{"id":2734,"date":"2015-01-01T12:13:32","date_gmt":"2015-01-01T12:13:32","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=2734"},"modified":"2015-01-01T12:14:15","modified_gmt":"2015-01-01T12:14:15","slug":"beyond-good-ol-run-key-part-20","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2015\/01\/01\/beyond-good-ol-run-key-part-20\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 20"},"content":{"rendered":"<p>Visual Basic is a goldmine when it comes to legacy code and some weird stuff (one example is &#8211; which doesn&#8217;t really matter for this post, but it&#8217;s just worth mentioning &#8211; that anytime a VB application exits it tries to find a .hlp file f.ex. \\windows\\system32\\.hlp and if it finds it it will try to open it using a WinHelp API).<\/p>\n<p>Anyway. In today&#8217;s post we describe yet another persistence mechanism related to VB which works on localized systems, but could be potentially adapted to English systems as well.<\/p>\n<p>The idea is simple and it&#8217;s yet another example of a feature which is rarely used nowadays, but could be adapted for malicious purposes. It&#8217;s about localization DLLs that\u00a0msvbvm60.dll loads by default when a VB application is launched on a non-English systems.<\/p>\n<p>The naming convention for these DLLs is vb6&lt;language code&gt;.dll e.g. vb6ar.dll for Arabic, vb6ru.dll for Russian. Dropping these into e.g. c:\\windows\\system32\\ will ensure that they are loaded anytime VB application starts (and exits).<\/p>\n<p>Example for Russian system:<\/p>\n<ul>\n<li>Application Start:<br \/>\n<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/01\/vb6ru_attach.png\"><img decoding=\"async\" loading=\"lazy\" class=\" size-full wp-image-2736 alignleft\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/01\/vb6ru_attach.png\" alt=\"vb6ru_attach\" width=\"245\" height=\"107\" \/><\/a><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>Application Exit:<br \/>\n<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/01\/vb6ru_detach.png\"><img decoding=\"async\" loading=\"lazy\" class=\" size-full wp-image-2737 alignleft\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/01\/vb6ru_detach.png\" alt=\"vb6ru_detach\" width=\"243\" height=\"107\" \/><\/a><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>Or, as seen in DebugView:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/01\/vb6ru.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-2735\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/01\/vb6ru.png\" alt=\"vb6ru\" width=\"500\" height=\"300\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/01\/vb6ru.png 500w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/01\/vb6ru-300x180.png 300w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n<p>There is a bonus for OS where the language is set to Arabic or Hebrew. On such systems VB will attempt to load one more extra library called vbame.dll.<\/p>\n<p>Dropping vbame.dll and vb6ar.dll inside c:\\windows\\system32 on Arabic Windows will ensure these DLLs are loaded anytime someone starts VB app:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/01\/vb6ar.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-2738\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/01\/vb6ar.png\" alt=\"vb6ar\" width=\"500\" height=\"300\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/01\/vb6ar.png 500w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/01\/vb6ar-300x180.png 300w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Visual Basic is a goldmine when it comes to legacy code and some weird stuff (one example is &#8211; which doesn&#8217;t really matter for this post, but it&#8217;s just worth mentioning &#8211; that anytime a VB application exits it tries &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2015\/01\/01\/beyond-good-ol-run-key-part-20\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,35,15,19],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/2734"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=2734"}],"version-history":[{"count":4,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/2734\/revisions"}],"predecessor-version":[{"id":2742,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/2734\/revisions\/2742"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=2734"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=2734"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=2734"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}