Learning Malware Analysis

6.1 Why Attackers Use DLLs

You will often see malware authors distributing their malicious code as DLL instead of executable files. The following list outlines some of the reasons why attackers implement their malicious code as DLLs:

• A DLL cannot be executed by double-clicking; DLL needs a host process to run. By distributing the malicious code as a DLL, a malware author can load his/her DLL into any process, including a legitimate process such as Explorer.exe, winlogon.exe, and so on. This technique gives the attacker the capability to hide a malware's actions, and all the malicious activity performed by the malware will appear to originate from the host process.
• Injecting a DLL into an already running process provides the attacker with ...