b155bc0fe5e27121ec1a6f8a23992726_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

b155bc0fe5e27121ec1a6f8a23992726_JaffaCakes118
Size

4.0MB
MD5

b155bc0fe5e27121ec1a6f8a23992726
SHA1

d0c4345974ceede74670036a89af9061f6f42e56
SHA256

b474b15d0895ef9f6bd317c0aa884878360701f96e98ed5006529e2c53acb8cd
SHA512

b27dfcbe1530dba99247d4f5386564e7db304b7520cfe5fa6daa1cabfac322ee5f1d28b8221f430db0b933d3f20eac500152cc033873a8e4545b1275b9334a90
SSDEEP

98304:X7J54jjrClrspscKRdyhr4Ntw+IWWbVF22fzf2B:X7EGlrOThCnoFX2B

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
b155bc0fe5e27121ec1a6f8a23992726_JaffaCakes118
unpack001/msimg32.dll

Files

b155bc0fe5e27121ec1a6f8a23992726_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4ea4df5d94204fc550be1874e1b77ea7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
Sleep
GetTickCount
CreateFileW
GetFileSize
MoveFileW
SetFileAttributesW
GetModuleFileNameW
CopyFileW
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
WaitForSingleObject
GetCurrentProcess
CompareFileTime
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
WriteFile
lstrcpyA
lstrcpyW
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GlobalFree
GlobalAlloc
GetShortPathNameW
SearchPathW
lstrcmpiW
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
lstrcmpW
GetDiskFreeSpaceW
lstrlenW
lstrcpynW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW

user32

GetSystemMenu
SetClassLongW
IsWindowEnabled
EnableMenuItem
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
wsprintfW
ScreenToClient
GetWindowRect
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
LoadImageW
SetTimer
SetWindowTextW
PostQuitMessage
ShowWindow
GetDlgItem
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow

gdi32

SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW

advapi32

RegDeleteKeyW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW

comctl32

ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 189KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SkypeC0SvcService.exe
.exe windows:5 windows x86 arch:x86

94f8a1539e17c7b1cf734cd4693a3598

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

97:a0:11:6e:8f:aa:c1:7d:a0:a1:31:d7:63:25:1c:c2:94:3a:0b:ef
Signer

Actual PE Digest

97:a0:11:6e:8f:aa:c1:7d:a0:a1:31:d7:63:25:1c:c2:94:3a:0b:ef

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\Release2008\TeamViewer.pdb

Imports

avicap32

capGetDriverDescriptionW

msvfw32

DrawDibDraw
DrawDibOpen
DrawDibClose

winmm

mixerGetDevCapsW
mixerOpen
waveInOpen
waveInPrepareHeader
timeEndPeriod
waveInGetDevCapsW
timeBeginPeriod
mixerSetControlDetails
mixerGetControlDetailsW
mixerClose
mixerGetLineControlsW
mixerGetLineInfoW
mixerGetID
waveOutGetDevCapsW
waveInUnprepareHeader
waveInClose
waveInReset
waveInStart
waveOutOpen
waveOutPrepareHeader
waveOutPause
waveOutWrite
waveOutUnprepareHeader
waveOutClose
waveInAddBuffer
waveOutReset
waveOutRestart
waveInGetNumDevs
waveOutGetNumDevs

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

GetUserDefaultLCID
GetCurrentDirectoryA
PeekNamedPipe
GetFullPathNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetStringTypeA
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
GetModuleFileNameA
GetStdHandle
CompareStringA
GetStringTypeW
LCMapStringW
LCMapStringA
GetDateFormatA
GetTimeFormatA
FindFirstFileA
GetDriveTypeA
ExitProcess
GetStartupInfoA
GetCommandLineA
GetCPInfo
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
CreateWaitableTimerA
CreateFileMappingA
MapViewOfFileEx
CreateFileA
UnmapViewOfFile
AreFileApisANSI
GetModuleHandleA
GetFileTime
GetFileInformationByHandle
RemoveDirectoryW
GetLocaleInfoA
EnumSystemLocalesA
HeapReAlloc
HeapDestroy
IsProcessorFeaturePresent
QueryPerformanceFrequency
SetEndOfFile
ReadFileEx
GetOverlappedResult
CancelIo
WaitForMultipleObjectsEx
GetFileAttributesExW
SetFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetFileAttributesW
GlobalSize
GetSystemTime
WaitForSingleObjectEx
GetLogicalDriveStringsW
DeviceIoControl
GetDateFormatW
GetTempPathW
SystemTimeToFileTime
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
MoveFileExW
CreateProcessW
ProcessIdToSessionId
TerminateProcess
WaitNamedPipeW
GetPrivateProfileIntW
GetWindowsDirectoryW
OpenProcess
InterlockedCompareExchange
GetQueuedCompletionStatus
TerminateThread
QueueUserAPC
CreateIoCompletionPort
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
ExpandEnvironmentStringsW
FormatMessageW
SetThreadAffinityMask
MoveFileW
SetFilePointer
GetSystemDirectoryW
SetUnhandledExceptionFilter
FileTimeToLocalFileTime
QueryPerformanceCounter
ExpandEnvironmentStringsA
LocalAlloc
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
GetThreadTimes
HeapSize
FormatMessageA
GetSystemDirectoryA
LoadLibraryA
CompareFileTime
CompareStringW
GetVolumeInformationW
GetDriveTypeW
lstrcpyW
FindFirstFileW
GetFullPathNameW
FindClose
FindNextFileW
GetCurrentThread
SetThreadPriority
GetPriorityClass
SetPriorityClass
TryEnterCriticalSection
GetLastError
CloseHandle
CreateEventA
WaitForSingleObject
SetEvent
EnterCriticalSection
LeaveCriticalSection
SleepEx
InterlockedIncrement
Sleep
GetSystemTimeAsFileTime
InitializeCriticalSection
DeleteCriticalSection
CreateSemaphoreA
ReleaseSemaphore
HeapFree
GetProcessHeap
SetWaitableTimer
PostQueuedCompletionStatus
InterlockedExchange
InterlockedExchangeAdd
HeapAlloc
GetCurrentThreadId
VirtualAlloc
VirtualFree
GetLocaleInfoW
DuplicateHandle
GetLocalTime
GetTimeFormatW
DeleteFileW
GetComputerNameW
CopyFileW
GetCommandLineW
LoadLibraryExW
lstrcmpiW
CreateMutexW
ReleaseMutex
TlsAlloc
TlsFree
FindResourceExW
SizeofResource
CreateThread
ResumeThread
GetExitCodeThread
CreateDirectoryW
SetErrorMode
SetProcessShutdownParameters
lstrlenA
MultiByteToWideChar
LoadResource
LockResource
GlobalHandle
lstrcmpW
MulDiv
FindResourceW
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
lstrcpynW
GetVersionExW
WritePrivateProfileStringW
GetFileSize
ReadFile
GetPrivateProfileStringW
LoadLibraryW
FreeLibrary
WideCharToMultiByte
GlobalAlloc
GlobalLock
CreateFileW
WriteFile
GlobalUnlock
GlobalFree
GetTickCount
InterlockedDecrement
LocalFree
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
lstrlenW
SetLastError
GetCurrentProcess
FlushInstructionCache
RaiseException
ResetEvent
OpenEventA
GetCurrentProcessId
WaitForMultipleObjects
CreateWaitableTimerW
CreateEventW
SetFileAttributesW

user32

GetWindowLongW
SetWindowPos
GetWindowRect
GetClientRect
UnregisterClassA
BlockInput
GetClassInfoW
RegisterClassW
RegisterClipboardFormatW
EnumDisplayMonitors
DefWindowProcW
IsWindow
DestroyWindow
DestroyCursor
SetLayeredWindowAttributes
ExitWindowsEx
GetCursor
MessageBoxA
SetMenuInfo
SetForegroundWindow
ChildWindowFromPointEx
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
CopyIcon
WindowFromPoint
GetWindowThreadProcessId
GetClassLongW
GetDlgItemTextW
DrawTextExW
UpdateLayeredWindow
IntersectRect
GetDialogBaseUnits
MsgWaitForMultipleObjects
PostQuitMessage
GetMenuItemID
GetMenuItemCount
MonitorFromWindow
TrackPopupMenuEx
MessageBoxW
MessageBeep
SetDlgItemTextW
RemoveMenu
SetWindowContextHelpId
SendDlgItemMessageW
MapDialogRect
CreateDialogIndirectParamW
EnumDisplaySettingsW
EnumDisplayDevicesW
SetWindowsHookExW
CallNextHookEx
ActivateKeyboardLayout
GetKeyboardLayout
SetWindowLongW
GetKeyboardState
VkKeyScanExW
UnhookWindowsHookEx
MapVirtualKeyW
ToUnicode
AttachThreadInput
EnumChildWindows
GetUpdateRgn
LoadBitmapW
SwitchToThisWindow
OpenDesktopW
SetThreadDesktop
CloseDesktop
LoadStringW
InvalidateRect
ShowWindow
GetClassInfoExW
LoadCursorW
RegisterClassExW
CreateWindowExW
MoveWindow
ClientToScreen
GetSystemMetrics
BeginPaint
EndPaint
FillRect
RedrawWindow
CharNextW
SendMessageW
SendNotifyMessageW
BringWindowToTop
GetDC
SetFocus
ReleaseDC
GetAsyncKeyState
CreateDialogParamW
SetClassLongW
DrawStateW
DrawFocusRect
FrameRect
GetCapture
DrawIconEx
DrawIcon
GetCursorInfo
GetKeyState
GetMessageW
TranslateAcceleratorW
SetWindowPlacement
GetNextDlgTabItem
LoadAcceleratorsW
DrawEdge
GetMessagePos
SendInput
CallWindowProcW
GetActiveWindow
CreatePopupMenu
AppendMenuW
InsertMenuW
InsertMenuItemW
IsMenu
CreateMenu
DestroyMenu
PostMessageW
IsWindowVisible
PtInRect
GetCursorPos
ScreenToClient
InvalidateRgn
SetTimer
KillTimer
SetCapture
ScrollWindowEx
SetParent
RegisterWindowMessageW
CreateAcceleratorTableW
DestroyAcceleratorTable
GetSysColor
IsChild
GetSystemMenu
FindWindowExW
GetSysColorBrush
TrackPopupMenu
MonitorFromPoint
SetScrollInfo
CopyRect
IsRectEmpty
InflateRect
UnionRect
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
OffsetRect
DestroyIcon
MapWindowPoints
GetWindow
SystemParametersInfoW
UpdateWindow
SetScrollPos
GetScrollInfo
SetCursorPos
SetCursor
CreateIconIndirect
ReleaseCapture
CheckMenuItem
OpenClipboard
GetClipboardViewer
SetClipboardViewer
ChangeClipboardChain
FindWindowW
SetActiveWindow
GetLastInputInfo
GetWindowPlacement
GetFocus
SetRect
IsWindowEnabled
IsIconic
GetForegroundWindow
PeekMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage
DispatchMessageW
PostThreadMessageW
GetClassNameW
GetWindowDC
EndDialog
LoadImageW
LoadIconW
MonitorFromRect
GetMonitorInfoW
AdjustWindowRect
SetRectEmpty
ShowScrollBar
GetMenuState
IsDialogMessageW
GetDesktopWindow
GetDlgItem
EnableWindow
GetWindowTextLengthW
GetDlgCtrlID
DialogBoxParamW
DrawTextW
GetWindowTextW
SetWindowTextW
GetSubMenu
LoadMenuW
CheckMenuRadioItem
GetMenuStringW
DeleteMenu
TrackMouseEvent
EqualRect
SetWindowRgn
GetParent
SetMenuItemInfoW
GetMenuItemInfoW
EnableMenuItem

gdi32

SetBkMode
SelectClipRgn
CreatePolygonRgn
SetLayout
ExtTextOutW
GetObjectType
SetBkColor
SetTextColor
SetPixel
SetViewportOrgEx
SetBrushOrgEx
CreateCompatibleBitmap
BitBlt
SelectObject
CreateCompatibleDC
GetObjectW
CreatePalette
GetClipRgn
CreateRectRgn
EndPath
SetStretchBltMode
CreateDIBSection
RealizePalette
SelectPalette
DeleteDC
GetDeviceCaps
DeleteObject
GetCurrentObject
DPtoLP
CreateRectRgnIndirect
RoundRect
CreateRoundRectRgn
PatBlt
GetStockObject
GetDIBits
GetTextMetricsW
CreateSolidBrush
GetTextExtentPoint32W
GetClipBox
TextOutW
MoveToEx
LineTo
CreatePen
GetPixel
CreatePatternBrush
SetRectRgn
OffsetRgn
CreateFontIndirectW
Ellipse
Rectangle
SetDIBColorTable
Polygon
GetViewportOrgEx
CreateFontW
SetWindowOrgEx
CreateBitmap
CombineRgn
BeginPath
StrokeAndFillPath
GetLayout
GetBkMode
GetTextColor
StretchBlt
GetBitmapBits
GetRgnBox

comdlg32

CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW

advapi32

SetEntriesInAclW
GetSidIdentifierAuthority
LsaLookupNames
LsaFreeMemory
LsaClose
ConvertSidToStringSidW
LsaOpenPolicy
OpenThreadToken
RegFlushKey
ImpersonateLoggedOnUser
AllocateAndInitializeSid
GetSecurityInfo
SetSecurityInfo
LogonUserW
LookupAccountSidW
LookupAccountNameW
EqualSid
FreeSid
RegCreateKeyW
RegOpenCurrentUser
CreateProcessAsUserW
StartServiceW
GetNamedSecurityInfoW
GetAce
DeleteAce
SetNamedSecurityInfoW
RevertToSelf
CryptGenRandom
CryptAcquireContextA
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptHashData
CryptAcquireContextW
CryptCreateHash
GetUserNameW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
MakeSelfRelativeSD
InitializeSecurityDescriptor
InitiateSystemShutdownW
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
CreateWellKnownSid
SetSecurityDescriptorOwner
OpenSCManagerW
OpenServiceW
CloseServiceHandle
ControlService

shell32

SHGetFileInfoW
ord680
Shell_NotifyIconW
DragAcceptFiles
SHBrowseForFolderW
ord155
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHGetMalloc
DragQueryFileW
ExtractIconW
SHAppBarMessage
ExtractIconExW
ShellExecuteW
SHGetSpecialFolderLocation
ShellExecuteExW
DragFinish

ole32

CoUninitialize
CoFreeUnusedLibraries
CoInitialize
CoGetClassObject
OleLockRunning
StringFromGUID2
CoTaskMemFree
CLSIDFromString
CoCreateGuid
CoMarshalInterThreadInterfaceInStream
CoInitializeSecurity
DoDragDrop
CoGetInterfaceAndReleaseStream
OleDuplicateData
CoRevokeClassObject
CoRegisterClassObject
ProgIDFromCLSID
CoInitializeEx
CoRevertToSelf
CoImpersonateClient
CoCreateInstance
IIDFromString
StringFromIID
CoTaskMemRealloc
RevokeDragDrop
PropVariantClear
RegisterDragDrop
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
ReleaseStgMedium
CLSIDFromProgID

oleaut32

SysAllocString
VarUI4FromStr
OleCreateFontIndirect
SysAllocStringLen
OleCreatePropertyFrame
VariantInit
VarDateFromStr
VariantTimeToSystemTime
VariantClear
LoadRegTypeLi
SysFreeString
RegisterTypeLi
UnRegisterTypeLi
DispCallFunc
SysStringLen
LoadTypeLi

shlwapi

PathCompactPathW
AssocQueryStringW

comctl32

DestroyPropertySheetPage
InitCommonControlsEx
ImageList_Draw
ImageList_GetIconSize
ImageList_DragLeave
ImageList_DragEnter
ImageList_DragMove
ImageList_EndDrag
ImageList_BeginDrag
ImageList_GetIcon
CreatePropertySheetPageW
PropertySheetW
ImageList_SetBkColor
ImageList_Remove
ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon

ws2_32

gethostbyname
inet_addr
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSACleanup
WSAStartup
inet_ntoa
gethostbyaddr
getservbyport
ioctlsocket
shutdown
ntohl
WSAResetEvent
WSACreateEvent
sendto
WSACloseEvent
WSAWaitForMultipleEvents
WSAEventSelect
WSASetEvent
recvfrom
accept
listen
WSARecv
WSARecvFrom
WSASend
WSASocketW
WSADuplicateSocketW
WSAAddressToStringA
getservbyname
htonl
gethostname

msimg32

AlphaBlend

mpr

WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW

netapi32

NetApiBufferFree
NetServerEnum
NetWkstaGetInfo
NetUserGetInfo
NetUserModalsGet

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiOpenDevRegKey

sensapi

IsNetworkAlive

wininet

InternetSetOptionW
InternetOpenW
HttpQueryInfoW
InternetReadFile
InternetQueryDataAvailable
HttpEndRequestA
InternetWriteFile
InternetConnectW
HttpSendRequestA
InternetErrorDlg
InternetQueryOptionW
InternetGoOnlineA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetCloseHandle

iphlpapi

GetIfEntry
GetBestInterface
GetAdaptersInfo
GetAdapterIndex
DeleteIPAddress
FlushIpNetTable
IpRenewAddress
SendARP
GetIpAddrTable

imagehlp

ImageGetCertificateHeader
ImageGetCertificateData
ImageEnumerateCertificates

secur32

GetUserNameExW

crypt32

CertFreeCertificateContext
CertGetNameStringW
CryptHashCertificate
CryptVerifyMessageSignature

wintrust

WinVerifyTrust

userenv

UnloadUserProfile
LoadUserProfileW
CreateEnvironmentBlock
DestroyEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW
WTSCloseServer
WTSEnumerateProcessesW
WTSFreeMemory
WTSEnumerateSessionsW

mswsock

AcceptEx
GetAcceptExSockaddrs

Sections

.text
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 286KB - Virtual size: 380KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 596KB - Virtual size: 595KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TeamViewer_Desktop.exe
.exe windows:5 windows x86 arch:x86

c942ae5c3bec2566edc10e9dd7bc32e6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:30:60:17:6b:95:4e:e6:70:1f:ec:cc:0e:69:ef:76:5a:4b:e0:7e
Signer

Actual PE Digest

10:30:60:17:6b:95:4e:e6:70:1f:ec:cc:0e:69:ef:76:5a:4b:e0:7e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\Release2008\TeamViewer_Desktop.pdb

Imports

wtsapi32

WTSEnumerateProcessesW
WTSEnumerateSessionsW
WTSFreeMemory

kernel32

GetCurrentProcess
lstrlenW
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetModuleHandleW
lstrcmpiW
FreeLibrary
GetThreadTimes
SetEnvironmentVariableA
CreateFileA
SetStdHandle
MultiByteToWideChar
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
FlushInstructionCache
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
GetModuleFileNameA
GetStdHandle
ExitProcess
CompareStringW
CompareStringA
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
SizeofResource
LoadResource
FindResourceW
LockResource
LoadLibraryExW
GetModuleFileNameW
SetProcessShutdownParameters
GetProcessShutdownParameters
GetCurrentProcessId
GetCommandLineW
SleepEx
GetExitCodeThread
SetWaitableTimer
PostQueuedCompletionStatus
InterlockedExchangeAdd
QueueUserAPC
CreateEventW
CreateWaitableTimerW
lstrcpyW
DeviceIoControl
CreateFileW
Sleep
LocalFree
LocalAlloc
LoadLibraryW
GetCurrentThread
CreateMutexA
TlsAlloc
TlsFree
DuplicateHandle
FindResourceExW
WriteConsoleW
RaiseException
InterlockedExchange
WaitForMultipleObjects
GetLastError
SetLastError
ReleaseSemaphore
CreateSemaphoreA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime
GetCurrentThreadId
SetEvent
GetDateFormatA
GetTimeFormatA
GetStartupInfoA
GetCommandLineA
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
CreateWaitableTimerA
GetSystemInfo
AreFileApisANSI
GetModuleHandleA
WaitForSingleObject
HeapAlloc
CreateEventA
FormatMessageA
GetLocaleInfoA
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
SetEndOfFile
ReadFileEx
GetOverlappedResult
CancelIo
WaitForMultipleObjectsEx
GetSystemTime
CreateThread
GetProcessHeap
HeapFree
CloseHandle
GetTickCount
FlushFileBuffers
ResumeThread
GetFileAttributesW
SetFileAttributesW
GlobalLock
GlobalUnlock
FileTimeToSystemTime
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
GetSystemDirectoryW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
GetFileSize
WriteFile
SetFilePointer
ReleaseMutex
CreateMutexW
CreateDirectoryW
QueryPerformanceFrequency
QueryPerformanceCounter
SetThreadAffinityMask
GetVersionExW
WideCharToMultiByte
FormatMessageW
GetLocalTime
OpenProcess
TerminateProcess
ProcessIdToSessionId
ReadFile
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
OpenEventA
ResetEvent
CreateIoCompletionPort
TerminateThread
GetQueuedCompletionStatus
InterlockedCompareExchange
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetLocaleInfoW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SystemTimeToFileTime

user32

DestroyWindow
GetClassNameW
GetWindowInfo
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
IsZoomed
ShowWindow
SetWindowPos
GetForegroundWindow
SystemParametersInfoW
EqualRect
IntersectRect
OffsetRect
IsRectEmpty
PtInRect
SetRectEmpty
CopyRect
InflateRect
InvalidateRect
IsWindow
GetCursorPos
SendMessageW
LockWorkStation
EnumWindows
MapWindowPoints
FindWindowW
FindWindowExW
SetWindowsHookExW
UnhookWindowsHookEx
GetCursorInfo
GetIconInfo
DrawTextW
GetSystemMetrics
GetWindowRgn
IsWindowEnabled
WindowFromPoint
GetDesktopWindow
CallNextHookEx
GetWindow
GetWindowDC
UnionRect
RedrawWindow
GetWindowThreadProcessId
GetGUIThreadInfo
GetParent
GetDC
ReleaseDC
FillRect
GetWindowLongW
CallWindowProcW
DefWindowProcW
GetClientRect
SetLayeredWindowAttributes
MsgWaitForMultipleObjectsEx
GetUserObjectInformationW
LoadStringW
OpenInputDesktop
SetThreadDesktop
ExitWindowsEx
EnumDisplayDevicesW
ChangeDisplaySettingsExW
EnumDisplaySettingsW
EnumDisplayMonitors
ScreenToClient
SetWindowLongW
GetDlgItem
LoadBitmapW
GetAsyncKeyState
LoadImageW
ToUnicode
MapVirtualKeyW
VkKeyScanExW
GetKeyboardState
GetKeyState
GetKeyboardLayout
ActivateKeyboardLayout
RegisterClipboardFormatW
UnregisterClassA
GetThreadDesktop
BlockInput
KillTimer
SetTimer
OpenDesktopW
EnumDesktopWindows
CloseDesktop
PostThreadMessageW
IsWindowVisible
PostMessageW
SendInput
SendNotifyMessageW
MessageBoxA
PostQuitMessage
MessageBoxW
CreateDialogParamW
RegisterClassExW
CreateWindowExW
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadCursorW
GetClassInfoExW

gdi32

DeleteObject
SetBkMode
GetSystemPaletteEntries
GetDIBits
GetDeviceCaps
StretchBlt
CreateCompatibleDC
GetObjectW
RectInRegion
CreateRectRgnIndirect
CreateDIBSection
SetPixel
CreateDCW
GetTextExtentPoint32W
SetBkColor
CreateSolidBrush
CreatePen
DeleteDC
TextOutW
RoundRect
GetDCOrgEx
BitBlt
SelectObject
PtInRegion
GetRgnBox
OffsetRgn
SetRectRgn
Rectangle
SelectClipRgn
GetRegionData
CombineRgn
CreateRectRgn
CreateCompatibleBitmap
CreatePatternBrush
CreateFontIndirectW
GetStockObject
ExtCreateRegion
GdiFlush

advapi32

GetSidIdentifierAuthority
StartServiceW
CloseServiceHandle
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
GetUserNameW
RegFlushKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenCurrentUser
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
InitiateSystemShutdownW
RevertToSelf
FreeSid
EqualSid
LookupAccountNameW
LookupAccountSidW
LogonUserW
SetSecurityInfo
SetEntriesInAclW
GetSecurityInfo
AllocateAndInitializeSid
SetNamedSecurityInfoW
GetNamedSecurityInfoW
ImpersonateLoggedOnUser
RegCreateKeyW
DeregisterEventSource
ReportEventW
RegisterEventSourceW

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
ShellExecuteW
SHGetFileInfoW
SHGetMalloc

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitializeSecurity
OleUninitialize
OleInitialize
CoGetInterfaceAndReleaseStream
CoCreateInstance
ReleaseStgMedium

oleaut32

SafeArrayGetElement
VariantClear
SafeArrayGetDim
VarUI4FromStr
SysAllocString
SysFreeString
VariantInit
VariantCopy
VariantChangeType

comctl32

ImageList_Draw
InitCommonControlsEx

msimg32

AlphaBlend

ws2_32

ioctlsocket
htonl
shutdown
gethostbyname
getsockname
getsockopt
closesocket
listen
WSAGetLastError
inet_ntoa
inet_addr
WSAAddressToStringA
select
WSASocketW
WSASend
WSARecv
WSACleanup
WSAStartup
setsockopt
WSASetLastError
ntohl
htons
__WSAFDIsSet
accept
bind
connect

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

imagehlp

ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData

crypt32

CryptHashCertificate
CertFreeCertificateContext
CertGetNameStringW
CryptVerifyMessageSignature

wintrust

WinVerifyTrust

netapi32

NetApiBufferFree
NetUserModalsGet

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 408KB - Virtual size: 408KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 203KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TeamViewer_Resource_en.dll
.dll windows:5 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:14:63:4e:d4:55:a0:c9:ae:7c:cc:be:68:b1:35:4a:c9:d3:5f:f9
Signer

Actual PE Digest

48:14:63:4e:d4:55:a0:c9:ae:7c:cc:be:68:b1:35:4a:c9:d3:5f:f9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 278KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TeamViewer_StaticRes.dll
.dll windows:5 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e4:f9:ec:1e:c8:0a:2e:30:3f:1f:04:43:45:8a:8f:9d:24:ed:f4:ed
Signer

Actual PE Digest

e4:f9:ec:1e:c8:0a:2e:30:3f:1f:04:43:45:8a:8f:9d:24:ed:f4:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
msimg32.dll
.dll windows:5 windows x86 arch:x86

71b7844928f595544581a77dd3f74826

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlMoveMemory
RtlDecompressBuffer

kernel32

SetProcessShutdownParameters
GetVersion
GlobalAlloc
VirtualFreeEx
VirtualAllocEx
GetCurrentProcess
VirtualAlloc
GetProcAddress
LoadLibraryExA
VirtualProtectEx
VirtualFree
FreeLibrary
ExitProcess
SetCurrentDirectoryA
GetSystemDirectoryA
SetErrorMode
DisableThreadLibraryCalls
GlobalFree

msvcrt40

free
strrchr
memset
_initterm
_adjust_fdiv
malloc

psapi

GetModuleFileNameExA

Exports

Exports

AlphaBlend
DllInitialize
GradientFill
ServiceMain
TransparentBlt
vSetDdrawflag

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
photo_2017-09-29_19-11-18.jpg
.jpg
tv_w32.dll
.dll windows:5 windows x86 arch:x86

714e5bc40dee78cd885497d6a83a0771

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:a1:4f:da:cb:82:08:23:5b:0e:0b:b4:77:f1:d9:c7:78:02:a2:ad
Signer

Actual PE Digest

25:a1:4f:da:cb:82:08:23:5b:0e:0b:b4:77:f1:d9:c7:78:02:a2:ad

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release2008\tv_w32dll.pdb

Imports

crtdll

strncat
strncpy
_vsnprintf
_snprintf
_strlwr
strrchr
memmove
memcpy
wcsstr
_wcslwr
_global_unwind2
_local_unwind2
_initterm
malloc
__dllonexit
strncmp
memset

comctl32

InitCommonControlsEx

kernel32

GetFileAttributesExW
HeapAlloc
GlobalLock
DeleteCriticalSection
GetProcAddress
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
GetLocalTime
InterlockedCompareExchange
GlobalUnlock
DisableThreadLibraryCalls
OpenMutexW
GetModuleFileNameA
FreeLibraryAndExitThread
Sleep
LoadLibraryW
GetModuleFileNameW
CreateThread
LocalFree
CreateMutexW
CreateEventW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
SetEvent
GetTickCount
IsBadWritePtr
IsBadReadPtr
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
LocalAlloc
SetLastError
GlobalFree
GlobalAlloc
GetVersion
QueryPerformanceCounter
GetVersionExW
VirtualProtect
ResumeThread
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateToolhelp32Snapshot
Thread32First
OpenThread
SuspendThread
Thread32Next
CloseHandle
GetProcessHeap
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSection
FileTimeToSystemTime
InterlockedExchange

user32

ShowWindow
GetWindow
GetWindowLongW
GetSysColor
LoadBitmapW
GetSystemMetrics
SystemParametersInfoW
SendMessageW
GetClientRect
IsZoomed
GetWindowInfo
IsRectEmpty
CallWindowProcW
RedrawWindow
MoveWindow
IsIconic
PostMessageW
TrackMouseEvent
InvalidateRect
EndPaint
BeginPaint
GetActiveWindow
SetWindowLongW
FindWindowExW
FindWindowW
GetClassNameA
GetDesktopWindow
ClientToScreen
GetDC
GetUpdateRect
GetWindowRect
ReleaseDC
IsWindow
IsWindowVisible
SetWindowPos
GetClassInfoExW
LoadCursorW
RegisterClassExW
CallNextHookEx
DestroyWindow
DefWindowProcW
KillTimer
SetTimer
RegisterClipboardFormatW
CreateWindowExW
UnregisterClassW
SendMessageTimeoutW
UnhookWindowsHookEx
SendNotifyMessageW
SetWindowsHookExW
RegisterWindowMessageW
MapWindowPoints
GetWindowDC

gdi32

DeleteObject
GdiFlush
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
Rectangle
GetStockObject
CreatePen
Polyline
ExtCreatePen
LineTo
MoveToEx
CreateSolidBrush
CreateCompatibleBitmap
GetObjectW
SetPixel
GetPixel
RectVisible
DeleteDC

shell32

DragQueryFileW

ole32

ReleaseStgMedium
CoCreateInstance

Exports

Exports

GetLoaderInterface
GetTeamViewerInterface

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tv_w32.exe
.exe windows:5 windows x86 arch:x86

50a1bd551f06f6cf63b0687e32d02be5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:77:47:ca:a2:b1:0a:a3:5b:51:73:fa:4f:3e:e4:24:4b:34:d0:46
Signer

Actual PE Digest

1a:77:47:ca:a2:b1:0a:a3:5b:51:73:fa:4f:3e:e4:24:4b:34:d0:46

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release2008\tv_w32exe.pdb

Imports

kernel32

SetEvent
GetVersionExW
GetLastError
CreateEventW
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
Sleep
GetSystemDirectoryW
LoadLibraryW
GetTickCount
OpenMutexA
CreateMutexW
SetFilePointer
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId
GetCommandLineW
GetCurrentProcess
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
GetCommandLineA
GetStartupInfoA
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringW
HeapFree
HeapAlloc
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
WriteConsoleA
VirtualQuery

user32

PeekMessageW
DispatchMessageW
SendInput
BlockInput
MsgWaitForMultipleObjectsEx
TranslateMessage

shell32

ShellExecuteExW

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tv_x64.dll
.dll windows:5 windows x64 arch:x64

2b7e8ea5f94b83a0c345d3ae26628b16

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:7b:9a:b9:19:5e:0b:2c:87:ab:17:bc:a4:4a:66:82:1f:7d:9d:21
Signer

Actual PE Digest

1b:7b:9a:b9:19:5e:0b:2c:87:ab:17:bc:a4:4a:66:82:1f:7d:9d:21

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release2008\tv_x64dll.pdb

Imports

msvcrt

_onexit
__dllonexit
realloc
calloc
malloc
free
_initterm
_wcslwr
wcsstr
strncmp
memmove
__C_specific_handler
strrchr
_strlwr
_snprintf
_vsnprintf
strncpy
strncat
memcpy
memset

comctl32

InitCommonControlsEx

kernel32

FileTimeToSystemTime
InitializeCriticalSection
GetLastError
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetProcessHeap
CloseHandle
Thread32Next
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
ResumeThread
VirtualProtect
GetVersionExW
QueryPerformanceCounter
GlobalUnlock
GetFileAttributesExW
HeapAlloc
GlobalLock
DeleteCriticalSection
GetProcAddress
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
GetLocalTime
DisableThreadLibraryCalls
OpenMutexW
GetModuleFileNameA
FreeLibraryAndExitThread
Sleep
LoadLibraryW
GetModuleFileNameW
CreateThread
LocalFree
CreateMutexW
CreateEventW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
SetEvent
GetTickCount
IsBadWritePtr
IsBadReadPtr
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
LocalAlloc
SetLastError

user32

SendNotifyMessageW
UnhookWindowsHookEx
SendMessageTimeoutW
UnregisterClassW
CreateWindowExW
RegisterClipboardFormatW
SetTimer
KillTimer
DefWindowProcW
DestroyWindow
CallNextHookEx
RegisterClassExW
LoadCursorW
GetClassInfoExW
SetWindowPos
IsWindowVisible
IsWindow
ReleaseDC
GetWindowRect
GetWindowDC
GetClassNameA
ShowWindow
GetWindow
GetWindowLongPtrW
GetSysColor
LoadBitmapW
GetSystemMetrics
SystemParametersInfoW
SendMessageW
GetClientRect
IsZoomed
GetWindowInfo
IsRectEmpty
CallWindowProcW
RedrawWindow
MoveWindow
IsIconic
PostMessageW
TrackMouseEvent
InvalidateRect
GetActiveWindow
SetWindowLongPtrW
EndPaint
BeginPaint
FindWindowExW
FindWindowW
MapWindowPoints
GetDesktopWindow
ClientToScreen
GetDC
GetUpdateRect
RegisterWindowMessageW
SetWindowsHookExW

gdi32

RectVisible
GetPixel
SetPixel
GetObjectW
CreateCompatibleBitmap
CreateSolidBrush
MoveToEx
LineTo
DeleteObject
Polyline
CreatePen
GetStockObject
Rectangle
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt
GdiFlush
ExtCreatePen
DeleteDC

shell32

DragQueryFileW

ole32

ReleaseStgMedium
CoCreateInstance

Exports

Exports

GetLoaderInterface

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shared
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tv_x64.exe
.exe windows:5 windows x64 arch:x64

2c5c62562658e3dcbc628c79afc9f4a7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f8:fb:19:9a:f2:d0:36:7a:24:71:00:14:d2:30:0e:b4:e9:0f:e8:0b
Signer

Actual PE Digest

f8:fb:19:9a:f2:d0:36:7a:24:71:00:14:d2:30:0e:b4:e9:0f:e8:0b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release2008\tv_x64exe.pdb

Imports

kernel32

SetEvent
GetVersionExW
GetLastError
CreateEventW
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
Sleep
GetSystemDirectoryW
LoadLibraryW
GetTickCount
OpenMutexA
CreateMutexW
SetFilePointer
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId
GetCommandLineW
GetCurrentProcess
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
GetCommandLineA
GetStartupInfoA
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
FlsAlloc
LCMapStringW
HeapFree
HeapAlloc
GetModuleHandleW
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
InitializeCriticalSectionAndSpinCount
HeapReAlloc

user32

PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage

shell32

ShellExecuteExW

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tvr.cfg

Sharing

General

Malware Config

Signatures

Files

4ea4df5d94204fc550be1874e1b77ea7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 128KB

.ndata Size: - Virtual size: 64KB

.rsrc Size: 189KB - Virtual size: 188KB

94f8a1539e17c7b1cf734cd4693a3598

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

97:a0:11:6e:8f:aa:c1:7d:a0:a1:31:d7:63:25:1c:c2:94:3a:0b:efSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

avicap32

msvfw32

winmm

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

ws2_32

msimg32

mpr

netapi32

setupapi

sensapi

wininet

iphlpapi

imagehlp

secur32

crypt32

wintrust

userenv

wtsapi32

mswsock

Sections

.text Size: 5.3MB - Virtual size: 5.3MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 286KB - Virtual size: 380KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 36KB - Virtual size: 36KB

.reloc Size: 596KB - Virtual size: 595KB

c942ae5c3bec2566edc10e9dd7bc32e6

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 128KB

.ndata
Size: - Virtual size: 64KB

.rsrc
Size: 189KB - Virtual size: 188KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

97:a0:11:6e:8f:aa:c1:7d:a0:a1:31:d7:63:25:1c:c2:94:3a:0b:ef
Signer

.text
Size: 5.3MB - Virtual size: 5.3MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 286KB - Virtual size: 380KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 36KB - Virtual size: 36KB

.reloc
Size: 596KB - Virtual size: 595KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

10:30:60:17:6b:95:4e:e6:70:1f:ec:cc:0e:69:ef:76:5a:4b:e0:7e
Signer

.text
Size: 1.5MB - Virtual size: 1.5MB

.orpc
Size: 2KB - Virtual size: 1KB

.rdata
Size: 408KB - Virtual size: 408KB

.data
Size: 54KB - Virtual size: 92KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 25KB - Virtual size: 24KB

.reloc
Size: 203KB - Virtual size: 203KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

48:14:63:4e:d4:55:a0:c9:ae:7c:cc:be:68:b1:35:4a:c9:d3:5f:f9
Signer

.rsrc
Size: 278KB - Virtual size: 278KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate