Windows/Defense_Evasion/Deobfuscate_Decode_Files_Or_Information.md

# Deobfuscate/Decode Files Or Information

MITRE ATT&CK Technique: [T1140](https://attack.mitre.org/wiki/Technique/T1140)

## Example encode executable

    certutil.exe -encode file.exe file.txt

## Example decode executable

    certutil.exe -decode file.txt file.exe
certutil encode/decode 2017-11-01 16:52:46 -06:00			`# Deobfuscate/Decode Files Or Information`

			`MITRE ATT&CK Technique: [T1140](https://attack.mitre.org/wiki/Technique/T1140)`

			`## Example encode executable`
Fixes 2018-01-11 11:00:46 -07:00
certutil fix 2017-11-01 17:11:21 -06:00			`certutil.exe -encode file.exe file.txt`
certutil encode/decode 2017-11-01 16:52:46 -06:00
			`## Example decode executable`
Fixes 2018-01-11 11:00:46 -07:00
certutil encode/decode 2017-11-01 16:52:46 -06:00			`certutil.exe -decode file.txt file.exe`