#ShellExecute - Twitter Hashtag

over 2 years ago

ShellExecute can perform a variety of operations, from opening a file or program to printing its contents. In this article, we will show you how to use #ShellExecute functions in #Delphi. https://t.co/Ty0FQrAnsN #Embarcadero #Coding #ShellExecuteFunctions #Development #DelphiApp

natali110686's tweet photo. ShellExecute can perform a variety of operations, from opening a file or program to printing its contents. In this article, we will show you how to use #ShellExecute functions in #Delphi.
https://t.co/Ty0FQrAnsN

#Embarcadero #Coding #ShellExecuteFunctions #Development #DelphiApp https://t.co/qu5ZEhc1Z8

0

3

1

0

62

Malwrologist

@DissectMalware

over 7 years ago

Wanted to call #win32 api indirectly in #powershell? you can use #excel #application #com #CLSID 00024500-0000-0000-C000-000000000046 related: https://t.co/INH0Xy3PN9 Example: calling #shell32 #ShellExecute using #Application.#ExecuteExcel4Macro

DissectMalware's tweet photo. Wanted to call #win32 api indirectly in #powershell? you can use #excel #application #com

#CLSID 00024500-0000-0000-C000-000000000046

related: https://t.co/INH0Xy3PN9

Example: calling #shell32 #ShellExecute using #Application.#ExecuteExcel4Macro https://t.co/pLMlApXj52

Malwrologist

@DissectMalware

over 7 years ago

Wanted to call #win32 api directly from #excel using #vba w/o declaring the signature 1st Call #ShellExecuteA: Application.ExecuteExcel4Macro "call(""shell32"", ""ShellExecuteA"", ""JJCCCCJ"", 0, ""open"",""calc"", """", """", 5)" JJCCCCJ return/param1/.../param6 J int C string

DissectMalware's tweet photo. Wanted to call #win32 api directly from #excel using #vba w/o declaring the signature 1st

Call #ShellExecuteA:
Application.ExecuteExcel4Macro "call(""shell32"", ""ShellExecuteA"", ""JJCCCCJ"", 0, ""open"",""calc"", """", """", 5)"

JJCCCCJ
return/param1/.../param6
J int
C string https://t.co/v6EokqsLs3

4

228

127

17

0

3

116

60

7

0

Malwrologist

@DissectMalware

almost 8 years ago

#mal #rtf (exploiting #equation3) dlls a malware using #urlmon.dll #URLDownloadToFile func and exes it using #shell32.dll #ShellExecute func https://t.co/xEbxJe7x8G #mal #url hxxp://iesagradafamiliapalestina.edu.co/PO.jpg #rtf https://t.co/68o1Vrip9q #pe https://t.co/68o1Vrip9q

DissectMalware's tweet photo. #mal #rtf (exploiting #equation3) dlls a malware using #urlmon.dll #URLDownloadToFile func and exes it using #shell32.dll #ShellExecute func
https://t.co/xEbxJe7x8G
#mal #url hxxp://iesagradafamiliapalestina.edu.co/PO.jpg #rtf https://t.co/68o1Vrip9q
#pe https://t.co/68o1Vrip9q https://t.co/Tgh4xcVrQK

0

16

5

0

Malwrologist

@DissectMalware

about 8 years ago

#powershell tidbit: how to execute a command with #shell in a hard way? instantiate a #shell #com object with #clsid (13709620-C279-11CE-A49E-444553540000), and then call #shellexecute It also has a few other useful funcs: #GetSystemInformation, #Shutdown, #ServiceStart, ...