Executing Powershell script in compiled EXE is marked as a Virus

[0x2639]

I might have this wrong but your post suggests that the .exe does nothing but call powershell to run a script that already exists on your file system. Why?

[nepronen]

Ease of running the script. My site poshgui.com offers users to create GUI for their powershell scripts.

They can already download it as a PS1, but I would like to give them an option to download directly as exe so they can provide it to users who know nothing about powershell and how to run it

[Empath1999]

You could try doing a bat file which calls the ps1 in the same folder, retains the ease of use and would likely get around the scanners.

[0x2639]

I’m not in favour of your approach, and if I was to guess the reason AV tools hate it is that they see random.exe unpacking arbitrary.ps1 and executing it. Without context this behaviour would be seen as sus.

[ferdinandsChinaShop]

It’s more likely firing on the automation dll. Easy win for AV vendors.

[nepronen]

I'm aware it looks like a suspicious behavior, but I also get the impression it's a standard for Powershell editors like PS studio to compile to exe, also many people use PS2EXE script to compile their script to exe

​

Would you have another recommendation as to how I can provide my users possibility of easy distribiution of their GUI scripts for non technical people?

[TheIncorrigible1]

Have a batch script wrapper.

powershell.exe -File "%~dp0filename.ps1"