Zipfldr.dll

Compressed Folder library

Paths

  • c:\windows\system32\zipfldr.dll
  • c:\windows\syswow64\zipfldr.dll

Commands

Execute

Launch an executable payload by calling RouteTheCall.

Use case: Launch an executable.

Privileges: User

rundll32.exe zipfldr.dll,RouteTheCall {PATH:.exe}

Execute

Launch an executable payload by calling RouteTheCall (obfuscated).

Use case: Launch an executable.

Privileges: User

rundll32.exe zipfldr.dll,RouteTheCall file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e

Detection

Resources