File Signature Verification has nothing to do with launching arbitrary applications, but it is just a similar case to odbcad32.exe – the GUI apps can sometimes be abused to produce undesired effects – ones that their authors most likely have not anticipated…

Time for the recipe.

So we launch the sigverif.exe:

Then we go to Advanced settings by clicking the Advanced button, and we choose … the log file. And while we are at it why shouldn’t we choose the c:\windows\system32\calc.exe as a destination?
We then hit the View Log button, and voila. Calculator is on the screen:

This is a quick & dirty recipe how to load a DLL of your choice using a built-in tool ExtExport.exe that can be found inside the Internet Explorer directory:

Method #1

• Drop a file named like one of these:
  • mozcrt19.dll
  • mozsqlite3.dll
  • sqlite3.dll
    inside the c:\test folder
• Now run:
  • “C:\Program Files\Internet Explorer\ExtExport.exe” c:\test foo bar

This will load one (or all) of these DLLs.

Method #2

The tool has more arbitrary DLL loading possibilities that allow to specify the name of the library directly from a command line.

This method requires providing more arguments e.g.:

• ExtExport.exe c:\Test\test.dll 2 3 4 FIREFOX {00000000-0000-0000-0000-000000000000}

I have not explored what other arguments mean but you can swap them with whatever you want to evade static detection; what matters is that the first argument must be a DLL name we want to load and the last argument must be a valid GUID presented in a form shown in a syntax above (acceptable by the IID­From­String function).

Method #3

It’s actually a variant of the method 2 – we just need to swap ‘FIREFOX’ with ‘360SE’:

• ExtExport.exe c:\Test\test.dll 2 3 4 360SE {00000000-0000-0000-0000-000000000000}