Malware Decoders

One page per obfuscation technique: what it looks like, how to reverse it by hand, and worked examples with the decoded result.

Esoteric JavaScriptDecoder
Decode AAEncode
Paste a (ﾟДﾟ) (ﾟΘﾟ) (o^_^o) emoticon payload and get the original JavaScript back without running it.
Open the decoder
Unix shellDecoder
Decode Bash ANSI-C Quoting
Paste a hex or octal escape string from a shell script and get the command it runs: the curl line, the pipe to sh, the path it writes.
Open the decoder
Windows command lineDecoder
Decode Batch File Obfuscation
Paste an obfuscated .bat or .cmd script and get the command it actually runs: caret escapes removed, set variables resolved, the download line readable.
Open the decoder
Windows command lineDecoder
Decode ClickFix cmd /v:on Commands
Paste a ClickFix command line to see the command it actually builds, with any numeric host converted to a dotted IPv4 address.
Open the decoder
Text encodingDecoder
Decode Invisible Unicode Payloads
Paste text that looks empty or harmless and recover the URL or command hidden in zero-width, Hangul Filler or variation-selector characters.
Open the decoder
JavaScript string arraysDecoder
Decode javascript-obfuscator String Arrays (obfuscator.io)
Paste a script full of _0x accessor lookups and get the program back: strings restored, names readable, and a note on whether the decode is complete.
Open the decoder
PowerShellDecoder
Decode PowerShell -EncodedCommand
Paste a powershell -enc or -EncodedCommand line and get the script it runs, with the URL and drop path it hides.
Open the decoder
JavaScript string encodingDecoder
Decode String.fromCharCode Chains
Paste a list of numeric character codes and get the string it spells: the URL, the script tag, the call that was hidden behind the integers.
Open the decoder
Windows scriptingDecoder
Decode VBScript Chr() Obfuscation
Paste a Chr(104)&Chr(116)&Chr(116) chain from a .vbs or .hta file and get the URL, path or command the script assembles at runtime.
Open the decoder
Byte-level encodingDecoder
Decode XOR-Obfuscated Strings
Paste a hex or base64 blob that hides a URL or a command behind a single-byte XOR and get the plain text back, without being told the key.
Open the decoder

Decoder guides in the knowledge base

Longer guides that live in Learn.