acb1ab0fee51336e029e7877c4dfbb81_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

acb1ab0fee51336e029e7877c4dfbb81_JaffaCakes118
Size

2.7MB
MD5

acb1ab0fee51336e029e7877c4dfbb81
SHA1

88d669224efa611c508d73080cbbc90050c2bca4
SHA256

dd3e6ac9669ac039fbeda1e19d3bf65c9c13f01d548a9b4bda011e9b60af91c0
SHA512

de5c0f4ac4e0d761e93c57c7176498c924a6b76d5c43e68110df461ae3d07c78032e28e5615d2a82b325aa39800d5b1e5e5a9c1eea2bef09b22c0260548f88e6
SSDEEP

49152:hhQ5ZfvgYduvSpqSzER94C0dtNnPhysZFASCn/AftXM3yQJvUBI9da:hm4vCjXpnZIBCtX1+AIC

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/ReadCustomerData.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/TvGetVersion.dll
unpack001/$PLUGINSDIR/nsis7z.dll
unpack001/out.upx

NSIS installer 1 IoCs

installer

resource	yara_rule
static1/unpack001/out.upx	nsis_installer_2

Files

acb1ab0fee51336e029e7877c4dfbb81_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:57:55:4b:e6:84:15:d4:eb:7b:ba:03:fe:3c:ba:19:1b:a5:2a:aa
Signer

Actual PE Digest

0b:57:55:4b:e6:84:15:d4:eb:7b:ba:03:fe:3c:ba:19:1b:a5:2a:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 196KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread

user32

CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ws2_32

gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ReadCustomerData.dll
.dll windows:4 windows x86 arch:x86

d29e408dd9048e10d5936c6f2bfca832

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
MultiByteToWideChar
GetLastError
ReadFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
CloseHandle
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
RtlUnwind
RaiseException
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
FlushFileBuffers
VirtualAlloc
HeapReAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
InitializeCriticalSection
HeapSize
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetEndOfFile
LCMapStringA
LCMapStringW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GlobalFree
lstrcpyA

Exports

Exports

ReadCustomerData

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/TvGetVersion.dll
.dll windows:4 windows x86 arch:x86

88d67657017b9d8004b8a2d8a16f30a6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

SHDeleteKeyA
SHCopyKeyA

kernel32

LocalFree
InterlockedDecrement
GetModuleFileNameA
RtlUnwind
CreateDirectoryA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
MoveFileA
DeleteFileA
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetFullPathNameA
GetCurrentDirectoryA
ExitProcess
GetVersionExA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
Sleep
GetLocaleInfoA
HeapSize
VirtualAlloc
HeapReAlloc
WriteFile
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
InitializeCriticalSection
SetFilePointer
GetTimeZoneInformation
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
lstrcpynA
lstrcpyA
lstrlenA
lstrcatA
GetDriveTypeA
CreateFileA
GetFileSize
GlobalAlloc
ReadFile
CloseHandle
GlobalFree
GetLastError
GetCurrentProcessId
GetModuleHandleA
GetProcAddress
lstrcmpiA
FreeEnvironmentStringsA
GetStringTypeW

user32

GetSystemMetrics
wsprintfA
SendMessageA

winspool.drv

EnumPrintProcessorsA
EnumPrinterDriversA

advapi32

RegEnumValueA
RegCreateKeyExA
RegDeleteValueA
LookupAccountNameA
ConvertSidToStringSidA
DeleteService
ControlService
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegFlushKey
RegSetValueExA
RegQueryValueExA
GetUserNameA

shell32

ShellExecuteA
SHFileOperationA

ole32

CoUninitialize
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
OleRun
CoInitialize

oleaut32

VariantClear
SysAllocString
GetErrorInfo
SysFreeString

Exports

Exports

AddAuthorizedApplication
CopyRegKeyWithRollback
CopyRegValueWithRollback
CreateDirWithRollback
DeleteRegKeyWithRollback
DeleteRegValueWithRollback
GetCurrentSessionId
GetServiceStatus
GetUserSID
IsNetPath
IsPrintProcessorInstalled
IsPrinterDriverInstalled
IsServiceInstalled
IsTvPasswordSet
LoadFile
RegCopyKey
RegCopyValue
RemoveAuthorizedApplication
RemoveService
RemoveServiceWait
RollbackFileChanges
RollbackRegChanges
RunService
RunServiceWait
StopService
StopServiceWait
WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsVersion
WindowsVersionMajor
WindowsVersionMinor
WriteRegValueWithRollback

Sections

.text
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsis7z.dll
.dll windows:4 windows x86 arch:x86

b22ed27c346f001ed1b4410c1073cfa9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
LoadLibraryA
GetModuleFileNameA
RemoveDirectoryW
MoveFileA
MoveFileW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
GetFullPathNameA
GetFullPathNameW
GetCurrentThreadId
GetCurrentProcessId
SetLastError
CreateFileW
SetFileTime
CloseHandle
SetFileAttributesA
SetFileAttributesW
RemoveDirectoryA
FindClose
FindFirstFileA
FindFirstFileW
CreateFileA
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GetProcAddress
GetCurrentProcess
GetSystemInfo
GetModuleHandleA
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
DeleteCriticalSection
AreFileApisANSI
VirtualFree
VirtualAlloc
GetVersionExA
ResetEvent
WaitForSingleObject
SetEvent
InitializeCriticalSection
CreateEventA
SetFileApisToOEM
SetFileApisToANSI
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
RaiseException
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapAlloc
HeapFree
HeapReAlloc
ExitThread
CreateThread
GetCommandLineA
GetProcessHeap
HeapDestroy
HeapCreate
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
Sleep
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
VirtualQuery

user32

CharUpperW
CharUpperA
GetDlgItem
FindWindowExA
SetWindowTextA
wsprintfA
SendMessageA

oleaut32

VariantCopy
VariantClear
SysAllocString

Exports

Exports

Extract
ExtractWithCallback
ExtractWithDetails

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_0_/tvqsfiles.7z
.7z
TeamViewer.exe
.exe windows:4 windows x86 arch:x86

d0fed9b55f7ed8441eeb0e3248f0601a

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

15:ad:b7:78:fa:6a:43:10:33:3b:07:f1:b4:d1:27:7e:4d:cb:cb:f0
Signer

Actual PE Digest

15:ad:b7:78:fa:6a:43:10:33:3b:07:f1:b4:d1:27:7e:4d:cb:cb:f0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer_6.0_Release\TeamViewer\qs_release\TeamViewer.pdb

Imports

ws2_32

send
recvfrom
sendto
ntohl
htonl
select
__WSAFDIsSet
WSARecv
gethostname
inet_ntoa
gethostbyname
recv
shutdown
WSAEventSelect
WSAAddressToStringA
getservbyport
closesocket
getservbyname
gethostbyaddr
WSAWaitForMultipleEvents
WSAResetEvent
WSASetEvent
htons
getsockopt
ntohs
getpeername
WSACloseEvent
socket
WSADuplicateSocketW
WSARecvFrom
WSACreateEvent
ioctlsocket
accept
connect
setsockopt
WSAStartup
WSACleanup
bind
getsockname
inet_addr
WSASetLastError
WSAGetLastError
listen
WSASend
WSASocketW

iphlpapi

DeleteIPAddress
GetAdaptersInfo
GetAdapterIndex

comctl32

ImageList_Destroy
InitCommonControlsEx
ImageList_Create
ImageList_SetBkColor
ImageList_Remove
ImageList_ReplaceIcon

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

msvfw32

DrawDibOpen
DrawDibDraw
DrawDibClose

winmm

mixerOpen
mixerGetID
waveOutClose
waveInStart
waveInReset
waveInGetNumDevs
waveInOpen
mixerSetControlDetails
timeBeginPeriod
timeEndPeriod
waveInAddBuffer
waveInUnprepareHeader
waveInClose
waveOutRestart
waveOutReset
waveOutGetNumDevs
waveInPrepareHeader
waveOutOpen
waveOutPrepareHeader
waveOutPause
waveOutWrite
waveOutUnprepareHeader
mixerClose

kernel32

CreateThread
ResumeThread
SetThreadPriority
GetPriorityClass
SetPriorityClass
ResetEvent
GetCurrentThread
DuplicateHandle
FindClose
CompareFileTime
CompareStringA
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
GetThreadTimes
GetCurrentDirectoryA
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
lstrcpyA
EnterCriticalSection
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSection
HeapAlloc
GetSystemTimeAsFileTime
CreateSemaphoreA
WaitForMultipleObjects
ReleaseSemaphore
MulDiv
SleepEx
ExpandEnvironmentStringsA
LocalAlloc
SetEnvironmentVariableA
SetStdHandle
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetTimeZoneInformation
GetOEMCP
HeapCreate
GetStdHandle
ExitThread
GetStringTypeA
LCMapStringA
GetDateFormatA
GetTimeFormatA
ExitProcess
GetStartupInfoA
GetCommandLineA
RtlUnwind
IsDebuggerPresent
UnhandledExceptionFilter
CreateWaitableTimerA
SetWaitableTimer
CreateFileMappingA
MapViewOfFileEx
CreateFileA
UnmapViewOfFile
GetSystemInfo
AreFileApisANSI
GetFileTime
SetEndOfFile
FormatMessageA
GetThreadLocale
GetACP
GetVersionExA
HeapSize
HeapReAlloc
HeapDestroy
IsProcessorFeaturePresent
InterlockedCompareExchange
lstrlenA
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetUnhandledExceptionFilter
FileTimeToLocalFileTime
QueueUserAPC
GetOverlappedResult
DeviceIoControl
GetExitCodeProcess
OpenEventA
TlsGetValue
TlsSetValue
TerminateProcess
OpenProcess
SetFilePointer
SetThreadAffinityMask
GetLocaleInfoA
GetUserDefaultLCID
GetSystemDefaultLCID
LocalFree
FileTimeToSystemTime
MoveFileExW
SystemTimeToTzSpecificLocalTime
GlobalFree
GlobalAlloc
GlobalLock
WriteFile
GlobalUnlock
GetFileSize
ReadFile
InitializeCriticalSectionAndSpinCount
LoadResource
LockResource
InterlockedDecrement
InterlockedIncrement
GlobalHandle
SizeofResource
InterlockedExchange
FreeLibrary
GetCommandLineW
CreateEventA
Sleep
CloseHandle
GetTickCount
TlsAlloc
SetEvent
TlsFree
GetCurrentThreadId
GetProcessHeap
WaitForSingleObject
HeapFree
GetLastError
SetLastError
RaiseException
TryEnterCriticalSection
GetExitCodeThread
VirtualFree
VirtualAlloc
GetLocalTime
GetCurrentProcessId
InterlockedExchangeAdd
SetProcessShutdownParameters
ReleaseMutex
CreateMutexA
SetErrorMode
LeaveCriticalSection

user32

MapWindowPoints
SetWindowPos
IsWindow
InvalidateRect
InflateRect
MoveWindow
SetWindowRgn
GetWindowRect
SetScrollInfo
GetWindow
ExitWindowsEx
SetCursorPos
CreateIconIndirect
MsgWaitForMultipleObjectsEx
DestroyWindow
TrackMouseEvent
ReleaseCapture
SetForegroundWindow
PtInRect
CheckMenuItem
EnableMenuItem
SetTimer
UnregisterClassA
EnumWindows
GetCursorInfo
GetGUIThreadInfo
GetUserObjectInformationW
EnumDesktopWindows
MsgWaitForMultipleObjects
GetWindowRgn
GetKeyState
SetDlgItemTextA
CreateWindowExA
SendDlgItemMessageA
GetDlgItemTextA
DrawIconEx
GetIconInfo
DrawFocusRect
FrameRect
GetCapture
IsMenu
CreateMenu
GetScrollInfo
ScrollWindowEx
SetScrollPos
SetParent
FlashWindow
GetNextDlgTabItem
GetMessagePos
SetWindowPlacement
GetWindowPlacement
DrawEdge
BlockInput
GetThreadDesktop
GetUpdateRgn
EnumChildWindows
AttachThreadInput
UnhookWindowsHookEx
CallNextHookEx
SendInput
ToAscii
ToUnicode
GetKeyboardState
SetThreadDesktop
CloseDesktop
ActivateKeyboardLayout
OpenInputDesktop
OpenDesktopW
GetKeyboardLayout
GetCursorPos
ScreenToClient
ShowWindow
SetCapture
GetClientRect
BeginPaint
GetParent
EndPaint
KillTimer
SetRect
InvalidateRgn
ClientToScreen
TrackPopupMenuEx
SetFocus
GetMenuState
GetSubMenu
CheckMenuRadioItem
DestroyMenu
OffsetRect
IsWindowVisible
CreatePopupMenu
RemoveMenu
GetDesktopWindow
BringWindowToTop
GetDlgCtrlID
GetDlgItem
FillRect
IsIconic
ShowScrollBar
IntersectRect
UpdateWindow
AdjustWindowRect
GetSystemMetrics
CopyRect
RedrawWindow
MessageBeep
GetDC
EndDialog
GetForegroundWindow
SetActiveWindow
GetSystemMenu
GetSysColorBrush
GetWindowThreadProcessId
WindowFromPoint
IsRectEmpty
SetRectEmpty
GetMenuItemCount
GetAsyncKeyState
DestroyIcon
DeleteMenu
PostQuitMessage
AdjustWindowRectEx
GetMenu
IsWindowEnabled
MessageBoxA
TranslateMessage
SetWindowContextHelpId
MapDialogRect
GetSysColor
IsChild
DestroyAcceleratorTable
GetFocus
OpenClipboard
GetClipboardViewer
ChangeClipboardChain
SetClipboardViewer
CloseClipboard
SetClipboardData
EmptyClipboard
ReleaseDC
GetWindowDC
GetCursor
EqualRect
UnionRect
SetCursor
DestroyCursor
GetActiveWindow

gdi32

PtInRegion
GetDCOrgEx
GetSystemPaletteEntries
GetRegionData
GetRgnBox
PatBlt
SetPixel
GetObjectType
CreateRoundRectRgn
CreateRectRgnIndirect
RealizePalette
SelectPalette
CreatePalette
RoundRect
GetPixel
CreatePatternBrush
StretchBlt
SetStretchBltMode
CreateBitmap
SetViewportOrgEx
SetWindowOrgEx
GetClipBox
SetBkColor
SetBrushOrgEx
CreateCompatibleBitmap
GetDIBits
SelectClipRgn
CreateDIBSection
SetTextColor
SetDIBColorTable
Polygon
LineTo
Ellipse
MoveToEx
GetDeviceCaps
OffsetRgn
SetRectRgn
CreateCompatibleDC
CreatePen
Rectangle
SelectObject
CreateSolidBrush
RectInRegion
CombineRgn
GetStockObject
SetBkMode
BitBlt
CreatePolygonRgn
CreateRectRgn
DeleteObject
DeleteDC

advapi32

GetSidIdentifierAuthority
RegFlushKey
RegSetValueExA
ImpersonateLoggedOnUser
RevertToSelf
AllocateAndInitializeSid
SetSecurityInfo
GetSecurityInfo
FreeSid
LookupAccountSidW
LookupAccountNameW
EqualSid
CreateProcessAsUserW
StartServiceW
CloseServiceHandle
DeleteAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegCloseKey
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
GetAce

shell32

ord680
SHAppBarMessage
DragFinish
DragAcceptFiles
SHGetMalloc
ord155
SHGetSpecialFolderLocation

ole32

StringFromGUID2
CreateStreamOnHGlobal
CLSIDFromProgID
CoCreateInstance
OleLockRunning
CoGetClassObject
CoTaskMemRealloc
CoInitializeSecurity
CLSIDFromString
CoTaskMemAlloc
CoUninitialize
CoInitializeEx
CoCreateGuid
OleUninitialize
OleInitialize
CoTaskMemFree

oleaut32

SysAllocStringLen
VarUI4FromStr
OleCreatePropertyFrame
VariantInit
OleCreateFontIndirect
SysStringByteLen
SysStringLen
LoadTypeLi
VariantClear
SysAllocString
LoadRegTypeLi
SafeArrayGetDim
SafeArrayGetElement
VariantChangeType
VariantCopy
SysFreeString

shlwapi

PathCompactPathW

mpr

WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW

crypt32

CertGetNameStringA
CertGetNameStringW
CryptVerifyMessageSignature
CertFreeCertificateContext

imagehlp

ImageGetCertificateHeader
ImageGetCertificateData
ImageEnumerateCertificates

wininet

InternetGoOnlineA
InternetQueryOptionW
HttpSendRequestA
InternetQueryDataAvailable
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
HttpAddRequestHeadersA
HttpOpenRequestA
HttpSendRequestW
InternetConnectW
HttpOpenRequestW
InternetReadFile
InternetErrorDlg
HttpQueryInfoW
InternetCloseHandle
InternetOpenW
InternetSetOptionW
DetectAutoProxyUrl

sensapi

IsNetworkAlive

urlmon

URLDownloadToFileA

Sections

.text
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 160KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TeamViewer_Desktop.exe
.exe windows:4 windows x86 arch:x86

1914baeb72d137b9190e43e6ba5cda45

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f6:50:78:f6:ba:65:48:15:a3:7e:3c:02:85:f3:21:5e:71:d8:b3:73
Signer

Actual PE Digest

f6:50:78:f6:ba:65:48:15:a3:7e:3c:02:85:f3:21:5e:71:d8:b3:73

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer_6.0_Release\TeamViewer\qs_release\TeamViewer_Desktop.pdb

Imports

ws2_32

listen
WSASocketW
setsockopt
connect
accept
ioctlsocket
closesocket
WSASetLastError
WSASend
inet_ntoa
gethostbyname
inet_addr
WSAGetLastError
gethostname
getsockname
bind
WSARecv
WSACleanup
WSAAddressToStringA
getsockopt
ntohl
ntohs
getservbyname
htons
__WSAFDIsSet
select
htonl
shutdown
getservbyport
gethostbyaddr
WSAStartup

comctl32

InitCommonControlsEx

kernel32

LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
CompareStringA
InterlockedExchangeAdd
CloseHandle
SetProcessShutdownParameters
GetProcessShutdownParameters
GetCurrentProcessId
HeapFree
GetProcessHeap
SetLastError
CreateEventA
InitializeCriticalSection
HeapAlloc
InterlockedDecrement
FlushInstructionCache
DeleteCriticalSection
GetCommandLineW
InterlockedIncrement
GetCurrentProcess
TlsFree
TlsAlloc
FileTimeToSystemTime
FindClose
FileTimeToLocalFileTime
EnterCriticalSection
ReleaseSemaphore
GetSystemTimeAsFileTime
WaitForSingleObject
CreateSemaphoreA
WaitForMultipleObjects
GetLocaleInfoA
GetTickCount
SetEvent
SetThreadAffinityMask
GetCurrentThread
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocalTime
LocalFree
GetSystemDefaultLCID
GetUserDefaultLCID
InitializeCriticalSectionAndSpinCount
SetFilePointer
WriteFile
ReleaseMutex
GetFileSize
OpenProcess
TerminateProcess
ReadFile
DuplicateHandle
ResetEvent
TlsSetValue
TlsGetValue
Sleep
GetExitCodeThread
QueueUserAPC
DeviceIoControl
LockResource
CreateMutexA
GlobalFree
lstrcpyA
ResumeThread
CreateThread
LocalAlloc
GetVersionExA
GetACP
GetThreadLocale
InterlockedCompareExchange
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapDestroy
HeapReAlloc
HeapSize
FormatMessageA
SetEndOfFile
AreFileApisANSI
GetSystemInfo
OpenEventA
SystemTimeToFileTime
SetWaitableTimer
CreateWaitableTimerA
UnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
GetTimeFormatA
GetDateFormatA
RtlUnwind
LCMapStringA
GetStringTypeA
ExitProcess
ExitThread
HeapCreate
GetStdHandle
GetOEMCP
FreeEnvironmentStringsA
GetEnvironmentStrings
SetHandleCount
GetFileType
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
FlushFileBuffers
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
SetEnvironmentVariableA
LoadResource
FreeLibrary
SizeofResource
RaiseException
GetCurrentThreadId
InterlockedExchange
GetLastError
LeaveCriticalSection
SetUnhandledExceptionFilter

user32

EqualRect
OffsetRect
RedrawWindow
GetWindow
InflateRect
IntersectRect
IsRectEmpty
GetThreadDesktop
BlockInput
MsgWaitForMultipleObjectsEx
SendInput
OpenDesktopW
EnumDesktopWindows
GetUserObjectInformationW
CloseDesktop
GetCursorPos
GetGUIThreadInfo
GetWindowDC
EnumWindows
GetCursorInfo
GetIconInfo
UnionRect
WindowFromPoint
UnhookWindowsHookEx
CallNextHookEx
GetDesktopWindow
IsWindowEnabled
GetKeyboardLayout
GetKeyboardState
ToUnicode
GetKeyState
ActivateKeyboardLayout
OpenInputDesktop
SetThreadDesktop
ExitWindowsEx
UnregisterClassA
FillRect
GetParent
GetClientRect
GetSystemMetrics
GetDlgItem
SetWindowPos
PostQuitMessage
GetWindowThreadProcessId
DestroyWindow
MessageBoxA
GetAsyncKeyState
IsWindow
TranslateMessage
ReleaseDC
CopyRect
GetDC
GetForegroundWindow
IsWindowVisible
MapWindowPoints
ScreenToClient
GetWindowRgn
GetWindowRect

advapi32

StartServiceW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
GetSecurityInfo
SetSecurityInfo
AllocateAndInitializeSid
FreeSid
RegSetValueExA
LookupAccountNameW
LookupAccountSidW
EqualSid
ImpersonateLoggedOnUser
RegFlushKey
GetSidIdentifierAuthority
RegCloseKey
CloseServiceHandle
RevertToSelf

ole32

CoTaskMemFree
CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance

oleaut32

VarUI4FromStr
SafeArrayGetElement
SysAllocString
VariantChangeType
VariantCopy
VariantClear
VariantInit
SafeArrayGetDim
SysFreeString

crypt32

CertGetNameStringA
CertGetNameStringW
CryptVerifyMessageSignature
CertFreeCertificateContext

imagehlp

ImageGetCertificateData
ImageGetCertificateHeader
ImageEnumerateCertificates

wininet

DetectAutoProxyUrl
InternetQueryOptionW

urlmon

URLDownloadToFileA

gdi32

CreateSolidBrush
CreateDIBSection
SetRectRgn
SetPixel
OffsetRgn
SelectClipRgn
SelectObject
CreateCompatibleDC
PtInRegion
CreateRectRgnIndirect
CreateRectRgn
GetStockObject
GetDeviceCaps
DeleteDC
CreateCompatibleBitmap
DeleteObject
CombineRgn
SetBkMode
StretchBlt
GetRgnBox
GetRegionData
BitBlt
GetSystemPaletteEntries
RectInRegion
GetDIBits
GetDCOrgEx

shell32

SHGetMalloc
SHGetSpecialFolderLocation

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 426KB - Virtual size: 426KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TeamViewer_Resource_en.dll
.dll windows:4 windows x86 arch:x86

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:bb:02:94:95:6f:0e:a4:bf:25:09:6b:4b:9f:94:b8:d4:88:4d:ad
Signer

Actual PE Digest

41:bb:02:94:95:6f:0e:a4:bf:25:09:6b:4b:9f:94:b8:d4:88:4d:ad

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TeamViewer_Service.exe
.exe windows:4 windows x86 arch:x86

d65b9f360d4f27f3af7bb12f9b2b2af7

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8c:6f:62:e5:8a:a9:ac:37:fa:d7:fe:be:84:b4:ac:9c:5f:92:fe:c3
Signer

Actual PE Digest

8c:6f:62:e5:8a:a9:ac:37:fa:d7:fe:be:84:b4:ac:9c:5f:92:fe:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer_6.0_Release\TeamViewer\qs_release\TeamViewer_Service.pdb

Imports

ws2_32

send
shutdown
getsockopt
WSAEventSelect
WSAWaitForMultipleEvents
WSAResetEvent
ntohl
WSARecvFrom
WSASetLastError
WSASend
accept
ioctlsocket
closesocket
bind
recvfrom
listen
inet_addr
WSAGetLastError
gethostname
inet_ntoa
gethostbyname
WSADuplicateSocketW
WSAStartup
WSACleanup
sendto
socket
getservbyport
getservbyname
WSACloseEvent
getpeername
ntohs
gethostbyaddr
WSASetEvent
WSACreateEvent
connect
setsockopt
WSASocketW
__WSAFDIsSet
select
WSARecv
recv
htonl
getsockname
htons

kernel32

GetDriveTypeA
FindFirstFileA
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
CompareStringA
FreeLibrary
InterlockedExchange
InterlockedIncrement
InterlockedExchangeAdd
InterlockedDecrement
Sleep
SetLastError
SetConsoleCtrlHandler
GetCurrentThreadId
TlsFree
SleepEx
ExpandEnvironmentStringsA
lstrlenA
SetEnvironmentVariableA
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidLocale
EnumSystemLocalesA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetOEMCP
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetStdHandle
HeapSize
GetLastError
TlsAlloc
GetFullPathNameA
GetCurrentDirectoryA
TerminateProcess
ExitThread
ExitProcess
GetStringTypeA
LCMapStringA
RtlUnwind
HeapReAlloc
GetDateFormatA
GetTimeFormatA
IsDebuggerPresent
UnhandledExceptionFilter
CreateWaitableTimerA
SetWaitableTimer
SystemTimeToFileTime
OpenEventA
AreFileApisANSI
SetEndOfFile
FormatMessageA
GetThreadLocale
GetACP
SetEvent
WaitForSingleObject
GetTickCount
DuplicateHandle
CreateEventA
GetCurrentProcess
ReleaseSemaphore
GetSystemTimeAsFileTime
CloseHandle
CreateSemaphoreA
GetLocalTime
LocalFree
GetSystemDefaultLCID
GetUserDefaultLCID
GetLocaleInfoA
FindClose
SetThreadAffinityMask
GetCurrentThread
QueryPerformanceCounter
QueryPerformanceFrequency
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetFilePointer
WriteFile
ReleaseMutex
GetFileSize
GetCurrentProcessId
OpenProcess
FileTimeToSystemTime
ReadFile
WaitForMultipleObjects
TlsGetValue
ResetEvent
HeapAlloc
GetProcessHeap
HeapFree
TlsSetValue
RaiseException
SizeofResource
LoadResource
GetExitCodeProcess
CreateThread
ResumeThread
DeviceIoControl
SetThreadPriority
GetOverlappedResult
QueueUserAPC
GetExitCodeThread
SetUnhandledExceptionFilter
FileTimeToLocalFileTime
InterlockedCompareExchange
GetVersionExA

user32

TranslateMessage
MessageBoxA
UnregisterClassA
ExitWindowsEx
MsgWaitForMultipleObjectsEx
DestroyWindow

advapi32

CloseServiceHandle
SetSecurityInfo
AllocateAndInitializeSid
RevertToSelf
ImpersonateLoggedOnUser
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
GetAce
DeleteAce
ControlService
QueryServiceStatus
DeleteService
RegFlushKey
RegCloseKey
RegSetValueExA
CreateProcessAsUserW
FreeSid
EqualSid
LookupAccountSidW
CryptGenRandom
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptReleaseContext
CryptAcquireContextA
GetSecurityInfo

ole32

CoInitializeEx
CoUninitialize
CoCreateGuid
StringFromGUID2
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
CoInitializeSecurity
CoTaskMemFree

oleaut32

SysFreeString
SysAllocString
VariantClear
VarUI4FromStr

mpr

WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiOpenDevRegKey

iphlpapi

DeleteIPAddress
GetAdapterIndex
GetAdaptersInfo

crypt32

CertGetNameStringW
CertGetNameStringA
CertFreeCertificateContext
CryptVerifyMessageSignature

imagehlp

ImageGetCertificateData
ImageGetCertificateHeader
ImageEnumerateCertificates

wininet

InternetQueryDataAvailable
HttpSendRequestA
InternetErrorDlg
InternetQueryOptionW
InternetGoOnlineA
InternetSetOptionW
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
HttpAddRequestHeadersA
HttpQueryInfoW
HttpOpenRequestA
InternetConnectW
InternetCloseHandle
InternetOpenW
InternetReadFile

sensapi

IsNetworkAlive

shell32

SHGetMalloc
SHGetSpecialFolderLocation

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 535KB - Virtual size: 534KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
tv_w32.dll
.dll windows:4 windows x86 arch:x86

798ed578c45b3498ce7896558c5e55e0

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:5f:25:48:bf:0e:f0:36:0b:90:72:cb:7f:8e:da:53:59:ea:3d:be
Signer

Actual PE Digest

10:5f:25:48:bf:0e:f0:36:0b:90:72:cb:7f:8e:da:53:59:ea:3d:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\TeamViewer_6.0_Release\TeamViewer\TVHooks64\release\tv_w32dll.pdb

Imports

crtdll

_snprintf
_strlwr
strncpy
strrchr
memset
memcpy
memmove
_vsnprintf
wcsstr
_wcslwr
_global_unwind2
_local_unwind2
_initterm
malloc
strncmp
strncat

comctl32

InitCommonControlsEx

kernel32

CreateEventW
GetVersionExW
UnmapViewOfFile
InterlockedDecrement
InterlockedIncrement
ReleaseMutex
SetEvent
WaitForSingleObject
GetTickCount
GetLastError
IsBadWritePtr
IsBadReadPtr
MapViewOfFile
CreateFileMappingW
FreeLibraryAndExitThread
Sleep
LoadLibraryW
GetModuleFileNameW
LocalAlloc
ResumeThread
CreateThread
SetLastError
GlobalFree
GlobalAlloc
GetVersion
GetCurrentThreadId
GetLocalTime
CreateMutexW
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
DisableThreadLibraryCalls
CloseHandle
OpenMutexW
LeaveCriticalSection
GetModuleFileNameA
EnterCriticalSection
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
FreeLibrary
LocalFree
GetCurrentProcessId

user32

GetSysColor
LoadBitmapW
GetWindow
SystemParametersInfoW
GetClientRect
CreateWindowExW
IsZoomed
GetWindowInfo
GetClassNameA
IsRectEmpty
DefWindowProcW
RedrawWindow
CallWindowProcW
MoveWindow
DestroyWindow
IsIconic
PostMessageW
TrackMouseEvent
InvalidateRect
EndPaint
BeginPaint
GetActiveWindow
SetWindowLongW
GetWindowLongW
FindWindowExW
FindWindowW
MapWindowPoints
GetDesktopWindow
ClientToScreen
GetDC
GetUpdateRect
ShowWindow
GetClassInfoExW
UnregisterClassW
LoadCursorW
RegisterClassExW
SendMessageW
SendMessageTimeoutW
CallNextHookEx
GetWindowDC
GetWindowRect
ReleaseDC
UnhookWindowsHookEx
SendNotifyMessageW
IsWindow
SetWindowsHookExW
SetWindowPos
RegisterWindowMessageW
GetSystemMetrics
IsWindowVisible

gdi32

RectVisible
BitBlt
GetPixel
SetPixel
CreateCompatibleDC
GetObjectW
CreateCompatibleBitmap
CreateSolidBrush
MoveToEx
LineTo
ExtCreatePen
Polyline
DeleteDC
CreatePen
SelectObject
GetStockObject
Rectangle
DeleteObject

Exports

Exports

GetLoaderInterface
GetTeamViewerInterface

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tv_w32.exe
.exe windows:4 windows x86 arch:x86

68da36c705041bcb516a1b6caabad0aa

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:d8:73:5d:da:bb:b6:a8:42:4b:c8:a7:f2:0a:a1:d4:18:ec:93:f3
Signer

Actual PE Digest

63:d8:73:5d:da:bb:b6:a8:42:4b:c8:a7:f2:0a:a1:d4:18:ec:93:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer_6.0_Release\TeamViewer\TVHooks64\release\tv_w32exe.pdb

Imports

kernel32

GetLastError
SetEvent
GetVersionExW
CreateEventW
CloseHandle
GetProcAddress
LoadLibraryA
GetModuleFileNameA
FreeLibrary
GetSystemDirectoryW
LoadLibraryW
GetTickCount
OpenMutexA
GetCurrentProcessId
CreateMutexW
SetFilePointer
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcess
GetCommandLineW
FlushFileBuffers
CreateFileA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
LCMapStringA
LCMapStringW
Sleep
HeapSize
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
VirtualQuery

user32

PeekMessageW
MsgWaitForMultipleObjectsEx
DispatchMessageW
TranslateMessage

shell32

ShellExecuteExW

Sections

.text
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
tv_x64.dll
.dll windows:4 windows x64 arch:x64

09c5b20b66e0f7caa44c28dfae2d9a8d

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f8:a8:f9:55:5d:6f:f3:5d:77:97:5e:a9:cf:42:a5:47:4b:8e:f5:76
Signer

Actual PE Digest

f8:a8:f9:55:5d:6f:f3:5d:77:97:5e:a9:cf:42:a5:47:4b:8e:f5:76

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\TeamViewer_6.0_Release\TeamViewer\TVHooks64\release\tv_x64dll.pdb

Imports

msvcrt

malloc
free
_initterm
_wcslwr
wcsstr
strncmp
memmove
memcpy
__C_specific_handler
memset
strrchr
strncpy
_strlwr
_snprintf
_vsnprintf
strncat

comctl32

InitCommonControlsEx

kernel32

SetLastError
CreateThread
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
CloseHandle
OpenMutexW
LeaveCriticalSection
GetModuleFileNameA
EnterCriticalSection
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
FreeLibrary
LocalFree
CreateMutexW
CreateEventW
GetVersionExW
UnmapViewOfFile
ReleaseMutex
SetEvent
WaitForSingleObject
GetTickCount
GetLastError
IsBadWritePtr
IsBadReadPtr
MapViewOfFile
CreateFileMappingW
FreeLibraryAndExitThread
Sleep
LoadLibraryW
GetModuleFileNameW
LocalAlloc
ResumeThread

user32

GetUpdateRect
RegisterWindowMessageW
SetWindowPos
IsWindowVisible
SetWindowsHookExW
IsWindow
SendNotifyMessageW
UnhookWindowsHookEx
ReleaseDC
GetWindowRect
GetWindowDC
CallNextHookEx
SendMessageTimeoutW
SendMessageW
RegisterClassExW
LoadCursorW
UnregisterClassW
GetClassInfoExW
ShowWindow
GetWindow
GetSysColor
LoadBitmapW
GetSystemMetrics
SystemParametersInfoW
GetClientRect
CreateWindowExW
IsZoomed
GetWindowInfo
GetClassNameA
IsRectEmpty
DefWindowProcW
CallWindowProcW
RedrawWindow
MoveWindow
DestroyWindow
IsIconic
PostMessageW
TrackMouseEvent
InvalidateRect
GetActiveWindow
SetWindowLongPtrW
EndPaint
BeginPaint
GetWindowLongPtrW
FindWindowExW
FindWindowW
MapWindowPoints
GetDesktopWindow
ClientToScreen
GetDC

gdi32

BitBlt
GetPixel
SetPixel
CreateCompatibleDC
GetObjectW
CreateCompatibleBitmap
CreateSolidBrush
MoveToEx
RectVisible
ExtCreatePen
Polyline
DeleteDC
CreatePen
SelectObject
GetStockObject
Rectangle
DeleteObject
LineTo

Exports

Exports

GetLoaderInterface

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shared
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 218B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tv_x64.exe
.exe windows:4 windows x64 arch:x64

fe0ec5a2a04130d9900b2dd133a00d2b

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:d0:22:6b:28:c5:9a:eb:40:33:63:5c:2a:72:90:78:81:8c:2e:51
Signer

Actual PE Digest

47:d0:22:6b:28:c5:9a:eb:40:33:63:5c:2a:72:90:78:81:8c:2e:51

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\TeamViewer_6.0_Release\TeamViewer\TVHooks64\release\tv_x64exe.pdb

Imports

kernel32

CreateEventW
CloseHandle
GetLastError
SetEvent
GetVersionExW
GetProcAddress
LoadLibraryA
GetModuleFileNameA
FreeLibrary
GetSystemDirectoryW
LoadLibraryW
OpenMutexA
GetTickCount
CreateMutexW
SetFilePointer
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId
GetCurrentProcess
GetCommandLineW
FlushFileBuffers
CreateFileA
WriteConsoleW
WideCharToMultiByte
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
FlsAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
Sleep
HeapSize
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapReAlloc
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP

user32

MsgWaitForMultipleObjectsEx
DispatchMessageW
TranslateMessage
PeekMessageW

shell32

ShellExecuteExW

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
x64/TVMonitor.inf
x64/TVMonitor.sys
.sys windows:6 windows x64 arch:x64

f24b69173de020aa0ac1739d7b40e04c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3b
Signer

Actual PE Digest

28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

j:\teamviewer6.0\monitordriver\objfre_wlh_amd64\amd64\TVMonitor.pdb

Imports

ntoskrnl.exe

IoAcquireRemoveLockEx
KeClearEvent
IoDeleteSymbolicLink
_snwprintf
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoReleaseRemoveLockEx
IoDetachDevice
PoRequestPowerIrp
KeSetTimerEx
PsCreateSystemThread
PsTerminateSystemThread
PoStartNextPowerIrp
ZwClose
IofCompleteRequest
IoReleaseRemoveLockAndWaitEx
ObReferenceObjectByHandle
KeWaitForSingleObject
IoGetAttachedDeviceReference
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateSymbolicLink
ObfDereferenceObject
IoInitializeRemoveLockEx
IoCreateDevice
KeInitializeTimerEx
KeCancelTimer
KeWaitForMultipleObjects
IofCallDriver
KeBugCheckEx

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/tvmonitor.cat
x86/TVMonitor.inf
x86/TVMonitor.sys
.sys windows:6 windows x86 arch:x86

bc06eb1dad5e8285411e580cdee99e10

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83
Signer

Actual PE Digest

a9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

j:\teamviewer6.0\monitordriver\objfre_wxp_x86\i386\TVMonitor.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
_snwprintf
IofCompleteRequest
IoReleaseRemoveLockEx
PoCallDriver
IoAcquireRemoveLockEx
PoStartNextPowerIrp
IofCallDriver
ObfDereferenceObject
IoGetAttachedDeviceReference
IoDeleteDevice
IoDetachDevice
KeWaitForSingleObject
KeSetEvent
PoRequestPowerIrp
IoAttachDeviceToDeviceStack
IoDeleteSymbolicLink
IoInitializeRemoveLockEx
IoCreateSymbolicLink
IoCreateDevice
InterlockedIncrement
IoReleaseRemoveLockAndWaitEx
PsTerminateSystemThread
KeCancelTimer
KeWaitForMultipleObjects
KeSetTimerEx
KeClearEvent
KeInitializeTimerEx
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
KeTickCount
KeBugCheckEx
KeInitializeEvent
KeGetCurrentThread

hal

KeGetCurrentIrql

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 277B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 384B - Virtual size: 274B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/tvmonitor.cat
out.upx
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

0b:57:55:4b:e6:84:15:d4:eb:7b:ba:03:fe:3c:ba:19:1b:a5:2a:aaSigner

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 196KB

UPX1 Size: 17KB - Virtual size: 20KB

.rsrc Size: 24KB - Virtual size: 28KB

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 25KB

.reloc Size: 1024B - Virtual size: 836B

d29e408dd9048e10d5936c6f2bfca832

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 42KB - Virtual size: 42KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 176B

.reloc Size: 5KB - Virtual size: 5KB

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 1024B - Virtual size: 520B

88d67657017b9d8004b8a2d8a16f30a6

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

winspool.drv

advapi32

shell32

ole32

oleaut32

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

0b:57:55:4b:e6:84:15:d4:eb:7b:ba:03:fe:3c:ba:19:1b:a5:2a:aa
Signer

UPX0
Size: - Virtual size: 196KB

UPX1
Size: 17KB - Virtual size: 20KB

.rsrc
Size: 24KB - Virtual size: 28KB

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 25KB

.reloc
Size: 1024B - Virtual size: 836B

.text
Size: 42KB - Virtual size: 42KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 92KB - Virtual size: 91KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 5KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 8KB - Virtual size: 7KB

.text
Size: 129KB - Virtual size: 129KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 6KB - Virtual size: 22KB

.rsrc
Size: 1024B - Virtual size: 840B

.reloc
Size: 12KB - Virtual size: 11KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

15:ad:b7:78:fa:6a:43:10:33:3b:07:f1:b4:d1:27:7e:4d:cb:cb:f0
Signer

.text
Size: 5.2MB - Virtual size: 5.2MB

.orpc
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 160KB - Virtual size: 1.3MB