DevicePairing.pdb
Static task
static1
Behavioral task
behavioral1
Sample
DevicePairing.dll
Resource
win10v2004-20240508-en
General
-
Target
DevicePairing.dll
-
Size
488KB
-
MD5
a141e69d374b245e00368b2f82285ffe
-
SHA1
bc907910ceb5796ef599af4f2c6685a14395dc63
-
SHA256
81a96fbba546dacb823e58f5b3dbd4323392d57015552afc5c45339dca2320bb
-
SHA512
9fdabedc006486b06dab959cfbb14689d126fcff70a0563fc33c9afc30dcd9e2d985a6513f4a319671383ea7bbd2553b40ce317816d62e80ef007d007752bc01
-
SSDEEP
6144:LsiXUluEcfbmFiFt5jXQV6yu+DmmzBDDA:AiEymFijhAV69+tFDD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DevicePairing.dll
Files
-
DevicePairing.dll.dll windows:10 windows x86 arch:x86
d0bd3f8d690569b53ca940f19113ed83
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_unlock
_onexit
_except_handler4_common
__RTDynamicCast
_lock
realloc
memmove
memcpy
memcmp
floor
_amsg_exit
_XcptFilter
_CxxThrowException
_vsnwprintf
??1type_info@@UAE@XZ
_initterm
__CxxFrameHandler3
_wcsicmp
_vsnprintf_s
_ui64tow_s
swscanf
?terminate@@YAXXZ
_ftol2_sse
_ftol2
__dllonexit
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
free
malloc
wcsncpy_s
_purecall
memcpy_s
_errno
memset
shcore
ord244
SHStrDupW
SHCreateThread
ord241
ord187
shell32
ord100
ShellExecuteExW
SHExtractIconsW
ord893
shlwapi
StrChrW
PathRemoveBlanksW
PathUnquoteSpacesW
StrToIntW
ord384
StrCmpIW
windows.ui.immersive
ord100
ord101
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleA
LoadLibraryExW
GetProcAddress
LockResource
LoadStringW
FindResourceExW
LoadResource
SizeofResource
GetModuleFileNameA
GetModuleHandleExW
GetModuleFileNameW
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
CreateMutexExW
CreateSemaphoreExW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
OpenSemaphoreW
AcquireSRWLockExclusive
CreateMutexW
SetEvent
WaitForMultipleObjectsEx
ResetEvent
CreateEventExW
InitializeCriticalSection
CreateEventW
WaitForSingleObject
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObjectEx
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
TlsGetValue
GetCurrentProcessId
TerminateProcess
TlsFree
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
GetCurrentThread
TlsAlloc
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetLocaleInfoW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
oleaut32
VarUI4FromStr
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
api-ms-win-core-com-l1-1-0
CoGetMalloc
CoTaskMemRealloc
CoGetApartmentType
CoWaitForMultipleHandles
CoTaskMemFree
CoUninitialize
CoInitializeEx
StringFromGUID2
CoTaskMemAlloc
PropVariantClear
CoCreateInstance
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCloseKey
RegGetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyExW
RegCreateKeyExW
RegDeleteValueW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventActivityIdControl
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
InitOnceBeginInitialize
SleepConditionVariableSRW
Sleep
InitOnceComplete
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-com-l1-1-1
RoGetAgileReference
rpcrt4
UuidToStringW
UuidFromStringW
RpcStringFreeW
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabled
api-ms-win-devices-query-l1-1-0
DevCreateObjectQueryFromId
DevGetObjectProperties
DevFreeObjectProperties
DevCloseObjectQuery
api-ms-win-devices-query-l1-1-1
DevCreateObjectQueryEx
ext-ms-win-rtcore-ntuser-dpi-l1-2-0
SetThreadDpiAwarenessContext
ext-ms-win-rtcore-ntuser-dpi-l1-2-1
ord2636
deviceassociation
DafStartReadCeremonyData
DafSelectCeremony
DafStartFinalize
DafStartWriteCeremonyData
DafStartEnumCeremonies
DafCreateAssociationContextFromOobBlob
DafCloseAssociationContext
DafCreateAssociationContext
DafStartRemoveAssociation
DafMemFree
imm32
ImmDisableLegacyIME
kernel32
MulDiv
lstrcmpiW
GetUserDefaultUILanguage
ntdll
EtwTraceMessage
WinSqmAddToStreamEx
dui70
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@Element@DirectUI@@SGJXZ
?DefaultAction@Element@DirectUI@@UAEJXZ
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
?Create@FillLayout@DirectUI@@SGJPAPAVLayout@2@@Z
UnInitThread
RegisterPVLBehaviorFactory
UnInitProcessPriv
InitThread
InitProcessPriv
?RemoveAll@Element@DirectUI@@QAEJXZ
??1CritSecLock@DirectUI@@QAE@XZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?SetAccName@Element@DirectUI@@QAEJPBG@Z
?SetAccDesc@Element@DirectUI@@QAEJPBG@Z
?SetTooltip@Element@DirectUI@@QAEJ_N@Z
?Create@TouchButton@DirectUI@@SGJPAVElement@2@PAKPAPAV32@@Z
??0ClassInfoBase@DirectUI@@QAE@XZ
??1ClassInfoBase@DirectUI@@UAE@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
??1Element@DirectUI@@UAE@XZ
?DesiredSizeProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?KeyFocusedProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?OnHosted@TouchButton@DirectUI@@UAEXPAVElement@2@@Z
?OnUnHosted@TouchButton@DirectUI@@UAEXPAVElement@2@@Z
?OnInput@TouchButton@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnPropertyChanged@TouchButton@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnEvent@TouchButton@DirectUI@@UAEXPAUEvent@2@@Z
?DefaultAction@TouchButton@DirectUI@@UAEJXZ
?GetImmersiveFocusRectOffsets@TouchButton@DirectUI@@UAEXPAUtagRECT@@@Z
?GetForegroundColorRef@TouchButton@DirectUI@@UAEJPAK@Z
?PressedProp@TouchButton@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetClassInfoPtr@TouchButton@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@TouchButton@DirectUI@@SGJXZ
??0TouchButton@DirectUI@@QAE@XZ
?Initialize@TouchButton@DirectUI@@QAEJIPAVElement@2@PAK@Z
??1TouchButton@DirectUI@@UAE@XZ
?FireClickEvent@TouchButton@DirectUI@@UAEXIIW4ClickDevice@12@PAUtagPOINT@@@Z
?FireRightClickEvent@TouchButton@DirectUI@@UAEXIPAUtagPOINT@@@Z
?Paint@RichText@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?GetContentSize@RichText@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?GetTrimmedLineCount@RichText@DirectUI@@QAEKXZ
?GetWidth@Element@DirectUI@@QAEHXZ
?GetHeight@Element@DirectUI@@QAEHXZ
?GetPadding@Element@DirectUI@@QAEPBUtagRECT@@PAPAVValue@2@@Z
?SetHeight@Element@DirectUI@@QAEJH@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
GetScaleFactor
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?SetSelected@Element@DirectUI@@QAEJ_N@Z
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?SetMinSize@Element@DirectUI@@QAEJHH@Z
?SetOverrideScaleFactor@DUIXmlParser@DirectUI@@QAEXM@Z
?ManipulationStarted@TouchScrollViewer@DirectUI@@SG?AVUID@@XZ
?Destroy@Element@DirectUI@@QAEJ_N@Z
?Add@Element@DirectUI@@QAEJPAV12@@Z
?Insert@Element@DirectUI@@QAEJPAV12@I@Z
?Remove@Element@DirectUI@@QAEJPAV12@@Z
?GetImmediateChild@Element@DirectUI@@QAEPAV12@PAV12@@Z
?GetRoot@Element@DirectUI@@QAEPAV12@XZ
?GetClassInfoPtr@ScrollViewer@DirectUI@@SGPAUIClassInfo@2@XZ
?Scroll@BaseScrollBar@DirectUI@@SG?AVUID@@XZ
DuiCreateObject
?Release@Value@DirectUI@@QAEXXZ
?UserTextChanged@TouchEditBase@DirectUI@@SG?AVUID@@XZ
?GetCheckedState@TouchCheckBox@DirectUI@@QAE?AW4CheckedStateFlags@2@XZ
?GetClassInfoPtr@TouchEdit2@DirectUI@@SGPAUIClassInfo@2@XZ
?SetInputScope@TouchEdit2@DirectUI@@QAEJW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@@Z
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?SetID@Element@DirectUI@@QAEJPBG@Z
?SetAccValue@Element@DirectUI@@QAEJPBG@Z
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
StrToID
?Click@TouchButton@DirectUI@@SG?AVUID@@XZ
?Click@Button@DirectUI@@SG?AVUID@@XZ
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
??0Element@DirectUI@@QAE@XZ
gdi32
GetStockObject
GetCurrentDpiInfo
user32
SetWindowTextW
GetMonitorInfoW
MonitorFromWindow
MonitorFromPoint
GetProcessDefaultLayout
GetWindowRect
MsgWaitForMultipleObjectsEx
PeekMessageW
PostQuitMessage
TranslateMessage
SetCursor
LoadCursorW
DispatchMessageW
DestroyIcon
GetWindowLongW
SetTimer
ord2574
SetWindowLongW
PostMessageW
GetPropW
SendMessageW
RemovePropW
SetPropW
GetClassNameW
GetWindow
DefWindowProcW
SetForegroundWindow
GetParent
UnregisterClassA
RegisterClassW
CreateWindowExW
ShowWindow
UnregisterClassW
GetCursorPos
DestroyWindow
LoadImageW
FindWindowExW
IsWindow
IsWindowVisible
IsIconic
KillTimer
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 185KB - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 257KB - Virtual size: 256KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ