![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgQ2X-BCrwRy-nJBlsQGKdBPQhNy0bt7FutEcB95yInhpv08HCsNeGrL5IFHW4MOuW9uBVfLLUK_GOcAHrGIZUjlA4wAoMdofEWPW0JEKhcIlznvi0jBNKgZX5Cz7PyyDoYZyeAE1G5yQ/s640/morphHTA.png) morphHTA is a Morphing Cobalt Strike PowerShell Evil HTA Generator **Usage** : usage: morph-hta.py [-h] [--in ] [--out ] [--maxstrlen ] [--maxvarlen ] [--maxnumsplit ] optional arguments: -h, --help show this help message and exit --in File to input Cobalt Strike PowerShell HTA --out File to output the morphed HTA to --maxstrlen Max length of randomly generated strings --maxvarlen Max length of randomly generated variable names --maxnumsplit Max number of times values should be split in chr obfuscation **Examples:** /morphHTA# python morph-hta.py ███╗ ███╗ ██████╗ ██████╗ ██████╗ ██╗ ██╗ ██╗ ██╗████████╗ █████╗ ████╗ ████║██╔═══██╗██╔══██╗██╔══██╗██║ ██║ ██║ ██║╚══██╔══╝██╔══██╗ ██╔████╔██║██║ ██║██████╔╝██████╔╝███████║█████╗███████║ ██║ ███████║ ██║╚██╔╝██║██║ ██║██╔══██╗██╔═══╝ ██╔══██║╚════╝██╔══██║ ██║ ██╔══██║ ██║ ╚═╝ ██║╚██████╔╝██║ ██║██║ ██║ ██║ ██║ ██║ ██║ ██║ ██║ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ Morphing Evil.HTA from Cobalt Strike Author: Vincent Yiu (@vysec, @vysecurity) [*] morphHTA initiated [+] Writing payload to morph.hta [+] Payload written ** ****Max variable name length and randomly generated string length reduced to reduce the overall size of HTA output:** /morphHTA# python morph-hta.py --maxstrlen 4 --maxvarlen 4 **Max split in chr() obfuscation, this reduces the number of additions we do to reduce length:** /morphHTA# python morph-hta.py --maxnumsplit 4 **Change input file and output files:** /morphHTA# python morph-hta.py --in advert.hta --out advert-morph.hta **VirusTotal Example** **_I suggest not uploading to VT_** : ![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2xMVVz35YRuL9rYQwK70yQUuMkhPE4XaXjDSrZWl0cc40GfCZLretMQaCIaYzFqZ0ahHOnKs30J7D3wnkjakPhsnmiIVNnAk2oybzQwkE0OQBS_ATJbNMXkwOv-KHqh8jq1D1wmwo7jk/s640/morphHTA_2.png) **Example of Obfuscated HTA content** ![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLyzti35InlKgINLHXkh6PqAZeOGdOlIkJEqCll5xRrZNHV0Dw-Aijy_5v88m67GlBnJaJ0l57HpjBbvRttqYyLhyphenhyphen5SRKjIVNGDjd2C5ZowfLW6e-T-OqtwuwUiHSeQGn_V97nYXNMnxQ/s640/morphHTA_3.png) **Download morphHTA**

morphHTA - Morphing Cobalt Strike PowerShell Evil HTA Generator