LOLBAS. GitHub
LIVING OFF THE LAND / OS LIBRARIES

Zipfldr.dll

View source

Compressed Folder library

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1218.011

Launch an executable payload by calling RouteTheCall.

COMMAND
rundll32.exe zipfldr.dll,RouteTheCall {PATH:.exe}
USE CASE
Launch an executable.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXE
EXAMPLE 02T1218.011

Launch an executable payload by calling RouteTheCall (obfuscated).

COMMAND
rundll32.exe zipfldr.dll,RouteTheCall file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e
USE CASE
Launch an executable.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXE
02 / ON DISK

Known paths

c:\windows\system32\zipfldr.dll
c:\windows\syswow64\zipfldr.dll
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Moriarty (Execution)@moriarty_meng
r0lan (Obfuscation)@r0lan