This function searches for a comma (‘,’, 0x2C) to locate the DLL name and for a space (‘ ‘, 0x20) to locate the entrypoint name.When using our sample command line, ParseCommand returns javascript:'.mshtml as the DLL name and RunHTMLApplication as the entrypoint. Analysis of Rundll32 ParametersOne of the first things done by Rundll32 is to parse the command line in the internal function ParseCommand.

The lpszCmdLine parameter is given the value specified on the rundll32 command line.We will try to figure out how Rundll32 is able to call the function RunHTMLApplication exported by the library mshtml.dll and how the “javascript:” prefix is used to execute actual JavaScript code. The particularity of this malware is that it resides in the Windows registry and uses rundll32.exe to execute JavaScript code.I found it funny that we can execute some JavaScript through Rundll32 and obviously I was not the only one.When we first saw the command line executing JavaScript, we were wondering how it worked.In this blog post, we analyze how and why JavaScript is executed when calling this simple command line. Posted at 16:46h in byRecently, provided a detailed walkthrough on the reverse engineering forum about Win32/Poweliks malware.

Mshta exe command line parameters