eq 4)) { break }
Start-Sleep -m 1600
Clear-Host
$host.UI.RawUI.CursorPosition = New-Object System.Management.Automation.Host.Coordinates `
0,([Console]::WindowHeight - 1)
Write-Host -NoNewLine 'Q or ESC to Quit'
## Loop through the frames and display them
[Console]::TreatControlCAsInput = $true
while($true)
if([Console]::KeyAvailable)
{
$key = [Console]::ReadKey()
if(($key.Key -eq 'Escape') -or
($key.Key -eq 'Q') -or
($key.Key -eq 'C'))
{
break
}
}
if((-not $player.HasError) -and ($player.PlayState -eq 0)) { break }
$host.UI.RawUI.CursorPosition = New-Object System.Management.Automation.Host.Coordinates 0,0
Write-Host (($frames[$counter] -split "`t") -join "`r`n")
Start-Sleep -m 100
$counter = ($counter + 1) % $maxCounter
finally
## Clean up, display exit screen
Clear-Host
$frames[-1] -split "`t"
"`n"
" Happy Scripting from PowerShell..."
" and Rick ASCII!"
"`n`n`n"
$player.Stop()
$bgPowerShell.Dispose()
Antivirus Signature
Bkav Clean
Lionic Clean
ClamAV Clean
CTX Clean
CAT-QuickHeal Clean
Skyhigh Clean
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Clean
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Trojan.PS.Dwnldr.CCD
Symantec Clean
ESET-NOD32 PowerShell/Hoax.Agent.B
TrendMicro-HouseCall Clean
Avast Clean
Cynet Clean
Kaspersky Clean
BitDefender Clean
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Clean
Tencent Clean
Sophos Clean
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
CMC Clean
Emsisoft Clean
huorong Clean
FireEye Clean
Jiangmin Clean
Varist Clean
Avira Clean
Fortinet Clean
Antiy-AVL Clean
Kingsoft Win32.Troj.Hoax.a
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
Microsoft Clean
Google Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
TACHYON Clean
VBA32 Clean
Zoner Clean
Rising Clean
Yandex Clean
Ikarus Clean
MaxSecure Clean
GData Clean
AVG Clean
Panda Clean
alibabacloud Clean
No IRMA results available.