DLLRunner
DLLRunner is a smart DLL execution script for malware analysis in sandbox systems.
Instead of executing a DLL file via "rundll32.exe file.dll" it analyzes the PE and executes all exported functions by name or ordinal in order to determine if one of the functions causes malicious activity.
rundll32.exe path/to/file.dll,exportedfunc1
rundll32.exe path/to/file.dll,exportedfunc2
rundll32.exe path/to/file.dll,exportedfunc3
Furthermore it tries to fuzz parameters in order to trigger acitivity in functions that require parameters to work.
rundll32.exe path/to/file.dll,exportedfunc1 "0"
rundll32.exe path/to/file.dll,exportedfunc1 "1"
rundll32.exe path/to/file.dll,exportedfunc1 "http://evil.local"
rundll32.exe path/to/file.dll,exportedfunc1 "Install"
...
Usage
usage: dllrunner.py [-h] [-f dllfile] [-l limit] [--fuzz] [--demo] [--debug]
DLLRunner
optional arguments:
-h, --help show this help message and exit
-f dllfile DLL file to execute exported functions
-l limit Only perform extended calls if export function count is less
than limit
--fuzz Add fuzzing parameters to the functions calls (currently 5
params are defined)
--demo Run a demo using \system32\url.dll
--debug Debug output