Unpeel layered malware payloads, phishing macros, C2 beacons, and PowerShell stagers in real-time. Chain operations across Base64, single/multi-byte XOR, Hex, URL-encoding, ROT13, Binary, CharCodes, and Gzip decompression with automated XOR key discovery.
Below are simultaneous real-time decodings across standard formats for instant triage of unknown strings:
Tests all 255 non-zero single-byte XOR keys (0x01 to 0xFF) and scores output based on English ASCII text readability.
| Key (Hex) | Key (Dec) | Readability | Decoded Preview (First 140 chars) | Action |
|---|---|---|---|---|
| Click "Run XOR Brute-Force" or paste a hex/ciphertext payload to scan all 255 keys. | ||||
In modern intrusion analysis, digital forensics examiners rarely encounter plaintext shellcode, URLs, or commands. Advanced Persistent Threat (APT) groups, ransomware operators, and commodity malware distributors employ defense evasion (MITRE ATT&CK T1027) techniques designed to bypass perimeter email filters, Web Application Firewalls (WAF), and endpoint detection (EDR) heuristics.
Attackers frequently stack multiple encodings into a single artifact to evade detection signatures:
Typical Threat Chain: Raw C2 URL → XOR with Key 0x5A → Gzip Compression → Base64 Encoding → URL Encoding
Security scanners looking for strings like http:// or powershell.exe fail to match static YARA signatures because the underlying byte pattern is mathematically scrambled. To analyze the threat, examiners must systematically reverse each layer in exact reverse order.
Exclusive OR is symmetric: (A ⊕ B) ⊕ B = A. With only 255 non-zero keys, automated heuristic brute-forcing scores character distributions (vowels, spaces, ASCII frequency) to pinpoint keys in milliseconds.
The PowerShell -EncodedCommand switch strictly requires 16-bit Little-Endian Unicode Base64. Standard decoders produce interleaved null bytes (\x00); this pipeline transposes UTF-16LE pairs into clean scripts.
Compressed payloads are decompressed in memory using modern DecompressionStream (Gzip/Deflate) Web APIs, completely bypassing the need to upload confidential payloads to third-party servers.
Malware deobfuscation often involves active C2 domain indicators and internal network paths. All transformations occur strictly in volatile browser RAM to protect evidentiary confidentiality.
| Encoding / Obfuscation | Primary Threat Use Case | Forensic Artifact Signature | Reversal Strategy |
|---|---|---|---|
| Base64 (RFC 4648) | Web shells, email attachment payloads, stagers | Characters [A-Za-z0-9+/] with = padding |
Standard 6-bit index mapping to byte octets |
| Single-Byte XOR | Cobalt Strike beacons, encrypted C2 configs | High entropy with repetitive non-standard byte distributions | 255-key brute-force frequency scoring |
| PowerShell UTF-16LE | Fileless memory execution, scheduled tasks | Base64 payload decoding into interleaved null bytes (0x00) | Filter null octets or decode 16-bit code units |
| ROT13 / Caesar | Phishing kit URL bypass, UserAssist registry | Monoalphabetic shifted strings maintaining word lengths | Modulo 26 alphabetic rotation |
| Hex / Shellcode | Buffer overflow exploits, DLL injection arrays | Pairs of [0-9a-fA-F] often prefixed with \x or 0x |
Hex nibble pairing to uint8 values |
\x00, \xFF) in the text editor. You can download the exact uncorrupted bytes at any time using the "Download .bin" button.
DecompressionStream('gzip') and DecompressionStream('deflate') Stream APIs. When selected in the recipe chain, compressed byte streams are decompressed directly in memory without requiring external server processing.
"MALWARE" or 0xDE, 0xAD, 0xBE, 0xEF) is cycled across the ciphertext. The recipe operation allows you to specify either an ASCII string key or a hex-formatted key, cycling through each key byte sequentially against the input buffer.