Learning Malware Analysis

6. Dynamic-Link Library (DLL) Analysis

A Dynamic-Link Library (DLL) is a module that contains functions (called exported functions or exports) that can be used by another program (such as an Executable or DLL). An executable can use the functions implemented in a DLL by importing it from the DLL.

The Windows operating system contains many DLLs that export various functions called Application Programming Interfaces (APIs). The functions contained in these DLLs are used by the processes to interact with the file system, process, registry, network, and the graphical user interface (GUI).

To display the exported functions in CFF Explorer tool, load the PE file that export functions and click on Export Directory. The following screenshot show ...