I am rather new to reversing and currently I am trying to reverse and understand one of the malware samples that seem to be used by DPRK actors to target security researchers.



The sample I am looking at is efscore.dll (SHA256: 4c3499f3cc4a4fdc7e67417e055891c78540282dccc57e37a01167dfe351b244). It is called via rundll32.exe with some arguments:

rundll32.exe efscore.dll,CMS_dataFinal Bx9yb37GEcJNK6bt 4901

So from my understanding the Function CMS_dataFinal is called as entry point. But the code of the function contains just a return and nothing more. However there is a wide-character version of the function CMS_dataFinalW which does much more and is the real function that is called. (Debugging confirmed this)

So here is my question which might be basic, but I can't get it into my head: How does the program know/decide that the wide-character version CMS_dataFinalW has to be called?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.