The lpszCmdLine parameter is given the value specified on the rundll32 command line.We will try to figure out how Rundll32 is able to call the function RunHTMLApplication exported by the library mshtml.dll and how the “javascript:” prefix is used to execute actual JavaScript code.
The particularity of this malware is that it resides in the Windows registry and uses rundll32.exe to execute JavaScript code.I found it funny that we can execute some JavaScript through Rundll32 and obviously I was not the only one.When we first saw the command line executing JavaScript, we were wondering how it worked.In this blog post, we analyze how and why JavaScript is executed when calling this simple command line.
Posted at 16:46h in byRecently, provided a detailed walkthrough on the reverse engineering forum about Win32/Poweliks malware.
0 kommentar(er)
