DevicePairingProxy[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

DevicePairingProxy.dll
Size

20KB
MD5

8d6411f98aec56f8aa4b9d05a063ca1f
SHA1

2c71cc04739c7f64df94ac549b8abdde012b384f
SHA256

8cd791cc38c9f05a9914e85468ad474a27d636b1fb6f19b21a71221cfb4f10b6
SHA512

29910dc964c40b26152a64b2e3ccf87dea3f85e9e4b9bafe78c3bef8c65b3590efe8b81709919f67c9cd470b1c1a5b41f468c5d485dc00d37e40e7012543b7cc
SSDEEP

384:w7D5Lo0aGU9awAiQD4awgWK3WIGr0iiu/Q2fOcZAwKIVf+o:j64awgVGV/nZAwKIH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DevicePairingProxy.dll

Files

DevicePairingProxy.dll
.dll regsvr32 windows:6 windows x86 arch:x86

906d6b3b7a74ac5a422c10e33546da5b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

DevicePairingProxy.pdb

Imports

msvcrt

memcmp
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter

kernel32

GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls
TerminateProcess

ole32

HWND_UserSize
HWND_UserFree
ObjectStublessClient5
ObjectStublessClient3
ObjectStublessClient7
HWND_UserMarshal
HWND_UserUnmarshal
ObjectStublessClient4
ObjectStublessClient6

rpcrt4

NdrOleFree
NdrOleAllocate
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
NdrDllUnregisterProxy
NdrDllGetClassObject
CStdStubBuffer_AddRef
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
CStdStubBuffer_Invoke

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 78B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

906d6b3b7a74ac5a422c10e33546da5b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

ole32

rpcrt4

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 4KB

.orpc Size: 512B - Virtual size: 78B

.data Size: 512B - Virtual size: 872B

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 512B - Virtual size: 492B

.text
Size: 5KB - Virtual size: 4KB

.orpc
Size: 512B - Virtual size: 78B

.data
Size: 512B - Virtual size: 872B

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 512B - Virtual size: 492B