DevicePairingFolder[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

DevicePairingFolder.dll
Size

199KB
MD5

c8607d09737079812ed4ab5f1e68df88
SHA1

d6683b26aada7dc96cb64a8c5ada754a710783c3
SHA256

31cd0e2b8480b2f8ffc1d26be7a63fc115506c4b12177c58b7f50f2b80c009dc
SHA512

e7057ae0e0ff1b7caa01d127f9ae2aca8569324712c74c4e0f870d66082c0f3a98cc94937b80bcd83b5b3309ace4078a7ef2f49e26394169042426e64feca5ba
SSDEEP

3072:qQabTjuoamIMG2PGAeiegyhdUOON1oLDESRabINp:qu0JjPyXY/SgINp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DevicePairingFolder.dll

Files

DevicePairingFolder.dll
.dll windows:10 windows x86 arch:x86

e10e52804e224853baf1d158d93a0c71

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

DevicePairingFolder.pdb

Imports

msvcrt

_vsnwprintf
wcsstr
wcschr
_wtol
_except_handler4_common
__CxxFrameHandler3
realloc
_errno
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
memset
_purecall
free
malloc
wcsncpy_s
memcpy_s
??1type_info@@UAE@XZ
memcpy

shell32

SHChangeNotify
ord256
SHCreateDefaultContextMenu
SHCreateDataObject
ord18
ord16
ord25
ord763
ShellExecuteExW
SHCreateShellItemArrayFromIDLists
ord155
SHCreateDefaultExtractIcon
ord19
SHBindToFolderIDListParent
SHBindToParent
ord153

shlwapi

ord344
ord219
StrRetToBufW
StrPBrkW
StrChrW
ord619
StrToIntW
SHStrDupW
ord615
ord199
ord16

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
FreeLibrary
LoadLibraryExW
SizeofResource
LoadResource
GetModuleHandleW
FindResourceExW
DisableThreadLibraryCalls
GetProcAddress
LoadStringW
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleA

api-ms-win-core-synch-l1-2-0

DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
LeaveCriticalSection
CreateEventW
ReleaseMutex
InitializeSRWLock
CreateSemaphoreExW
AcquireSRWLockExclusive
Sleep
CreateMutexExW
InitializeCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSRWLockShared
ResetEvent
EnterCriticalSection
SetEvent

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter
RaiseException

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
OutputDebugStringW

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

oleaut32

VariantInit
VariantClear
SysAllocString
VarUI4FromStr
SafeArrayGetElement
SysFreeString

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
RegisterTraceGuidsW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle

api-ms-win-core-com-l1-1-1

CoInitializeEx
CoUninitialize
PropVariantClear
CoCreateInstance
CoTaskMemAlloc
CoGetMalloc
PropVariantCopy
CoTaskMemRealloc
StringFromGUID2
CoTaskMemFree
CoWaitForMultipleHandles

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWrite
EventUnregister

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

rpcrt4

RpcStringFreeW
UuidFromStringW
UuidToStringW

cfgmgr32

DevCreateObjectQuery
DevCloseObjectQuery

kernel32

lstrlenW
lstrcmpiW

propsys

VariantCompare
PSPropertyBag_WriteDWORD
PropVariantChangeType
PropVariantToVariant
PSGetPropertyDescription
PropVariantToStringAlloc
PSCreateMemoryPropertyStore
PSGetPropertyFromPropertyStorage
PropVariantCompareEx

user32

UnregisterClassA

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e10e52804e224853baf1d158d93a0c71

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

shell32

shlwapi

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-2

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-profile-l1-1-0

rpcrt4

cfgmgr32

kernel32

propsys

user32

api-ms-win-core-heap-l2-1-0

Exports

Exports

Sections

.text Size: 65KB - Virtual size: 64KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 123KB - Virtual size: 122KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 65KB - Virtual size: 64KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 123KB - Virtual size: 122KB

.reloc
Size: 4KB - Virtual size: 4KB