PowerShell Deobfuscator

Multi-pass deobfuscator for the PowerShell loaders that show up in commodity-malware and ransomware staging: -EncodedCommand, FromBase64String, char-array literals, format-string composition, replace chains, backtick noise. Each pass shows what it changed.

Heuristic — does not actually execute anything. Pure client-side; nothing leaves your browser. After decoding, dangerous primitives (IEX, DownloadString, VirtualAlloc, Defender tampering) are flagged.

Input

Passes

encoded-command — decodes -EncodedCommand base64 (UTF-16LE).
from-base64-string — [Convert]::FromBase64String + standalone long blobs.
strip-backticks — removes lone backticks used as escape-noise.
reverse-string — resolves [Array]::Reverse on string literals.
replace-chain — applies chained .Replace("a","b") on literals.
format-string — resolves "{0}{1}" -f 'a','b' composition.
char-literals — [char]65 + [char]66 and [char[]](72,73) -join ''.