powershellmalwaredeobfuscation

What does [TYPE] mean in powershell

I'm currently working on deobfuscating a piece of powershell code used in a trickbot campaign.

I understand that the script is initializing a system directory object to create a new directory, but I don't understand what [TYPE] actually does or why it is required.

I have tried to google this, but I cant really find any satisfying answer.

Set-Item 'variAblE:8TKm0' ([TYPE]"system.io.directory");

(Get-Item 'variAblE:8TKm0').Value::"CreateDirectory"($HOME + "\Frv3p35\Ntwhagi\");
Solution

  • Its a data type: The most common DataTypes (type accelerators) used in PowerShell are listed below.

    [string] Fixed-length string of Unicode characters
    [char] A Unicode 16-bit character
    [byte] An 8-bit unsigned character

    [int] 32-bit signed integer
    [long] 64-bit signed integer

    [bool] Boolean True/False value

    [decimal] A 128-bit decimal value
    [single] Single-precision 32-bit floating point number
    [double] Double-precision 64-bit floating point number
    [DateTime] Date and Time

    [xml] Xml object
    [array] An array of values
    [hashtable] Hashtable object

    enter image description here ref: https://ss64.com/ps/syntax-datatypes.html