Suspicious ^80% windows Download

angry-birds-star-wars

External executable download via script

Uses Start-Process cmdletStart-Process call

SHA-256d46f13877e0a34fd1e9d9f8bb3fb0f17879c37f18e52928ad9c14eb2531f2060

URLhttps://community.chocolatey.org/api/v2/package/angry-birds-star-wars

Evidence

HTTP/HTTPS URL literal ChocolateyInstall.ps1 · lines 1–5

1﻿$ErrorActionPreference = 'Stop'
2$toolsDir       = "$(Split-Path -parent $MyInvocation.MyCommand.Definition)"
3$url            = 'https://d1x9snl812q4nd.cloudfront.net/installer/com.rovio.angrybirdsstarwars.ads.iap/Angry_Birds_Star_Wars-gameslol.exe'
4$checksum       = '97B86CFF43A0960407A7FF94A8D5B58ED66AF8896FDA1E861BC999270437595D'
5$ahkExe         = 'AutoHotKey'

USERPROFILE environment variable ChocolateyInstall.ps1 · lines 14–25

14  softwareName  = 'MobiGame'
15  checksum      = $checksum
16  checksumType  = 'sha256' 
17}
18
19Start-Process $ahkExe $ahkFile
20Install-ChocolateyPackage @packageArgs
21Start-sleep 2
22Remove-Item "$env:AppData\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\GamesLOL.lnk" -ea SilentlyContinue
23Remove-Item "$env:USERPROFILE\Desktop\GamesLOL.lnk" -ea SilentlyContinue
24Remove-Item "$env:AppData\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Angry Birds Star Wars.lnk" -ea SilentlyContinue
25Start-CheckAndStop "mobinotifier"

NuGet package declares dependencies angry-birds-star-wars.nuspec · lines 39–43

  <tags>rovio angry birds star wars mobiegame games notsilent</tags>
  <packageSourceUrl>https://github.com/bcurran3/ChocolateyPackages/tree/master/angry-birds-star-wars</packageSourceUrl>
  <dependencies>
    <dependency id="autohotkey" />
    <dependency id="chocolatey-misc-helpers.extension" version="0.0.2" />

No evidence locations were recorded for this file. Raw result