DevicePairing.pdb
Static task
static1
Behavioral task
behavioral1
Sample
DevicePairing.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
DevicePairing.dll
Resource
win10v2004-20240508-en
General
-
Target
DevicePairing.dll
-
Size
502KB
-
MD5
f0fd2757c9975ec62c3aff9de3415830
-
SHA1
5cc4e0677bc714e3ccb76e82f56daff83ab5b131
-
SHA256
fc2bc5ccaedb11ba098205c36bbea54684277e02c8900bb052e46d65b1ec4a72
-
SHA512
cdab8cbc9b4fb1ba7ba03be8ff83a17aea81db9b11acaf1dd779e32c7a43042548c333435180343e0967a7bd323a5ed6479cad6549fe951f29d88c2f8c6c72b0
-
SSDEEP
6144:Ft2wX12VmqHj4d34u/GW/IwZ2PIic9zhEgy2DT0qNhjBNj08:nrGcIC2PLc9zhEgyerLjH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DevicePairing.dll
Files
-
DevicePairing.dll.dll windows:6 windows x64 arch:x64
85598dbc59d8fd50da4acceede4cbaab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
memmove
_wcsicmp
_purecall
__CxxFrameHandler3
__RTDynamicCast
floorf
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
??1type_info@@UEAA@XZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
__C_specific_handler
memset
memcpy_s
free
malloc
wcsncpy_s
_vsnwprintf
memcpy
memcmp
wcscmp
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
WinSqmAddToStreamEx
NtQuerySystemInformation
kernel32
GetCurrentThread
GlobalLock
GlobalSize
GetUserDefaultUILanguage
GetLocaleInfoW
CreateEventExW
ResetEvent
DuplicateHandle
MulDiv
EnterCriticalSection
SetEvent
CloseHandle
CreateMutexW
GetProcessHeap
HeapFree
HeapAlloc
GetTickCount64
CompareStringOrdinal
WaitForSingleObject
LockResource
FormatMessageW
TlsSetValue
TlsGetValue
WaitForMultipleObjectsEx
GetSystemTimeAsFileTime
LeaveCriticalSection
GlobalUnlock
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
RaiseException
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
TlsAlloc
TlsFree
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
CreateEventW
GetTickCount
OutputDebugStringA
ole32
PropVariantClear
CoGetApartmentType
CoWaitForMultipleHandles
CoInitializeEx
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
ReleaseStgMedium
StringFromGUID2
oleaut32
VarUI4FromStr
advapi32
RegSetValueExW
EventWrite
EventActivityIdControl
RegDeleteKeyExW
RegQueryValueExW
RegGetValueW
EventUnregister
EventRegister
RegDeleteValueW
RegCreateKeyExW
TraceMessage
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
user32
RegisterClipboardFormatW
GetWindow
GetClassNameW
MonitorFromPoint
GetWindowLongPtrW
GetCursorPos
CreateWindowExW
UnregisterClassW
RegisterClassW
GetPropW
SendMessageW
SetWindowLongPtrW
LoadStringW
UnregisterClassA
CharNextW
DefWindowProcW
SetForegroundWindow
ShowWindow
IsIconic
IsWindowVisible
IsWindow
FindWindowExW
DestroyWindow
LoadImageW
SetWindowTextW
GetMonitorInfoW
MonitorFromWindow
GetProcessDefaultLayout
GetWindowRect
MsgWaitForMultipleObjectsEx
PeekMessageW
PostQuitMessage
TranslateMessage
SetCursor
LoadCursorW
DispatchMessageW
DestroyIcon
SetTimer
RemovePropW
PostMessageW
KillTimer
GetParent
SetPropW
GetWindowLongW
SetWindowLongW
shell32
ord893
SHExtractIconsW
ord100
ShellExecuteExW
shlwapi
StrToIntW
PathRemoveBlanksW
StrChrW
StrCmpIW
SHStrDupW
ord16
ord10
PathUnquoteSpacesW
shcore
ord241
ord244
windows.ui.immersive
ord101
ord100
gdi32
GetCurrentDpiInfo
GetStockObject
rpcrt4
UuidFromStringW
UuidToStringW
RpcStringFreeW
imm32
ImmDisableLegacyIME
twinapi
ord9
deviceassociation
DafCreateAssociationContext
DafStartWriteCeremonyData
DafStartReadCeremonyData
DafStartRemoveAssociation
DafStartFinalize
DafCreateAssociationContextFromOobBlob
DafStartEnumCeremonies
DafSelectCeremony
DafMemFree
DafCloseAssociationContext
cfgmgr32
DevCreateObjectQueryFromId
DevCreateObjectQueryEx
DevCloseObjectQuery
dui70
?GetClassInfoPtr@TouchButton@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@TouchButton@DirectUI@@SAJXZ
??0TouchButton@DirectUI@@QEAA@XZ
?Initialize@TouchButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
??1TouchButton@DirectUI@@UEAA@XZ
?FireClickEvent@TouchButton@DirectUI@@UEAAXIIW4ClickDevice@12@PEAUtagPOINT@@@Z
?FireRightClickEvent@TouchButton@DirectUI@@UEAAXIPEAUtagPOINT@@@Z
??1CritSecLock@DirectUI@@QEAA@XZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
??0Element@DirectUI@@QEAA@XZ
??1Element@DirectUI@@UEAA@XZ
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnDestroy@Element@DirectUI@@UEAAXXZ
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@Element@DirectUI@@SAJXZ
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?DefaultAction@Element@DirectUI@@UEAAJXZ
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnEvent@TouchButton@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnPropertyChanged@TouchButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnInput@TouchButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnUnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z
?OnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z
?KeyFocusedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?DesiredSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetTrimmedLineCount@RichText@DirectUI@@QEAAKXZ
?GetContentSize@RichText@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Paint@RichText@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?Create@TouchButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z
?SetTooltip@Element@DirectUI@@QEAAJ_N@Z
?SetAccDesc@Element@DirectUI@@QEAAJPEBG@Z
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z
?RemoveAll@Element@DirectUI@@QEAAJXZ
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?PressedProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
??0ClassInfoBase@DirectUI@@QEAA@XZ
??1ClassInfoBase@DirectUI@@UEAA@XZ
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?GetWidth@Element@DirectUI@@QEAAHXZ
?GetHeight@Element@DirectUI@@QEAAHXZ
?GetPadding@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z
?SetHeight@Element@DirectUI@@QEAAJH@Z
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHICON__@@_N11@Z
GetScaleFactor
?SetAccValue@Element@DirectUI@@QEAAJPEBG@Z
?UserTextChanged@TouchEditBase@DirectUI@@SA?AVUID@@XZ
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?GetCheckedState@TouchCheckBox@DirectUI@@QEAA?AW4CheckedStateFlags@2@XZ
?GetClassInfoPtr@TouchEdit2@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetInputScope@TouchEdit2@DirectUI@@QEAAJW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@@Z
?Release@Value@DirectUI@@QEAAXXZ
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?SetID@Element@DirectUI@@QEAAJPEBG@Z
?SetSelected@Element@DirectUI@@QEAAJ_N@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
DuiCreateObject
StrToID
?Click@Button@DirectUI@@SA?AVUID@@XZ
?Scroll@BaseScrollBar@DirectUI@@SA?AVUID@@XZ
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?Add@Element@DirectUI@@QEAAJPEAV12@@Z
?Insert@Element@DirectUI@@QEAAJPEAV12@I@Z
?Remove@Element@DirectUI@@QEAAJPEAV12@@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?GetImmediateChild@Element@DirectUI@@QEAAPEAV12@PEAV12@@Z
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
?GetClassInfoPtr@ScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
?SetOverrideScaleFactor@DUIXmlParser@DirectUI@@QEAAXM@Z
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ
?ManipulationStarted@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z
?SetMinSize@Element@DirectUI@@QEAAJHH@Z
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z
?GetForegroundColorRef@TouchButton@DirectUI@@UEAAJPEAK@Z
?GetImmersiveFocusRectOffsets@TouchButton@DirectUI@@UEAAXPEAUtagRECT@@@Z
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
InitProcessPriv
InitThread
UnInitProcessPriv
RegisterPVLBehaviorFactory
UnInitThread
?DefaultAction@TouchButton@DirectUI@@UEAAJXZ
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 203KB - Virtual size: 203KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 257KB - Virtual size: 256KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ