home

rundll32.exe

Run a DLL as an App

Microsoft Corporation

Rundll allows various libraries (DLL files) to be loaded as a process by allowing the operating system to invoke a function exported from a DLL. The file has been seen being downloaded from dl-mail.ymail.com and multiple other hosts.
Publisher:
Microsoft Corporation

Product:
Microsoft® Windows® Operating System

Description:
Run a DLL as an App

 
Part of the Windows XP Operating System

Version:
5.1.2600.5512 (xpsp.080413-2105)

MD5:
037b1e7798960e0420003d05bb577ee6

SHA-1:
303a90020bf3beaf9acd0ea86487c853636a99a3

SHA-256:
dee53d6d332dadd40c0ce34a425a6c0781f611765dcd4299d869f2b1ee80ae66

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
11/15/2024 9:21:00 AM UTC  (today)

File size:
32.5 KB (33,280 bytes)

Product version:
5.1.2600.5512

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
RUNDLL.EXE

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Windows\System32\rundll32.exe

File PE Metadata
Compilation timestamp:
4/13/2008 7:37:09 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
384:4rvAw66vILDzNRhbHeJh8+oXBjxJd5IyYQGSbdkDjkoebjDISEWa1gW:4vAOUbSEln5IyYpamDjobj8Sw1

Entry address:
0x1BDC

Entry point:
E8, 0A, 00, 00, 00, E9, 65, FF, FF, FF, CC, CC, CC, CC, CC, 8B, FF, 55, 8B, EC, 83, EC, 10, A1, 10, 30, 00, 01, 85, C0, 74, 07, 3D, 40, BB, 00, 00, 75, 4D, 56, 8D, 45, F8, 50, FF, 15, 74, 10, 00, 01, 8B, 75, FC, 33, 75, F8, FF, 15, 70, 10, 00, 01, 33, F0, FF, 15, 6C, 10, 00, 01, 33, F0, FF, 15, 68, 10, 00, 01, 33, F0, 8D, 45, F0, 50, FF, 15, 64, 10, 00, 01, 8B, 45, F4, 33, 45, F0, 33, C6, 25, FF, FF, 00, 00, 5E, 75, 05, B8, 40, BB, 00, 00, A3, 10, 30, 00, 01, F7, D0, A3, 0C, 30, 00, 01, C9, C3, CC, CC, CC...
 
[+]

Entropy:
5.6460

Code size:
5 KB (5,120 bytes)

The file rundll32.exe has been seen being distributed by the following 13 URLs.

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-e_JQc63afb5kRy3u_OjyDUMolDET8P5TFf0o_LVsCie-Ul0HCpuLJvOYmvFySxyl/messages/@.id==AHbsw0MAAAMDVwW9mAjCMJXEb3E/content/parts/@.id==2/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBZQwXsQj-vd7gGDZZpJvT9r4QS589m2ULn4HOf3kMCF_g&error=https://us-mg6.mail.yahoo.com/.../iframemsg?id=da1f4921-c7d6-5421-ed3b-750bddf3b100&ymreqid=28d0c69f-8229-6d71-01f5-8f0022010000

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-kJOztV19EloopywiyzD0pH94lk_DfcaYaFTGXBXfmLHpNu_aN0j4wTGkGod-URju-OZtZrw2rULBXQ-scIJXZQ/messages/@.id==AD8NiWIAABWBVdQ7PwIbEKcvKtI/content/parts/@.id==3/raw?appid=YahooMailNeo&ymreqid=8b05a3d5-308a-8a9c-0166-6b001d010000&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBaOa8NjGeKhN69PwXnNyHbv1Fu8QsP_Ca_d6tcx0agSytXSRikrv4dQK_yh62yfLak6y0cZDZK87O4GU8LnZAz6&error=https://mg.mail.yahoo.com/.../iframemsg?id=cead5501-5a8c-b15d-2b21-72968cb40517

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-YWxkE_72yAVgEZA2l-MJ0SbBNTrNOeb7q0NtVWrYf3mZadAafWwTDo6HVziKtMsu/messages/@.id==AH7sw0MAAcqgV7hVrgYeaDwMoFc/content/parts/@.id==5/raw?appid=YahooMailNeo&ymreqid=3c18f758-3ef7-112b-019a-bb00e4010000&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBZyZ-8ma8hHdGcinA8jK8dn6F676llwJijNHGM9Rx73ng&error=https://vn-mg6.mail.yahoo.com/.../iframemsg?id=6e66823c-4904-1836-1e69-8d5c65d035d0

http://i61.tinypic.com/2j0jaro.jpg

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-0TKb5Nm8qq8WczHS2_5tQrLXVPrwukgA_9oP1bouObpnDJmu_wzcrTtDOBCvdTB0/messages/@.id==AFzuw0MADD05VyosHgq-AK7IAlA/content/parts/@.id==2/raw?appid=YahooMailNeo&ymreqid=48cefa74-93eb-e8c8-01b7-270027010000&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBa_FwR6YwcjxYb9YcHSh0176F676llwJijNHGM9Rx73ng&error=https://us-mg6.mail.yahoo.com/.../iframemsg?id=70cb2e2a-8414-605e-190f-f4bfa75ad4cb

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-tOHZNscVBjldLCqEodh9dxTKLVr49IKuPJkkVzsnZuHmOAlxdpsK_DEsfGsHnAmY/messages/@.id==AEp3w0MAAEOJVxUvlggxqFZt5co/content/parts/@.id==2/raw?appid=YahooMailNeo&ymreqid=0910f7f4-bd23-6e42-012e-bd00a9010000&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBbW47queHd0qRLzhNDwT4sbUWhjIv2uHVC2R0Wv8Q9VgQ&error=https://us-mg4.mail.yahoo.com/.../iframemsg?id=a1e5eb01-2e98-de45-3151-fbf7203c82ee

https://mg.mail.yahoo.com/ya/.../QymSJe1gOA&fid=Draft&pid=2&clean=0&appid=YahooMailNeo

https://mg.mail.yahoo.com/.../download?mid=2_0_0_1_171880_AIati2IAACPeUzAOHgAAAHJGsYg&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo

https://scontent-hkg3-1.xx.fbcdn.net/hphotos-xfa1/v/.../12348720_1644792279142137_517736861_n.jpg?oh=9177bd11b72b72bfb430b10d443f5cc8&oe=566CB22E

https://ps2xka.bn1301.livefilestore.com/.../rundll32.exe

https://ne1-attach.ymail.com/us.f1223.mail.yahoo.com/.../securedownload?mid=2_0_0_2_17632_AJt2imIAAAd0UgdAkgAAAKCXcUE&fid=Sent&pid=2&clean=0&appid=YahooMailNeo&cred=aE3xUJ15jd2QGW_8OrDYcvZPh8ZErCGfForZHD6lBTESv2kTMHKGbqB5&ts=1388067407&partner=ymail&sig=Umc1UHi4uCwS6HyDIRiEXg--

https://ne1-attach.ymail.com/us.f1223.mail.yahoo.com/.../securedownload?mid=2_0_0_2_17632_AJt2imIAAAd0UgdAkgAAAKCXcUE&fid=Sent&pid=2&clean=0&appid=YahooMailNeo&cred=B4YNOFkxjd3GExH59W7buN6ld_l.Mxu0U_iyKaM9x.oAy4ezxjcLvbLl&ts=1388067335&partner=ymail&sig=CFX2ieXFVzjagcvqAoJdsg--

https://us-mg5.mail.yahoo.com/.../download?mid=2_0_0_2_17632_AJt2imIAAAd0UgdAkgAAAKCXcUE&fid=Sent&pid=2&clean=0&appid=YahooMailNeo

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.