From e5935050216c31e8333cee5922eb1acca90d468d Mon Sep 17 00:00:00 2001
From: rajeshnataraj <rajesh.nataraj@sophos.com>
Date: Sat, 9 Apr 2022 17:31:10 +0100
Subject: [PATCH] updated worker js similar to http://amsi.fail

---
 docs/worker.js | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/docs/worker.js b/docs/worker.js
index a9bb2a6..7184855 100644
--- a/docs/worker.js
+++ b/docs/worker.js
@@ -303,7 +303,32 @@ function encodePayload(input){
         input = input.replaceAll(word, obf)
     }
 
-    return input
+    input = input.replace(";", ";$" + getRandomJunk() + "=\"" + obfuscateString(getRandomJunk())+ "\";[Threading.Thread]::Sleep(" +randomInt(2000)+");")
+    
+    let nullValue = randomCase(randomString(randomInt(10)))
+
+    input = input.replace("$null","$" + nullValue)
+
+    input + ";$" + getRandomJunk() + "=\"" + obfuscateString(getRandomJunk())+ "\";[Threading.Thread]::Sleep(" +randomInt(2000)+")"
+
+    input=  input.replace(";;","")
+
+    return input.replace("\n","\n$" + nullValue + "=$null;")
+}
+
+/**
+ * creates a random junk 
+ * @param {Integer} length
+ * @returns {String} random string of a given length
+ */
+ function getRandomJunk(){
+    let length = randomInt(30) 
+    const alphabet = "abcdefghijklmnopqrstuvwxyz"
+    let ret = ""
+    for(var i=0; i < length; i++){
+        ret += alphabet[Math.floor(Math.random() * alphabet.length)]
+    }
+    return ret
 }
 
 /**