Learning Malware Analysis

1.6.2 Analyzing PowerShell Commands/Scripts

Powershell commands are easy to understand compared to assembly code, but in some situations (such as when a PowerShell command is obfuscated), you may want to run the PowerShell commands to understand how it works. The easiest method to test a single command is to execute it in the interactive PowerShell. If you wish to execute a PowerShell script (.ps1) containing multiple commands, first change the execution policy setting to either Bypass or Unrestricted (as mentioned previously) and then execute the script using the PowerShell console. Remember to execute malicious script in an isolated environment.

Running the script (.ps1) in the PowerShell prompt will run all the commands at once. If you ...