DevicePairing.pdb
Static task
static1
Behavioral task
behavioral1
Sample
DevicePairing.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
DevicePairing.dll
Resource
win10v2004-20240426-en
General
-
Target
DevicePairing.dll
-
Size
454KB
-
MD5
b98f9f25d0cca83e1ca79d1f8baa1075
-
SHA1
aee7fe6552ccb6cb20e7aace2ff85d99641dd5e6
-
SHA256
ea135a9dcd0fb449c2279bc76fe59472e909fdabbbd91822699521063087a7aa
-
SHA512
d4a5581568fbdf898e4c19de59e6762f00123e820cb8cf3305fa8d15abdb6319287f306f7aa8ea35122f01dc26d1ece8d62a3cfd9a9a160740d6df199cc44a20
-
SSDEEP
6144:DesC23rffnfP1GVwIXrcQIcAdZ2zBNj08fLI:abmLnVGl7m27jHD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DevicePairing.dll
Files
-
DevicePairing.dll.dll windows:6 windows x86 arch:x86
2a79e7141b91fdb9c98e624342c24201
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
__CxxFrameHandler3
memmove
_wcsicmp
_vsnwprintf
__RTDynamicCast
_ftol2
_ftol2_sse
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
??1type_info@@UAE@XZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
memset
memcpy_s
memcpy
free
malloc
wcsncpy_s
_purecall
floor
kernel32
GlobalUnlock
GetCurrentThread
DuplicateHandle
GetLocaleInfoW
GetTickCount64
CompareStringOrdinal
WaitForSingleObject
GlobalLock
CreateEventExW
ResetEvent
WaitForMultipleObjectsEx
SetEvent
CloseHandle
CreateMutexW
GetProcessHeap
GlobalSize
HeapFree
HeapAlloc
LockResource
FormatMessageW
CreateEventW
TlsSetValue
TlsGetValue
MulDiv
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
TlsFree
TlsAlloc
DisableThreadLibraryCalls
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
GetUserDefaultUILanguage
ole32
CoUninitialize
CoInitializeEx
StringFromGUID2
PropVariantClear
CoGetApartmentType
CoGetMalloc
ReleaseStgMedium
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoWaitForMultipleHandles
oleaut32
VarUI4FromStr
advapi32
TraceMessage
EventWrite
EventActivityIdControl
RegDeleteKeyExW
RegQueryValueExW
RegGetValueW
EventUnregister
EventRegister
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
user32
SendMessageW
GetPropW
LoadStringW
SetWindowLongW
GetWindowLongW
SetPropW
GetParent
KillTimer
PostMessageW
RemovePropW
SetTimer
DestroyIcon
DispatchMessageW
LoadCursorW
SetCursor
TranslateMessage
PostQuitMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
GetWindowRect
GetProcessDefaultLayout
MonitorFromWindow
GetMonitorInfoW
SetWindowTextW
LoadImageW
DestroyWindow
FindWindowExW
IsWindow
IsWindowVisible
IsIconic
ShowWindow
SetForegroundWindow
DefWindowProcW
MonitorFromPoint
RegisterClipboardFormatW
GetWindow
GetClassNameW
GetCursorPos
UnregisterClassA
CharNextW
CreateWindowExW
UnregisterClassW
RegisterClassW
ntdll
WinSqmAddToStreamEx
NtQuerySystemInformation
shell32
ord893
ShellExecuteExW
ord100
SHExtractIconsW
shlwapi
StrChrW
StrCmpIW
SHStrDupW
ord16
PathRemoveBlanksW
PathUnquoteSpacesW
ord10
StrToIntW
shcore
ord244
ord241
windows.ui.immersive
ord100
ord101
gdi32
GetCurrentDpiInfo
GetStockObject
rpcrt4
RpcStringFreeW
UuidFromStringW
UuidToStringW
imm32
ImmDisableLegacyIME
twinapi
ord9
deviceassociation
DafStartReadCeremonyData
DafStartRemoveAssociation
DafSelectCeremony
DafStartWriteCeremonyData
DafCreateAssociationContext
DafMemFree
DafCloseAssociationContext
DafCreateAssociationContextFromOobBlob
DafStartEnumCeremonies
DafStartFinalize
cfgmgr32
DevCloseObjectQuery
DevCreateObjectQueryFromId
DevCreateObjectQueryEx
dui70
?DefaultAction@TouchButton@DirectUI@@UAEJXZ
?GetImmersiveFocusRectOffsets@TouchButton@DirectUI@@UAEXPAUtagRECT@@@Z
?GetForegroundColorRef@TouchButton@DirectUI@@UAEJPAK@Z
?PressedProp@TouchButton@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetClassInfoPtr@TouchButton@DirectUI@@SGPAUIClassInfo@2@XZ
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?ManipulationStarted@TouchScrollViewer@DirectUI@@SG?AVUID@@XZ
?Click@TouchButton@DirectUI@@SG?AVUID@@XZ
?SetOverrideScaleFactor@DUIXmlParser@DirectUI@@QAEXM@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?GetClassInfoPtr@ScrollViewer@DirectUI@@SGPAUIClassInfo@2@XZ
?GetRoot@Element@DirectUI@@QAEPAV12@XZ
?GetImmediateChild@Element@DirectUI@@QAEPAV12@PAV12@@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?Remove@Element@DirectUI@@QAEJPAV12@@Z
?Insert@Element@DirectUI@@QAEJPAV12@I@Z
?Add@Element@DirectUI@@QAEJPAV12@@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
?Scroll@BaseScrollBar@DirectUI@@SG?AVUID@@XZ
?Click@Button@DirectUI@@SG?AVUID@@XZ
StrToID
DuiCreateObject
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?SetSelected@Element@DirectUI@@QAEJ_N@Z
?SetID@Element@DirectUI@@QAEJPBG@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnEvent@TouchButton@DirectUI@@UAEXPAUEvent@2@@Z
?OnPropertyChanged@TouchButton@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnInput@TouchButton@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnUnHosted@TouchButton@DirectUI@@UAEXPAVElement@2@@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
??1Element@DirectUI@@UAE@XZ
??0Element@DirectUI@@QAE@XZ
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?Register@TouchButton@DirectUI@@SGJXZ
??0TouchButton@DirectUI@@QAE@XZ
?Initialize@TouchButton@DirectUI@@QAEJIPAVElement@2@PAK@Z
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnHosted@TouchButton@DirectUI@@UAEXPAVElement@2@@Z
?KeyFocusedProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?DesiredSizeProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetTrimmedLineCount@RichText@DirectUI@@QAEKXZ
?GetContentSize@RichText@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@RichText@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?Create@TouchButton@DirectUI@@SGJPAVElement@2@PAKPAPAV32@@Z
?SetTooltip@Element@DirectUI@@QAEJ_N@Z
?SetAccDesc@Element@DirectUI@@QAEJPBG@Z
?SetAccName@Element@DirectUI@@QAEJPBG@Z
?RemoveAll@Element@DirectUI@@QAEJXZ
InitProcessPriv
InitThread
UnInitProcessPriv
RegisterPVLBehaviorFactory
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
??1TouchButton@DirectUI@@UAE@XZ
?FireClickEvent@TouchButton@DirectUI@@UAEXIIW4ClickDevice@12@PAUtagPOINT@@@Z
?FireRightClickEvent@TouchButton@DirectUI@@UAEXIPAUtagPOINT@@@Z
??1CritSecLock@DirectUI@@QAE@XZ
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?Release@Value@DirectUI@@QAEXXZ
?SetInputScope@TouchEdit2@DirectUI@@QAEJW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@@Z
?GetClassInfoPtr@TouchEdit2@DirectUI@@SGPAUIClassInfo@2@XZ
UnInitThread
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?SetMinSize@Element@DirectUI@@QAEJHH@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?GetCheckedState@TouchCheckBox@DirectUI@@QAE?AW4CheckedStateFlags@2@XZ
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?UserTextChanged@TouchEditBase@DirectUI@@SG?AVUID@@XZ
?SetAccValue@Element@DirectUI@@QAEJPBG@Z
GetScaleFactor
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?Create@FillLayout@DirectUI@@SGJPAPAVLayout@2@@Z
?SetHeight@Element@DirectUI@@QAEJH@Z
?GetPadding@Element@DirectUI@@QAEPBUtagRECT@@PAPAVValue@2@@Z
?GetHeight@Element@DirectUI@@QAEHXZ
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@Element@DirectUI@@SGJXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
??0ClassInfoBase@DirectUI@@QAE@XZ
??1ClassInfoBase@DirectUI@@UAE@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetWidth@Element@DirectUI@@QAEHXZ
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 156KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 257KB - Virtual size: 256KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ