{
	"id": "62191254-bffd-4897-966c-17759bca6eb6",
	"created_at": "2026-04-06T00:18:40.391797Z",
	"updated_at": "2026-04-10T13:12:09.593383Z",
	"deleted_at": null,
	"sha1_hash": "75906f9253a3da0d1db71b6993dfefce3e221ec4",
	"title": "GitHub - peewpw/Invoke-PSImage: Encodes a PowerShell script in the pixels of a PNG file and generates a oneliner to execute",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 726736,
	"plain_text": "GitHub - peewpw/Invoke-PSImage: Encodes a PowerShell script in\r\nthe pixels of a PNG file and generates a oneliner to execute\r\nBy peewpw\r\nArchived: 2026-04-05 13:02:28 UTC\r\nEncodes a PowerShell script in the pixels of a PNG file and generates a oneliner to execute\r\nInvoke-PSImage takes a PowerShell script and encodes the bytes of the script into the pixels of a PNG image. It\r\ngenerates a oneliner for executing either from a file of from the web.\r\nIt can either create a new image using only the payload data, or it can embed the payload in the least significant\r\nbytes of an existing image so that it looks like an actual picture. The image is saved as a PNG, and can be\r\nlosslessly compressed without affecting the ability to execute the payload as the data is stored in the colors\r\nthemselves. When creating new images, normal PowerShell scripts are actually significantly compressed, usually\r\nproducing a png with a filesize ~50% of the original script.\r\nWith the embed method, the least significant 4 bits of 2 color values in each pixel are used to hold the payload.\r\nImage quality will suffer as a result, but it still looks decent. It can accept most image types as input, but output\r\nwill always be a PNG because it needs to be lossless. Each pixel of the image is used to hold one byte of script, so\r\nyou will need an image with at least as many pixels as bytes in your script. This is fairly easy—for example,\r\nInvoke-Mimikatz fits into a 1920x1200 image.\r\nArguments\r\n-Script [filepath] The path to the script to embed in the Image.\r\n-Out [filepath] The file to save the resulting image to (image will be a PNG)\r\n-Image [filepath] The image to embed the script in. (optional)\r\n-WebRequest Output a command for reading the image from the web using Net.WebClient. You will need to host\r\nthe image and insert the URL into the command.\r\n-PictureBox Output a command for reading the image from the web using System.Windows.Forms.PictureBox.\r\nYou will need to host the image and insert the URL into the command.\r\nExample\r\nCreate an image with the script \"Invoke-Mimikatz.ps1\" embeded in it and output a oneliner to execute from disk:\r\nPS\u003eImport-Module .\\Invoke-PSImage.ps1\r\nPS\u003eInvoke-PSImage -Script .\\Invoke-Mimikatz.ps1 -Out .\\evil-kiwi.png -Image .\\kiwi.jpg\r\nhttps://github.com/peewpw/Invoke-PSImage\r\nPage 1 of 2\n\n[Oneliner to execute from a file]\r\nCreate an image with the script \"Invoke-Mimikatz.ps1\" embeded in it and output a oneliner to execute from the\r\nweb (you still have to host the image and edit the URL):\r\nPS\u003eImport-Module .\\Invoke-PSImage.ps1\r\nPS\u003eInvoke-PSImage -Script .\\Invoke-Mimikatz.ps1 -Out .\\evil-kiwi.png -Image .\\kiwi.jpg -WebRequest\r\n [Oneliner to execute from the web]\r\nExecuting an image hosted on the web:\r\nSource: https://github.com/peewpw/Invoke-PSImage\r\nhttps://github.com/peewpw/Invoke-PSImage\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://github.com/peewpw/Invoke-PSImage"
	],
	"report_names": [
		"Invoke-PSImage"
	],
	"threat_actors": [],
	"ts_created_at": 1775434720,
	"ts_updated_at": 1775826729,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/75906f9253a3da0d1db71b6993dfefce3e221ec4.pdf",
		"text": "https://archive.orkl.eu/75906f9253a3da0d1db71b6993dfefce3e221ec4.txt",
		"img": "https://archive.orkl.eu/75906f9253a3da0d1db71b6993dfefce3e221ec4.jpg"
	}
}