Benign powershell Download

ps12exe 0.6.5

PowerShell dynamic scriptblock invokePowerShell compiles C# source at runtime

SHA-2563f6350c03f9707dfa4d7681b321cdab77937a2ba2a03920010a0ca61c7a26478

URLhttps://www.powershellgallery.com/api/v2/package/ps12exe/0.6.5

MaleculeK₂(AmLi₂)O₁₁(As₅Er₇Xe₅AlC₈CaCo₂DyIPPr)H₁₀(Cm₁₇Cr₄Db₂₃DsF₁₁Mg₂Os₁₀Po₁₄TiU₇)Md₆(Bi₄In₉Pa₅Pt₃Si)Th₂

Evidence

Encoded URL references Microsoft documentation ps12exe.ps1 · lines 48–51

48:89… r culture)
49- Options: additional compiler options (see https://msdn.microsoft.com/en-us/library/78f4aasd.aspx)
50- KeepSource: keep the generated C# source for debugging (default: $false)
51- Minify: scriptblock  …

Windows public or temp directory path ps12exe.ps1 · lines 51–57

51:32…  the script before compiling
52- TempDir: directory for storing temporary files (default: random directory in %temp%)
53
54.PARAMETER Resources
55A hashtable of version resources embedded into the compiled executable.
56Supported keys are 'Icon', 'Title', 'Description', 'Company', 'Product', 'Copyright', 'Trademark', 'Version'.
57Icon can be a file path or URL to an icon file. All other values are …

PowerShell dynamic scriptblock invoke ps12exe.ps1 · lines 343–354

8… et-Command $minifyer -ErrorAction Ignore) {
	$minifyer = "$minifyer `$_"
}
$minifyer = [scriptblock]::Create($minifyer)
}
if ($minifyer) {
⋯6 lines

PowerShell compiles C# source at runtime CodeDomCompiler.ps1 · lines 132–156

25… $script:CacheRoot ("build_" + [Guid]::NewGuid().ToString('N'))
New-Item -ItemType Directory -Path $buildDir -Force | Out-Null
try {
	$phPath = Join-Path $buildDir $ResourceName
	[System.IO.File]::WriteAllBytes($phPath, [byte[]]::new($Bucket))
	$templateOut = Join-Path $buildDir $AssemblyName
	$p = New-CompilerParameters $templateOut $Options $FALSE
	[VOID]$p.EmbeddedResources.Add($phPath)
	$r = $cop.CompileAssemblyFromSource($p, $Source)
	if ($r.Errors.Count -gt 0) { throw ($r.Errors -join "`n") }
	$bytes = [System.IO.File]::ReadAllBytes($templateOut)
	Set-CachedBytes $cachePath $bytes
	return , $bytes
}
finally {
	Remove-Item -LiteralPath $buildDir -Recurse -Force -ErrorAction Ignore
}
}
⋯7 lines

Delete script files using del es-ES.ps1 · lines 336–340

7… DoesNotExist         = "El archivo no existe."
EnterOutputFile          = "Introduce la ruta del archivo de salida (dejar en blanco para <exe>.ps1 en la misma carpeta):"
OutputFileExtensionError	= "El archivo de salida debe ser '.ps1'. Se añadirá la extensión."
AdditionalInfoPrompt     = "[Y/N]"
ConvertAnother           = "� …

Showing the top 5 files — 7 more files (114 regions) not shown.

No evidence locations were recorded for this file. Raw result