Benign powershell Download

PSSailpoint.IaiRecommendations 2.1.40

PowerShell decodes Base64 with ConvertReferences named armored private-key header

SHA-25623bf2eb7403b8d56a0d9253307e0be0c26aa9fdd52fdeeeb92510d86d102fd93

URLhttps://www.powershellgallery.com/api/v2/package/PSSailpoint.IaiRecommendations/2.1.40

MaleculeTh

Evidence

Authorization header-name literal lines 42–50

19…  = 'Digest'
  # The 'Authorization' header is automatically generated by the client. It includes
  # the list of signed headers and a base64-encoded signature.
  $HEADER_AUTHORIZATION = 'Authorization'
46
  #Hash table to store singed headers
  $HttpSignedRequestHeader = @{ }
  $HttpSignatureHeader = @{ }
  $TargetHost = …

Encodes base64 in PowerShell lines 56–59

35… HashAlgorithm -eq "SHA256") {
      $Digest = [String]::Format("SHA-256={0}", [Convert]::ToBase64String($bodyHash))
  } elseif ($httpSigningConfiguration.HashAlgorithm -eq "SHA512") {
      $Digest = [String]::Format("SHA-512={ …

References named armored private-key header lines 168–197

6… 
  try {
170
      if ($hashAlgorithmName -eq "sha256") {
          $hashAlgo = [System.Security.Cryptography.HashAlgorithmName]::SHA256
      } elseif ($hashAlgorithmName -eq "sha512") {
          $hashAlgo = [System.Security.Cryptography.HashAlgorithmName]::SHA512
      }
176
      if ($PSVersionTable.PSVersion.Major -ge 7) {
          $ecKeyHeader = "-----BEGIN RSA PRIVATE KEY-----"
          $ecKeyFooter = "-----END RSA PRIVATE KEY-----"
          $keyStr = Get-Content -Path $PrivateKeyFilePath -Raw
          $ecKeyBase64String = $keyStr.Replace($ecKeyHeader, "").Replace($ecKeyFooter, "").Trim()
          $keyBytes = [System.Convert]::FromBase64String($ecKeyBase64String)
          $rsa = [System.Security.Cryptography.RSA]::Create()
          [int]$bytCount = 0
          $rsa.ImportRSAPrivateKey($keyBytes, [ref] $bytCount)
186
          if ($SigningAlgorithm -eq "RSASSA-PSS") {
              $signedBytes = $rsa.SignHash($DataToSign, $hashAlgo, [System.Security.Cryptography.RSASignaturePadding]::Pss)
          } else {
              $signedBytes = $rsa.SignHash($DataToSign, $hashAlgo, [System.Security.Cryptography.RSASignaturePadding]::Pkcs1)
          }
      } else {
          $rsa_provider_path = Join-Path -Path $PSScriptRoot -ChildPath "RSAEncryptionProvider.cs"
          $rsa_provider_sourceCode = Get-Content -Path $rsa_provider_path -Raw
          Add-Type -TypeDefinition $rsa_provider_sourceCode
196
          [System.Security.Cryptography.RSA]$rsa = [RSAEncryption.RSAEncryptionProvider]::GetRSAPro …

PowerShell .NET ECDSA object creation lines 250–274

  $ecKeyFooter = "-----END EC PRIVATE KEY-----"
  $keyStr = Get-Content -Path $ECKeyFilePath -Raw
  $ecKeyBase64String = $keyStr.Replace($ecKeyHeader, "").Replace($ecKeyFooter, "").Trim()
  $keyBytes = [System.Convert]::FromBase64String($ecKeyBase64String)
  $ecdsa = [System.Security.Cryptography.ECDsa]::Create()
255
  [int]$bytCount =0
  if (![string]::IsNullOrEmpty($KeyPassPhrase)) {
      $ecdsa.ImportEncryptedPkcs8PrivateKey($KeyPassPhrase,$keyBytes,[ref]$bytCount)
  } else {
      $ecdsa.ImportPkcs8PrivateKey($keyBytes,[ref]$bytCount)
  }
262
  $signedBytes = $ecdsa.SignHash($DataToSign)
  $derBytes =  ConvertTo-ECDSAANS1Format -RawBytes $signedBytes
  $signedString = [System.Convert]::ToBase64String($derBytes)
  return $signedString
267}
⋯7 lines

PowerShell .NET ComputeHash call lines 291–301

291:40… ryptography.HashAlgorithm]::Create($HashName)
292    $hashAlgorithm.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($String))
293}
294
⋯7 lines

No evidence locations were recorded for this file. Raw result