[Vrtule]

Hello,

I know that the Rundll32 program allows anybody to execute a function exported by a dynamic link library (DLL). The syntax of the command is the following:

Code: Select all

RunDll32 <DllName>,<FunctionName> <StringsPassedToTheDll>

I thought the DllName argument must point to a valid dynamic link library file. However, I recently found RunDll32 command where the argument pointed to a binary file. The binary file contained only a number written as unicode (wide character) string.

Does anybody have any information about using the RunDll32 with this "type" of the RunDll argument?

Thanks in advance

[EP_X0FF]

Example of command and file content.

[Vrtule]

Hello,

the command is:

Code: Select all

rundll32 C:\Users\Martin\AppData\Roaming\PkgMgrr.dll,Okheh

and conent of the PkgMgrr.dll file is (in hex):

Code: Select all

00: 31 00 33 00 31 00 33 00 39 00 31 00 34 00 30 00 
10: 33 00 39 00                                                  

[EP_X0FF]

That's Reveton.

http://www.kernelmode.info/forum/viewto ... 867#p18867