deviceassociation[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

deviceassociation.dll
Size

45KB
MD5

55e0493dec6aa683a4dec7e8bb22d3ac
SHA1

18e0bf17b809282a2e91d47904fef3ea756898b0
SHA256

a73c8a76064a8caaf89c2cbed50ae392d660cc050cf95dde2654351d6825c587
SHA512

f8316ffc17137aba834b6da9edc3531c21d0f4d73cb62bf96c1d6bca280097847e594b1757c37038600eead61b9c901e302696f716db11ee389985d9fe2d2b0e
SSDEEP

768:n7tOAIVQU4gNNuomRQdEvJQeigKPap91Pzi9zEL:nQAIVQUtuhQIJQfP4rPz+zEL

Score

1^/10

Malware Config

Signatures

Files

deviceassociation.dll
.dll windows:10 windows x86 arch:x86

13a349ff56669f13169a941309e873dd

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

89:10:c7:d3:0f:6b:6b:02:1d:22:19:72:30:1e:ea:9f:9c:8a:9b:d6:0d:1e:45:b9:32:5e:d4:9f:d4:b0:54:b7
Signer

Actual PE Digest

89:10:c7:d3:0f:6b:6b:02:1d:22:19:72:30:1e:ea:9f:9c:8a:9b:d6:0d:1e:45:b9:32:5e:d4:9f:d4:b0:54:b7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

deviceassociation.pdb

Imports

msvcrt

_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
free
malloc
memset

ntdll

RtlCompareMemory

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
TraceMessage
RegisterTraceGuidsW
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableLevel

api-ms-win-core-synch-l1-1-0

CreateEventW
AcquireSRWLockExclusive
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
SleepEx
SetEvent
ReleaseSRWLockExclusive
InitializeCriticalSection

rpcrt4

RpcAsyncCompleteCall
RpcBindingFromStringBindingW
RpcStringFreeW
NdrClientCall4
NdrAsyncClientCall2
RpcExceptionFilter
RpcAsyncCancelCall
RpcAsyncInitializeHandle
RpcBindingSetOption
I_RpcExceptionFilter
RpcStringBindingComposeW
RpcSsDestroyClientContext
RpcBindingFree

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-threadpool-l1-2-0

CallbackMayRunLong
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
TrySubmitThreadpoolCallback

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
DisableThreadLibraryCalls

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DafAepExport
DafAepImport
DafChallengeDevicePresence
DafCloseAssociationContext
DafCloseChallengeContext
DafCloseImportExportContext
DafCloseInboundContext
DafCreateAssociationContext
DafCreateAssociationContextForApp
DafCreateAssociationContextFromOobBlob
DafCreateChallengeContext
DafCreateDeviceChallengeContext
DafCreateDeviceInterfaceChallengeContext
DafCreateImportExportContext
DafCreateInboundContext
DafGetInboundAssociationResultForAppActivation
DafMemFree
DafRegisterForInboundAssociationsAppActivation
DafSelectCeremony
DafStartAepExport
DafStartAepImport
DafStartDeviceStatusNotification
DafStartEnumCeremonies
DafStartFinalize
DafStartListenForInboundAssociations
DafStartReadCeremonyData
DafStartRemoveAssociation
DafStartWriteCeremonyData

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

13a349ff56669f13169a941309e873dd

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

89:10:c7:d3:0f:6b:6b:02:1d:22:19:72:30:1e:ea:9f:9c:8a:9b:d6:0d:1e:45:b9:32:5e:d4:9f:d4:b0:54:b7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-synch-l1-1-0

rpcrt4

api-ms-win-core-heap-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 22KB - Virtual size: 22KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 2KB - Virtual size: 1KB

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

89:10:c7:d3:0f:6b:6b:02:1d:22:19:72:30:1e:ea:9f:9c:8a:9b:d6:0d:1e:45:b9:32:5e:d4:9f:d4:b0:54:b7
Signer

.text
Size: 22KB - Virtual size: 22KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 2KB - Virtual size: 1KB