Ieframe.dll

Internet Browser DLL for translating HTML code.

Paths

  • c:\windows\system32\ieframe.dll
  • c:\windows\syswow64\ieframe.dll

Commands

Execute

Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL.

Use case: Load an executable payload by calling a .url file with or without quotes. The .url file extension can be renamed.

Privileges: User

rundll32.exe ieframe.dll,OpenURL {PATH_ABSOLUTE:.url}

Detection

Resources