5e60962a90e8c71cd4b00d2e27fb0e4c_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

5e60962a90e8c71cd4b00d2e27fb0e4c_JaffaCakes118
Size

2.7MB
MD5

5e60962a90e8c71cd4b00d2e27fb0e4c
SHA1

5d10e0492a6b5d563b747e2f9d8969eab6b81ee3
SHA256

139dfc982c364514d76ed2542923f646d95a5ef3fc11bafea76cd4baa645174c
SHA512

4da435c1afc5fe4e77274b2d407b7ac9fda1494243ca0693ca8193de7071136aa702f6902bda4e064ddd61e0d9db0d2714f4953e247c20316b3c271d7f60ed11
SSDEEP

49152:yftA2eEwrpK5Kh7v9XFEYtVzAN+5jvURCndyWLhdndhDtr7It6FfTYi5iARVVpw7:yftveFpvh7v9V/tVcN+5ZhVdhpr7LF7M

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx
static1/unpack001/$_0_/TeamViewer_.exe	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/TvGetVersion.dll
unpack002/$PLUGINSDIR/NSISdl.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/out.upx
unpack001/out.upx

NSIS installer 2 IoCs

installer

resource	yara_rule
static1/unpack002/out.upx	nsis_installer_2
static1/unpack001/out.upx	nsis_installer_2

Files

5e60962a90e8c71cd4b00d2e27fb0e4c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4b:cd:2d:6e:5b:28:e2:b7:ba:87:07:94:26:b7:19:5e:e1:11:ba:cb
Signer

Actual PE Digest

4b:cd:2d:6e:5b:28:e2:b7:ba:87:07:94:26:b7:19:5e:e1:11:ba:cb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 192KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/TvGetVersion.dll
.dll windows:4 windows x86 arch:x86

a147e98bc4c8de2e7a562af6dc54045c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
GlobalFree
CloseHandle
ReadFile
GlobalAlloc
GetFileSize
CreateFileA
GetDriveTypeA
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
lstrlenA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
lstrcpynA
lstrcpyA
lstrcmpiA
GetSystemInfo
GetModuleHandleA
GetProcAddress
lstrcatA
HeapDestroy
GetVersionExA

user32

wsprintfA
GetSystemMetrics
SendMessageA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CloseServiceHandle
OpenServiceA
OpenSCManagerA
DeleteService
ControlService

Exports

Exports

IsNetPath
IsTvPasswordSet
LoadFile
RemoveService
WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsServicePack
WindowsServicePackBuild
WindowsType
WindowsVersion
WindowsVersionMajor
WindowsVersionMinor

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_0_/TeamViewer_.exe
.exe windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

00:70:1c:5c:3c:cc:7f:75:19:a5:90:af:f7:9a:bc:ed:6d:2e:b4:0e
Signer

Actual PE Digest

00:70:1c:5c:3c:cc:7f:75:19:a5:90:af:f7:9a:bc:ed:6d:2e:b4:0e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 188KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$EXEDIR/TV.dll
.dll windows:4 windows x86 arch:x86

05692b5533cab7ba99d5ebc863276c4d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2a:80:1a:d0:40:5b:97:cb:57:8d:00:86:6d:ef:d0:05:e3:0d:e6:20
Signer

Actual PE Digest

2a:80:1a:d0:40:5b:97:cb:57:8d:00:86:6d:ef:d0:05:e3:0d:e6:20

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\TeamViewer_Split_Release\TeamViewer\qs_release\TV.pdb

Imports

comctl32

InitCommonControlsEx

kernel32

LocalFree
InitializeCriticalSection
HeapSize
WriteFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
Sleep
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LCMapStringW
WideCharToMultiByte
LCMapStringA
MultiByteToWideChar
SetLastError
GetModuleFileNameA
GetProcAddress
FreeLibrary
GetTickCount
GetLastError
GetCurrentProcessId
LocalAlloc
InterlockedExchange
CloseHandle
OpenMutexA
GetSystemDirectoryA
LocalLock
CreateMutexA
GetVersionExA
ReleaseMutex
LoadLibraryA
LocalUnlock
GetCurrentThreadId
VirtualQuery
WaitForSingleObject
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
RaiseException
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree

user32

SetRect
DestroyWindow
IsRectEmpty
SendMessageA
GetDC
GetWindowLongA
DefWindowProcA
ShowWindow
RegisterWindowMessageA
SetWindowLongA
LoadBitmapA
SetActiveWindow
TrackMouseEvent
SendNotifyMessageA
SetWindowsHookExA
RedrawWindow
InflateRect
UnionRect
FindWindowExA
BeginPaint
MapWindowPoints
InvalidateRect
IsZoomed
GetActiveWindow
CreateWindowExA
GetDesktopWindow
UnhookWindowsHookEx
FindWindowA
GetSysColor
ReleaseDC
GetClassNameA
SetWindowPos
SystemParametersInfoA
GetWindowThreadProcessId
GetClassInfoA
CallNextHookEx
IsWindow
RegisterClassA
LoadCursorA
GetWindowDC
PostMessageA
GetClientRect
GetSystemMetrics
EndPaint
IsWindowVisible
MoveWindow
UnregisterClassA
GetWindowInfo
GetWindowRect

gdi32

CreatePen
MoveToEx
GetStockObject
LineTo
SetPixel
DeleteDC
CombineRgn
GetDeviceCaps
CreateCompatibleDC
BitBlt
CreateCompatibleBitmap
Rectangle
DeleteObject
CreateSolidBrush
Polyline
ExtCreatePen
SelectObject
GetPixel
CreateRectRgn
GetObjectA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Exports

Exports

AddProcessExclusion
GetChangeRegion
GetChangedWindowList
IsTitleBarButtonPressed
RemoveProcessExclusion
SetButtonXOffset
SetSingleWindow
ShowTitleBarButton
StartHooks
StopHooks

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sharedv
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$EXEDIR/TeamViewer.exe
.exe windows:4 windows x86 arch:x86

c24d6897799ac1bdb0cfcf8a76ed55fc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2f:9c:06:0a:c4:8e:e3:6c:d7:06:bc:fa:0a:13:aa:ba:56:c0:bc:4d
Signer

Actual PE Digest

2f:9c:06:0a:c4:8e:e3:6c:d7:06:bc:fa:0a:13:aa:ba:56:c0:bc:4d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer_Split_Release\TeamViewer\qs_release\TeamViewer_qs.pdb

Imports

ws2_32

send
recvfrom
htonl
recv
gethostname
inet_ntoa
gethostbyname
connect
accept
getservbyname
gethostbyaddr
getservbyport
inet_addr
WSAEventSelect
WSAWaitForMultipleEvents
WSAResetEvent
WSARecv
htons
WSACreateEvent
ntohs
getpeername
WSACloseEvent
socket
getsockopt
sendto
setsockopt
WSASocketW
listen
getsockname
WSASend
shutdown
bind
WSASetEvent
WSACleanup
WSAStartup
closesocket
WSAGetLastError
select
WSASetLastError
ioctlsocket
__WSAFDIsSet

comctl32

InitCommonControlsEx
ImageList_Create
ImageList_SetBkColor
ImageList_Remove
ImageList_ReplaceIcon

avicap32

capGetDriverDescriptionA
capCreateCaptureWindowA

msvfw32

DrawDibDraw
DrawDibOpen
DrawDibClose

winmm

mixerOpen
waveOutUnprepareHeader
waveInUnprepareHeader
waveInClose
waveInStart
waveInReset
waveOutClose
waveOutRestart
waveOutReset
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutPause
waveOutWrite
mixerGetID
mixerClose
timeEndPeriod
timeBeginPeriod
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
mixerSetControlDetails

kernel32

VirtualFree
VirtualAlloc
GetExitCodeThread
TryEnterCriticalSection
CreateThread
ResumeThread
SetThreadPriority
GetPriorityClass
SetPriorityClass
ResetEvent
GetCurrentThread
GetExitCodeProcess
TerminateProcess
SetErrorMode
FindClose
CompareFileTime
CompareStringA
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
QueryPerformanceFrequency
QueryPerformanceCounter
GetFileSize
ReadFile
QueueUserAPC
LocalAlloc
SetEnvironmentVariableA
SetStdHandle
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetTimeZoneInformation
GetOEMCP
HeapCreate
GetStdHandle
GetStringTypeA
LCMapStringA
GetDateFormatA
GetTimeFormatA
ExitProcess
GetStartupInfoA
GetCommandLineA
RtlUnwind
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
CreateWaitableTimerA
SetWaitableTimer
CreateFileMappingA
MapViewOfFileEx
SetEndOfFile
UnmapViewOfFile
GetSystemInfo
GetFileTime
CreateFileA
FormatMessageA
GetThreadLocale
GetACP
GetVersionExA
IsProcessorFeaturePresent
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
LocalUnlock
LocalSize
LocalLock
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
GetOverlappedResult
DeviceIoControl
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
TlsGetValue
TlsSetValue
OpenProcess
SetFilePointer
LocalFree
MoveFileExW
GetLocaleInfoA
GetUserDefaultLCID
GetSystemDefaultLCID
TerminateThread
InterlockedExchangeAdd
GlobalHandle
LoadResource
GlobalLock
GlobalUnlock
GetLastError
ReleaseSemaphore
GetCurrentThreadId
CreateEventA
WaitForSingleObject
CloseHandle
SetEvent
DuplicateHandle
GetCurrentProcess
GetProcessHeap
Sleep
HeapFree
GetSystemTimeAsFileTime
CreateSemaphoreA
GetTickCount
GlobalAlloc
FlushInstructionCache
SetLastError
EnterCriticalSection
LeaveCriticalSection
RaiseException
HeapAlloc
InitializeCriticalSection
WaitForMultipleObjects
DeleteCriticalSection
MulDiv
WriteFile
GetLocalTime
GetCurrentProcessId
TlsFree
TlsAlloc
SetProcessShutdownParameters
GetCommandLineW
FreeLibrary
SizeofResource
ReleaseMutex
CreateMutexA
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
LockResource
GlobalFree

user32

UnregisterClassA
GetThreadDesktop
GetUserObjectInformationW
GetCursorInfo
EnumWindows
GetGUIThreadInfo
UnhookWindowsHookEx
CallNextHookEx
DrawFocusRect
FrameRect
GetIconInfo
GetCapture
MessageBeep
DrawIconEx
CopyImage
ExitWindowsEx
SendInput
ToUnicode
GetKeyboardState
ToAscii
SendDlgItemMessageA
GetDlgItemTextA
SetDlgItemTextA
CreateWindowExA
GetKeyState
BlockInput
GetWindowRgn
MsgWaitForMultipleObjects
CreateIconIndirect
MsgWaitForMultipleObjectsEx
SetCursorPos
SetClipboardViewer
ChangeClipboardChain
GetClipboardViewer
IsMenu
CreateMenu
FlashWindow
GetMessagePos
GetNextDlgTabItem
SetWindowPlacement
GetWindowPlacement
DrawEdge
GetSystemMenu
MapWindowPoints
GetWindowRect
ScrollWindowEx
SetScrollPos
GetScrollInfo
SetClipboardData
OpenInputDesktop
CloseDesktop
SetThreadDesktop
OpenDesktopW
AttachThreadInput
SetForegroundWindow
CloseClipboard
SetWindowPos
InvalidateRect
MoveWindow
GetWindow
InflateRect
OpenClipboard
EmptyClipboard
IsWindow
BeginPaint
TrackMouseEvent
PtInRect
EndPaint
SetTimer
DestroyWindow
GetParent
GetCursorPos
ScreenToClient
KillTimer
GetClientRect
SetFocus
ShowWindow
DestroyMenu
OffsetRect
SetWindowRgn
SetRect
GetSubMenu
CheckMenuRadioItem
ClientToScreen
EnableMenuItem
TrackPopupMenuEx
CheckMenuItem
GetMenuState
CreatePopupMenu
RemoveMenu
IsWindowVisible
GetDesktopWindow
BringWindowToTop
GetDlgItem
IntersectRect
AdjustWindowRect
ShowScrollBar
SetScrollInfo
DestroyCursor
SetParent
GetSysColorBrush
GetWindowThreadProcessId
WindowFromPoint
IsRectEmpty
SetRectEmpty
GetMenuItemCount
GetAsyncKeyState
DestroyIcon
PostQuitMessage
GetDlgCtrlID
IsWindowEnabled
DeleteMenu
TranslateMessage
MessageBoxA
GetSysColor
IsChild
DestroyAcceleratorTable
GetFocus
RedrawWindow
MapDialogRect
InvalidateRgn
SetWindowContextHelpId
ReleaseDC
GetWindowDC
EqualRect
GetCursor
SetCapture
ReleaseCapture
SetCursor
UnionRect
GetActiveWindow
SetActiveWindow
GetForegroundWindow
EndDialog
GetDC
FillRect
IsIconic
GetSystemMetrics
CopyRect
UpdateWindow

gdi32

GetRgnBox
PtInRegion
GetRegionData
GetDCOrgEx
GetSystemPaletteEntries
GetPixel
PatBlt
SetPixel
SetBrushOrgEx
GetObjectType
CreateRoundRectRgn
CreatePalette
RealizePalette
SelectPalette
CreateRectRgnIndirect
MaskBlt
RoundRect
CreatePatternBrush
SetStretchBltMode
CreateBitmap
SetViewportOrgEx
SetWindowOrgEx
StretchBlt
SetBkColor
DPtoLP
CreateCompatibleBitmap
SelectClipRgn
CreateDIBSection
GetDIBits
SetDIBColorTable
Polygon
Ellipse
SetTextColor
GetDeviceCaps
LineTo
MoveToEx
SetBkMode
BitBlt
CreateCompatibleDC
OffsetRgn
SetRectRgn
Rectangle
SelectObject
CreateSolidBrush
CreatePen
RectInRegion
CombineRgn
CreateRectRgn
CreatePolygonRgn
DeleteObject
DeleteDC
GetStockObject

advapi32

GetSidIdentifierAuthority
RegFlushKey
ImpersonateLoggedOnUser
RevertToSelf
RegSetValueExA
AllocateAndInitializeSid
SetSecurityInfo
GetSecurityInfo
EqualSid
FreeSid
LookupAccountSidW
LookupAccountNameW
CreateProcessAsUserW
StartServiceW
CloseServiceHandle
SetSecurityDescriptorDacl
RegCloseKey
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
RegisterEventSourceW
InitializeSecurityDescriptor
ReportEventW
SetNamedSecurityInfoW
SetEntriesInAclW
GetNamedSecurityInfoW
DeregisterEventSource

shell32

ord680
SHGetMalloc
ord155
SHGetSpecialFolderLocation
DragFinish
SHAppBarMessage
DragAcceptFiles

ole32

CoUninitialize
CoCreateGuid
CoInitializeEx
CoTaskMemRealloc
StringFromGUID2
CreateStreamOnHGlobal
OleUninitialize
CoTaskMemAlloc
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
CoCreateInstance
OleInitialize
CoTaskMemFree

oleaut32

LoadRegTypeLi
OleCreatePropertyFrame
VarUI4FromStr
VariantClear
SysAllocString
SysAllocStringLen
LoadTypeLi
OleCreateFontIndirect
SysStringByteLen
SysStringLen
VariantInit
SysFreeString
VariantCopy
SafeArrayGetDim
SafeArrayGetElement
VariantChangeType

shlwapi

PathCompactPathW

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum

iphlpapi

GetAdapterIndex
DeleteIPAddress
GetAdaptersInfo

crypt32

CertGetNameStringA
CertFreeCertificateContext
CryptVerifyMessageSignature
CertGetNameStringW

imagehlp

ImageGetCertificateData
ImageGetCertificateHeader
ImageEnumerateCertificates

wininet

HttpSendRequestA
InternetQueryDataAvailable
HttpEndRequestA
InternetWriteFile
HttpAddRequestHeadersA
HttpOpenRequestA
InternetGoOnlineA
InternetReadFile
InternetErrorDlg
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetQueryOptionW
HttpSendRequestExA

sensapi

IsNetworkAlive

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 852KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$EXEDIR/TeamViewer.ini
$EXEDIR/TeamViewer_Desktop.exe
.exe windows:4 windows x86 arch:x86

07ea98f4e07eafe92328d9e513829dd2

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:d7:eb:e2:a9:2a:9d:8c:6d:27:8f:ee:25:4b:7c:12:ae:2f:b1:d5
Signer

Actual PE Digest

3d:d7:eb:e2:a9:2a:9d:8c:6d:27:8f:ee:25:4b:7c:12:ae:2f:b1:d5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer_Split_Release\TeamViewer\qs_release\TeamViewer_Desktop.pdb

Imports

ws2_32

gethostbyname
closesocket
__WSAFDIsSet
WSASetLastError
ioctlsocket
select
accept
WSASend
inet_ntoa
getservbyport
ntohs
connect
setsockopt
WSASocketW
listen
htons
getservbyname
getsockname
WSARecv
bind
WSAStartup
WSACleanup
WSAGetLastError
inet_addr
gethostbyaddr
shutdown
htonl
getsockopt

comctl32

InitCommonControlsEx

kernel32

GlobalFree
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
CompareStringA
TlsAlloc
TlsFree
LeaveCriticalSection
GetCurrentProcessId
FlushInstructionCache
InitializeCriticalSection
GetCommandLineW
InterlockedDecrement
GetLocaleInfoA
WaitForSingleObject
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
SetEvent
GetSystemTimeAsFileTime
GetTickCount
GetSystemDefaultLCID
GetUserDefaultLCID
GetLocalTime
ReleaseSemaphore
WaitForMultipleObjects
CreateSemaphoreA
SetFilePointer
WriteFile
GetFileSize
OpenProcess
FindClose
DeleteCriticalSection
TerminateProcess
DuplicateHandle
FileTimeToSystemTime
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
TlsGetValue
Sleep
QueueUserAPC
TerminateThread
InterlockedExchangeAdd
LocalLock
LocalSize
LocalUnlock
CreateMutexA
GetVersionExA
GetACP
GetThreadLocale
InterlockedCompareExchange
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapDestroy
HeapReAlloc
HeapSize
FormatMessageA
CreateFileA
ReleaseMutex
GetSystemInfo
ResetEvent
TlsSetValue
ResumeThread
SystemTimeToFileTime
SetWaitableTimer
CreateWaitableTimerA
UnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
ExitThread
CreateThread
RtlUnwind
LCMapStringA
GetStringTypeA
ExitProcess
HeapCreate
GetStdHandle
GetCurrentThread
GetOEMCP
FreeEnvironmentStringsA
GetEnvironmentStrings
SetHandleCount
GetFileType
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
FlushFileBuffers
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
SetEndOfFile
SetEnvironmentVariableA
LocalAlloc
InterlockedIncrement
GetCurrentThreadId
GetLastError
CreateEventA
InterlockedExchange
EnterCriticalSection
HeapFree
GetProcessHeap
LoadResource
FreeLibrary
SizeofResource
HeapAlloc
CloseHandle
RaiseException
GetCurrentProcess
SetLastError
SetProcessShutdownParameters
GetProcessShutdownParameters
ReadFile

user32

EqualRect
EnumWindows
GetWindowDC
GetUserObjectInformationW
GetThreadDesktop
WindowFromPoint
RedrawWindow
UnhookWindowsHookEx
CallNextHookEx
GetDesktopWindow
GetWindowRgn
IsWindowEnabled
UnionRect
GetCursorInfo
GetIconInfo
ToAscii
GetKeyState
SendInput
UnregisterClassA
CopyRect
GetGUIThreadInfo
GetForegroundWindow
MapWindowPoints
ReleaseDC
GetDC
GetParent
SetWindowPos
OpenInputDesktop
CloseDesktop
SetThreadDesktop
OpenDesktopW
GetWindowThreadProcessId
IntersectRect
InflateRect
OffsetRect
BlockInput
PostQuitMessage
DestroyWindow
GetAsyncKeyState
GetSystemMetrics
GetWindowRect
FillRect
GetCursorPos
IsRectEmpty
IsWindow
ExitWindowsEx
TranslateMessage
MessageBoxA
IsWindowVisible

advapi32

CloseServiceHandle
StartServiceW
ReportEventW
DeregisterEventSource
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
GetSecurityInfo
SetSecurityInfo
AllocateAndInitializeSid
RegSetValueExA
RevertToSelf
ImpersonateLoggedOnUser
LookupAccountNameW
LookupAccountSidW
EqualSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCloseKey
GetSidIdentifierAuthority
RegisterEventSourceW

ole32

CoTaskMemRealloc
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitializeSecurity

oleaut32

SysFreeString
VarUI4FromStr
VariantClear
VariantInit
SafeArrayGetDim
SafeArrayGetElement
SysAllocString
VariantChangeType
VariantCopy

crypt32

CertGetNameStringA
CryptVerifyMessageSignature
CertFreeCertificateContext
CertGetNameStringW

imagehlp

ImageEnumerateCertificates
ImageGetCertificateData
ImageGetCertificateHeader

wininet

InternetQueryOptionW

gdi32

GetDCOrgEx
CreateRectRgn
SelectClipRgn
BitBlt
CreateCompatibleBitmap
GetRegionData
PtInRegion
GetRgnBox
OffsetRgn
CombineRgn
RectInRegion
SetBkMode
StretchBlt
DeleteDC
SetPixel
SelectObject
CreateCompatibleDC
GetStockObject
CreateSolidBrush
GetDeviceCaps
DeleteObject
GetDIBits
SetRectRgn
GetSystemPaletteEntries
CreateDIBSection

shell32

SHGetSpecialFolderLocation
SHGetMalloc

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 433KB - Virtual size: 433KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$EXEDIR/TeamViewer_Resource_en.dll
.dll windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3b:92:20:e4:14:12:8d:23:57:3f:10:ce:da:57:9c:37:72:a4:e6:b7
Signer

Actual PE Digest

3b:92:20:e4:14:12:8d:23:57:3f:10:ce:da:57:9c:37:72:a4:e6:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 584KB - Virtual size: 581KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$EXEDIR/TeamViewer_Service.exe
.exe windows:4 windows x86 arch:x86

075c20e9a75435ef05fc9fc71aee01e7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e9:4b:d9:e8:23:82:1d:30:75:d8:9f:ab:61:0a:04:e0:30:0b:4a:b3
Signer

Actual PE Digest

e9:4b:d9:e8:23:82:1d:30:75:d8:9f:ab:61:0a:04:e0:30:0b:4a:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer_Split_Release\TeamViewer\qs_release\TeamViewer_Service.pdb

Imports

ws2_32

WSAEventSelect
shutdown
send
recvfrom
sendto
getsockopt
gethostbyname
inet_ntoa
socket
WSAWaitForMultipleEvents
WSAResetEvent
htons
WSACreateEvent
WSASetEvent
gethostname
gethostbyaddr
getservbyport
getservbyname
WSACleanup
WSACloseEvent
WSAStartup
ntohs
recv
htonl
closesocket
WSAGetLastError
select
WSASend
WSASetLastError
ioctlsocket
__WSAFDIsSet
inet_addr
bind
WSARecv
getsockname
listen
WSASocketW
setsockopt
connect
accept
getpeername

kernel32

InterlockedExchange
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
CompareStringA
FreeLibrary
TlsFree
TlsAlloc
SetEnvironmentVariableA
SetEndOfFile
SetStdHandle
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetOEMCP
GetTimeZoneInformation
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualAlloc
SetLastError
SetConsoleCtrlHandler
GetLastError
GetCurrentThreadId
CreateSemaphoreA
VirtualFree
HeapCreate
HeapDestroy
GetStdHandle
HeapSize
ExitProcess
GetStringTypeA
LCMapStringA
RtlUnwind
GetDateFormatA
GetTimeFormatA
ExitThread
HeapReAlloc
IsDebuggerPresent
UnhandledExceptionFilter
CreateWaitableTimerA
SetWaitableTimer
SystemTimeToFileTime
CreateMutexA
GetCurrentProcess
FileTimeToSystemTime
SetUnhandledExceptionFilter
CloseHandle
FindClose
FileTimeToLocalFileTime
GetCurrentProcessId
InitializeCriticalSection
SetEvent
LeaveCriticalSection
WaitForSingleObject
RaiseException
SizeofResource
LoadResource
EnterCriticalSection
InterlockedIncrement
ReleaseMutex
GetSystemTimeAsFileTime
InterlockedDecrement
CreateEventA
DeleteCriticalSection
GetExitCodeProcess
QueueUserAPC
TerminateThread
InterlockedExchangeAdd
Sleep
ReleaseSemaphore
HeapAlloc
GetProcessHeap
HeapFree
GetTickCount
DeviceIoControl
CreateThread
ResumeThread
DuplicateHandle
WaitForMultipleObjects
SetThreadPriority
GetCurrentThread
ReadFile
GetOverlappedResult
WriteFile
GetExitCodeThread
SetFilePointer
GetFileSize
GetSystemDefaultLCID
GetUserDefaultLCID
GetLocaleInfoA
GetLocalTime
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
OpenProcess
TerminateProcess
TlsSetValue
TlsGetValue
ResetEvent
InterlockedCompareExchange
GetVersionExA
GetACP
GetThreadLocale
FormatMessageA
CreateFileA

user32

TranslateMessage
MessageBoxA
UnregisterClassA
MsgWaitForMultipleObjectsEx
DestroyWindow

advapi32

CreateProcessAsUserW
CryptGenRandom
CryptReleaseContext
FreeSid
GetSecurityInfo
SetSecurityInfo
RevertToSelf
RegCloseKey
RegFlushKey
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
CloseServiceHandle
ControlService
QueryServiceStatus
CryptAcquireContextA
ImpersonateLoggedOnUser
AllocateAndInitializeSid
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
DeleteService
EqualSid
RegSetValueExA
LookupAccountSidW

oleaut32

VarUI4FromStr

mpr

WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW

iphlpapi

DeleteIPAddress
GetAdaptersInfo
GetAdapterIndex

crypt32

CertFreeCertificateContext
CryptVerifyMessageSignature
CertGetNameStringW
CertGetNameStringA

imagehlp

ImageGetCertificateData
ImageGetCertificateHeader
ImageEnumerateCertificates

wininet

HttpSendRequestExA
InternetOpenW
InternetConnectW
InternetErrorDlg
HttpSendRequestA
HttpQueryInfoW
InternetReadFile
InternetQueryDataAvailable
HttpEndRequestA
InternetWriteFile
InternetGoOnlineA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCloseHandle
InternetSetOptionW

sensapi

IsNetworkAlive

shell32

SHGetMalloc
SHGetSpecialFolderLocation

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoCreateGuid
StringFromGUID2
CoInitializeEx
CoUninitialize
CoTaskMemFree

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 477KB - Virtual size: 476KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$EXEDIR/logo.bmp
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread

user32

CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ws2_32

gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
out.upx
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
out.upx
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01Certificate

Extended Key Usages

Key Usages

4b:cd:2d:6e:5b:28:e2:b7:ba:87:07:94:26:b7:19:5e:e1:11:ba:cbSigner

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 192KB

UPX1 Size: 17KB - Virtual size: 20KB

.rsrc Size: 24KB - Virtual size: 24KB

a147e98bc4c8de2e7a562af6dc54045c

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 31KB - Virtual size: 30KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 3KB - Virtual size: 7KB

.rsrc Size: 512B - Virtual size: 176B

.reloc Size: 4KB - Virtual size: 3KB

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01Certificate

Extended Key Usages

Key Usages

00:70:1c:5c:3c:cc:7f:75:19:a5:90:af:f7:9a:bc:ed:6d:2e:b4:0eSigner

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 188KB

UPX1 Size: 17KB - Virtual size: 20KB

.rsrc Size: 24KB - Virtual size: 24KB

05692b5533cab7ba99d5ebc863276c4d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01Certificate

Extended Key Usages

Key Usages

2a:80:1a:d0:40:5b:97:cb:57:8d:00:86:6d:ef:d0:05:e3:0d:e6:20Signer

Headers

File Characteristics

PDB Paths

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

4b:cd:2d:6e:5b:28:e2:b7:ba:87:07:94:26:b7:19:5e:e1:11:ba:cb
Signer

UPX0
Size: - Virtual size: 192KB

UPX1
Size: 17KB - Virtual size: 20KB

.rsrc
Size: 24KB - Virtual size: 24KB

.text
Size: 31KB - Virtual size: 30KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 3KB - Virtual size: 7KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 4KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

00:70:1c:5c:3c:cc:7f:75:19:a5:90:af:f7:9a:bc:ed:6d:2e:b4:0e
Signer

UPX0
Size: - Virtual size: 188KB

UPX1
Size: 17KB - Virtual size: 20KB

.rsrc
Size: 24KB - Virtual size: 24KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

2a:80:1a:d0:40:5b:97:cb:57:8d:00:86:6d:ef:d0:05:e3:0d:e6:20
Signer

.text
Size: 52KB - Virtual size: 50KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 4KB - Virtual size: 7KB

.sharedv
Size: 20KB - Virtual size: 16KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 7KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

2f:9c:06:0a:c4:8e:e3:6c:d7:06:bc:fa:0a:13:aa:ba:56:c0:bc:4d
Signer

.text
Size: 4.0MB - Virtual size: 4.0MB

.orpc
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 133KB - Virtual size: 852KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 24KB - Virtual size: 24KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate