DevicePairingProxy[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

DevicePairingProxy.dll
Size

20KB
MD5

345e9b8d66a795cbd53e86f94aa81fa2
SHA1

295b415034105beadd0e53bebb8bcb808c2e8947
SHA256

64ec287ec3081d76ed82f9d730e73fb57128e96f3a7518101c0a767dc4af7623
SHA512

d4f5a322512cd9c643d07384b13a19299dcec09dbb9cfdd1be439b1c6c60f311301250de0d7077847dadb35ff222c105ed72480e6134cce2d0b22b0cb37a4213
SSDEEP

384:tk/xaXYRPswawzWtL3WiGr0iiu/Q2fOcZAwKIVf+oy1:8DawavGV/nZAwKIHy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DevicePairingProxy.dll

Files

DevicePairingProxy.dll
.dll regsvr32 windows:6 windows x86 arch:x86

906d6b3b7a74ac5a422c10e33546da5b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

DevicePairingProxy.pdb

Imports

msvcrt

memcmp
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter

kernel32

GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls
TerminateProcess

ole32

HWND_UserSize
HWND_UserFree
ObjectStublessClient5
ObjectStublessClient3
ObjectStublessClient7
HWND_UserMarshal
HWND_UserUnmarshal
ObjectStublessClient4
ObjectStublessClient6

rpcrt4

NdrOleFree
NdrOleAllocate
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
NdrDllUnregisterProxy
NdrDllGetClassObject
CStdStubBuffer_AddRef
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
CStdStubBuffer_Invoke

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 67B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

906d6b3b7a74ac5a422c10e33546da5b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

ole32

rpcrt4

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

.orpc Size: 512B - Virtual size: 67B

.data Size: 512B - Virtual size: 872B

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 4KB - Virtual size: 4KB

.orpc
Size: 512B - Virtual size: 67B

.data
Size: 512B - Virtual size: 872B

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 1KB - Virtual size: 1KB