Malware
PurpleFox
Purple Fox uses msi.dll function, 'MsiInstallProductA', to download and execute its payload.
PurpleFox is a Windows malware family.
Background
Purple Fox calls the msi.dll function 'MsiInstallProductA' to fetch and run its payload. That payload is a .msi file holding encrypted shellcode in both 32-bit and 64-bit variants. After it runs, the machine is rebooted and the 'PendingFileRenameOperations' registry key is used to rename the malware's components.
Following the reboot, Purple Fox activates its rootkit functionality. It spawns a suspended svchost process and injects a DLL that builds a driver providing the rootkit capability.
Recent versions repurpose open-source code to power their rootkit components, which hide and protect the malware's files and registry entries. They also abuse a file utility tool to conceal the DLL component, hindering reverse engineering.
Source: Malpedia (Fraunhofer FKIE).