Learning Malware Analysis

3.4.3 How Attackers Use Shims

The following steps describe the manner in which an attacker may shim an application and install it on a victim system:

• An attacker creates an application compatibility database (shim database) for the target application (such as notepad.exe, or any legitimate third-party application frequently used by the victim). An attacker can choose a single shim, such as InjectDll, or multiple shims.
• The attacker saves the shim database (.sdb file) created for the target application.
• The .sdb file is delivered and dropped on the victim system (mostly via malware), and it is installed, typically using the sdbinst utility.
• The attacker invokes the target application or waits for the user to execute the target application. ...