3601c125212a9d00c84e3db0b20f1fc0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3601c125212a9d00c84e3db0b20f1fc0N.exe
Size

5.1MB
MD5

3601c125212a9d00c84e3db0b20f1fc0
SHA1

f7e88b331574a9c6f12bf4b5bac04f103d1cafcb
SHA256

2032cdf2e610a639ec218631be2b32e7fd09aecd57c70678d0f000e143b7124d
SHA512

29b6c9908e9449ab20dab36795c039c719c24800ef1ad3e7c79fbd9b1b84e37ba71ff62c8587dfa7dea96a6cec772918b85f7c9325affa4e74194eb72614c76e
SSDEEP

98304:yUqKcwwv64RPQKHkZ1yWeJYaBuGplhgvS22azk4YeuM/nRTYKCI4fmFF:yy5wvhX8ydJYr6Aqqz7uWRTYKyeFF

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/TvGetVersion.dll
unpack001/$PLUGINSDIR/nsis7z.dll

Files

3601c125212a9d00c84e3db0b20f1fc0N.exe
.exe windows:5 windows x86 arch:x86

32f3282581436269b3a75b6675fe3e08

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:42:0a:6a:be:bf:2a:0e:75:e4:0d:78:32:1a:b1:3a:90:c9:86:ec
Signer

Actual PE Digest

8d:42:0a:6a:be:bf:2a:0e:75:e4:0d:78:32:1a:b1:3a:90:c9:86:ec

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 708KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/TvGetVersion.dll
.dll windows:4 windows x86 arch:x86

14e0ed23a737a24ab5884c7197f5adf9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

StrChrW
StrRChrW

kernel32

LoadLibraryW
WaitForSingleObject
DeleteFileW
GetWindowsDirectoryW
GetTempPathW
InterlockedDecrement
WideCharToMultiByte
RtlUnwind
MultiByteToWideChar
CreateDirectoryW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileW
MoveFileW
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetFullPathNameW
GetCurrentDirectoryA
ExitProcess
SetHandleCount
Sleep
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeLibrary
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
HeapSize
lstrcpynW
VirtualAlloc
HeapReAlloc
WriteFile
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
InitializeCriticalSection
SetFilePointer
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetTimeZoneInformation
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetDriveTypeA
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
lstrcpyW
lstrlenA
lstrcpynA
lstrcmpiA
lstrcpyA
LocalFree
GetModuleFileNameA
GetVersionExW
lstrlenW
lstrcatW
GetDriveTypeW
CreateFileW
GetFileSize
GlobalAlloc
ReadFile
CloseHandle
GlobalFree
GetLastError
GetCurrentProcessId
GetModuleHandleW
GetProcAddress
lstrcmpiW
GetStdHandle

user32

wsprintfW
SendMessageW
PostMessageW
GetSystemMetrics

gdi32

AddFontResourceExW
RemoveFontResourceExW

winspool.drv

EnumPrinterDriversW
EnumPrintProcessorsW

advapi32

RegQueryValueExA
RegDeleteValueW
ChangeServiceConfig2W
RegDeleteKeyW
GetUserNameW
LookupAccountNameW
ConvertSidToStringSidW
DeleteService
ControlService
StartServiceW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
RegOpenKeyExA
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumValueW
RegCreateKeyExW
RegOpenKeyExW
RegFlushKey
RegEnumKeyExW

shell32

SHFileOperationW
ShellExecuteExW

ole32

CoUninitialize
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
OleRun
CoInitialize

oleaut32

SysFreeString
GetErrorInfo
SysAllocString

Exports

Exports

ActivateRootAutoUpdate
AddAuthorizedApplication
CheckChecksumCustomIniFile
CopyRegKeyWithRollback
CopyRegValueWithRollback
CreateDirWithRollback
DeleteRegKeyWithRollback
DeleteRegValueWithRollback
GetCurrentSessionId
GetServiceStatus
GetUserSID
IsNetPath
IsPrintProcessorInstalled
IsPrinterDriverInstalled
IsServiceInstalled
IsTvPasswordSet
LoadFile
RegCopyKey
RegCopyValue
RemoveAuthorizedApplication
RemoveService
RemoveServiceWait
RollbackFileChanges
RollbackRegChanges
RunService
RunServiceWait
StopService
StopServiceWait
TvAddFontResource
TvIsHomeServer
TvIsRegBinaryValueSet
TvIsServer
TvRemoveFontResource
TvSetFailureActions
WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsVersion
WindowsVersionMajor
WindowsVersionMinor
WriteRegValueWithRollback

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsis7z.dll
.dll windows:4 windows x86 arch:x86

9c8bb65ecbb91da1f2ebb6ae7a714ed0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateDirectoryW
GetLastError
DeleteFileW
GetFullPathNameW
GetCurrentThreadId
GetCurrentProcessId
SetLastError
CreateFileW
SetFileTime
FindClose
FindFirstFileW
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GetCurrentProcess
GetSystemInfo
GetProcAddress
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
DeleteCriticalSection
AreFileApisANSI
VirtualFree
VirtualAlloc
GetVersionExW
WaitForSingleObject
SetEvent
InitializeCriticalSection
ResetEvent
CreateEventW
SetFileApisToOEM
SetFileApisToANSI
GlobalFree
lstrcpyW
lstrcpynW
GlobalAlloc
RaiseException
VirtualQuery
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
HeapFree
HeapAlloc
HeapReAlloc
ExitThread
CreateThread
GetCommandLineA
GetVersionExA
GetProcessHeap
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
Sleep
HeapSize
RtlUnwind
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoA

user32

CharUpperW
GetDlgItem
FindWindowExW
SetWindowTextW
wsprintfW
SendMessageW

oleaut32

VariantCopy
VariantClear
SysAllocString

Exports

Exports

Extract
ExtractWithCallback
ExtractWithDetails

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/wincheck.ini
$_3_/tvqsfiles.7z
.7z
TeamViewer.exe
.exe windows:5 windows x86 arch:x86

27c125b046582eb649aee2589da71bda

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fa:d5:76:83:af:16:8b:b7:9c:e9:a2:15:01:f6:33:b5:e5:7f:90:53
Signer

Actual PE Digest

fa:d5:76:83:af:16:8b:b7:9c:e9:a2:15:01:f6:33:b5:e5:7f:90:53

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer_10.0_Release\BuildTarget\QS_Release2013\TeamViewer.pdb

Imports

kernel32

GetLocaleInfoW
GetLastError
CloseHandle
WaitForSingleObjectEx
CreateEventA
SetEvent
GetCurrentProcessId
OpenEventA
ResetEvent
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedExchange
PostQueuedCompletionStatus
InterlockedIncrement
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
ReleaseSemaphore
DuplicateHandle
GetCurrentProcess
CreateSemaphoreA
RaiseException
Sleep
FlushInstructionCache
GetCurrentThreadId
SetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
GetSystemTimeAsFileTime
InterlockedExchangeAdd
SetWaitableTimer
WaitForSingleObject
SleepEx
CreateEventW
CreateWaitableTimerW
GetProcessHeap
HeapFree
HeapAlloc
CreateIoCompletionPort
VerifyVersionInfoW
VerSetConditionMask
QueueUserAPC
TerminateThread
WaitForMultipleObjects
InterlockedDecrement
GetQueuedCompletionStatus
InterlockedCompareExchange
HeapReAlloc
HeapDestroy
HeapSize
DecodePointer
GetModuleHandleA
GetTempPathW
GlobalAlloc
GlobalLock
GlobalFree
GlobalUnlock
lstrlenW
GetVersionExW
CompareStringW
CompareFileTime
GetLocalTime
GetTimeFormatW
GetModuleHandleW
WideCharToMultiByte
CreateFileW
GetFileSize
ReadFile
GetPrivateProfileStringW
WritePrivateProfileStringW
GetModuleFileNameW
MulDiv
lstrcmpW
GlobalHandle
LockResource
LoadResource
FindResourceW
MultiByteToWideChar
SetErrorMode
SetProcessShutdownParameters
OutputDebugStringW
CreateDirectoryW
SetThreadPriority
GetCurrentThread
UnregisterWait
RegisterWaitForSingleObject
ResumeThread
CreateThread
GetExitCodeThread
SizeofResource
FindResourceExW
CopyFileW
DeleteFileW
FindFirstFileW
FindClose
GetFileAttributesW
LoadLibraryExA
GetSystemDirectoryA
GetCommandLineW
ReleaseMutex
CreateMutexW
WriteFile
GetComputerNameW
VirtualAlloc
VirtualFree
GetPriorityClass
SetPriorityClass
ExpandEnvironmentStringsA
FormatMessageA
GetUserGeoID
GetGeoInfoW
GetSystemInfo
MoveFileExW
GetNativeSystemInfo
SetThreadAffinityMask
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemDirectoryW
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
GetDateFormatW
SystemTimeToFileTime
OpenProcess
FindNextFileW
WaitNamedPipeW
CreateProcessW
TerminateProcess
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
UnregisterWaitEx
SetDllDirectoryW
HeapSetInformation
ExpandEnvironmentStringsW
GetPrivateProfileIntW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
LoadLibraryExW
LocalFree
GetWindowsDirectoryW
SetFilePointerEx
OpenMutexW
FormatMessageW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalMemoryStatusEx
MoveFileW
GetLogicalDriveStringsW
GetDriveTypeW
GetVolumeInformationW
FileTimeToSystemTime
DeviceIoControl
SetFileAttributesW
GetTempFileNameW
SetFilePointer
GetCurrentDirectoryW
LocalFileTimeToFileTime
SetFileTime
GetFileInformationByHandle
UnmapViewOfFile
lstrcmpiW
SetUnhandledExceptionFilter
FileTimeToLocalFileTime
GlobalSize
GetFileAttributesExW
SetThreadExecutionState
GetSystemTime
GetFullPathNameW
SetEndOfFile
GetStringTypeW
EncodePointer
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
IsProcessorFeaturePresent
LoadLibraryA
GetStringTypeExW
LCMapStringW
LCMapStringA
GetUserDefaultLCID
GetStringTypeExA
GetFileTime
RemoveDirectoryW
AreFileApisANSI
CreateFileA
MapViewOfFileEx
CreateFileMappingA
WaitForMultipleObjectsEx
CreateWaitableTimerA
ExitThread
GetCPInfo
GetCommandLineA
ExitProcess
GetModuleHandleExW
RtlUnwind
UnhandledExceptionFilter
GetStartupInfoW
CreateSemaphoreW
IsValidLocale
EnumSystemLocalesW
GetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
FlushFileBuffers
IsValidCodePage
GetACP
GetOEMCP
ReadConsoleW
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
FindFirstFileExW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
PeekNamedPipe
GetThreadTimes
SwitchToThread
LocalAlloc
OpenEventW
OpenFileMappingA
GetOverlappedResult
lstrlenA

Sections

.text
Size: 8.4MB - Virtual size: 8.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 439KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 455KB - Virtual size: 455KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TeamViewer_Desktop.exe
.exe windows:5 windows x86 arch:x86

b20fd39d4bc459e9d88bbdd89f047664

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

aa:d8:4c:ab:41:e2:df:7b:88:21:3a:3a:50:4d:1d:62:25:10:7c:8a
Signer

Actual PE Digest

aa:d8:4c:ab:41:e2:df:7b:88:21:3a:3a:50:4d:1d:62:25:10:7c:8a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer_10.0_Release\BuildTarget\QS_Release2013\TeamViewer_Desktop.pdb

Imports

kernel32

CloseHandle
WaitForSingleObjectEx
CreateEventA
SetEvent
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
PostQueuedCompletionStatus
InterlockedIncrement
TlsFree
GetLastError
TlsAlloc
TlsGetValue
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsSetValue
GetCurrentProcessId
OpenEventA
ResetEvent
GetTickCount
ReleaseSemaphore
DuplicateHandle
CreateSemaphoreA
RaiseException
GetCurrentProcess
LoadLibraryExA
GetSystemDirectoryA
GetCurrentThreadId
GetCommandLineW
GetModuleFileNameW
GetProcessShutdownParameters
SetProcessShutdownParameters
DecodePointer
FlushInstructionCache
SetLastError
GetProcessHeap
HeapFree
Sleep
HeapAlloc
GetSystemTimeAsFileTime
CreateFileW
DeviceIoControl
GetExitCodeThread
QueueUserAPC
InterlockedExchangeAdd
SetWaitableTimer
WaitForSingleObject
SleepEx
CreateEventW
CreateWaitableTimerW
InterlockedDecrement
GetModuleHandleA
GetProcAddress
GetCurrentThread
LoadLibraryW
LocalAlloc
LocalFree
InterlockedCompareExchange
InitializeCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemInfo
GetModuleHandleW
CreateSemaphoreW
FreeLibrary
HeapReAlloc
FindFirstFileW
SetUnhandledExceptionFilter
GetSystemDirectoryW
FileTimeToSystemTime
HeapSize
FindClose
FindNextFileW
FileTimeToLocalFileTime
DeleteFileW
CreateDirectoryW
CreateIoCompletionPort
VerifyVersionInfoW
VerSetConditionMask
TerminateThread
WaitForMultipleObjects
GetQueuedCompletionStatus
GetFileAttributesW
WideCharToMultiByte
MultiByteToWideChar
SetDllDirectoryW
HeapSetInformation
OpenProcess
LoadLibraryExW
GetVersionExW
WriteFile
ReadFile
TerminateProcess
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
UnregisterWaitEx
ReleaseMutex
SetFilePointerEx
CreateMutexW
OpenMutexW
GetFileSize
GetTimeZoneInformation
GetLocalTime
SystemTimeToTzSpecificLocalTime
GetTimeFormatW
GetDateFormatW
SystemTimeToFileTime
GetPrivateProfileStringW
FormatMessageW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
GlobalMemoryStatusEx
GetComputerNameW
SetFileAttributesW
CreateThread
ResumeThread
GetDriveTypeW
lstrcmpiW
SizeofResource
LoadResource
FindResourceW
SetThreadExecutionState
LockResource
GetSystemTime
GetFullPathNameW
SetEndOfFile
GetStringTypeW
EncodePointer
IsDebuggerPresent
OutputDebugStringW
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
FormatMessageA
LCMapStringW
GetUserDefaultLCID
GetCurrentDirectoryW
GetFileInformationByHandle
RemoveDirectoryW
CopyFileW
AreFileApisANSI
WaitForMultipleObjectsEx
CreateWaitableTimerA
ExitThread
GetCommandLineA
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
GetStartupInfoW
CompareStringW
IsValidLocale
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetStdHandle
GetFileType
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadConsoleW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
GetThreadTimes
GetPrivateProfileIntW
WritePrivateProfileStringW
SwitchToThread
OpenEventW
UnmapViewOfFile
CreateFileMappingA
OpenFileMappingA
MapViewOfFileEx
FindFirstFileExW
PeekNamedPipe

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 891KB - Virtual size: 890KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TeamViewer_Resource_es.dll
.dll windows:5 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fb:88:a4:17:5d:67:db:61:7c:a7:a3:fe:da:3c:88:cd:91:0b:27:2a
Signer

Actual PE Digest

fb:88:a4:17:5d:67:db:61:7c:a7:a3:fe:da:3c:88:cd:91:0b:27:2a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 331KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TeamViewer_Service.exe
.exe windows:5 windows x86 arch:x86

ec1d82cddaa664eed6de12398d264f9f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c8:19:de:44:a7:10:d8:c2:4d:26:3b:b5:81:b6:b4:ae:c9:43:90:48
Signer

Actual PE Digest

c8:19:de:44:a7:10:d8:c2:4d:26:3b:b5:81:b6:b4:ae:c9:43:90:48

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer_10.0_Release\BuildTarget\QS_Release2013\TeamViewer_Service.pdb

Imports

kernel32

GetCurrentThreadId
GetModuleFileNameW
LoadLibraryExA
GetSystemDirectoryA
GetLastError
lstrcmpiW
SetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DecodePointer
GetModuleHandleW
RaiseException
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
InterlockedDecrement
InterlockedIncrement
Sleep
CreateEventA
SetEvent
InterlockedExchange
InterlockedExchangeAdd
PostQueuedCompletionStatus
TlsAlloc
CloseHandle
TlsFree
ExpandEnvironmentStringsA
VerSetConditionMask
SleepEx
VerifyVersionInfoW
InitializeCriticalSection
GetTickCount
LoadLibraryW
FormatMessageA
WaitForSingleObject
WideCharToMultiByte
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentProcessId
DeleteFileW
MoveFileExW
CreateDirectoryW
GetSystemTimeAsFileTime
TlsGetValue
SetWaitableTimer
CreateEventW
CreateWaitableTimerW
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
LocalFree
GetSystemDirectoryW
SetDllDirectoryW
HeapSetInformation
GetFileAttributesW
GetSystemInfo
WriteFile
ReleaseMutex
SetFilePointerEx
CreateMutexW
OpenMutexW
CreateFileW
GetFileSize
ProcessIdToSessionId
GetVersionExW
FindFirstFileW
FindNextFileW
FindClose
WaitNamedPipeW
ReadFile
CreateProcessW
TerminateProcess
WTSGetActiveConsoleSessionId
RegisterWaitForSingleObject
UnregisterWaitEx
GetTimeZoneInformation
GetLocalTime
SystemTimeToTzSpecificLocalTime
GetTimeFormatW
GetDateFormatW
SystemTimeToFileTime
DuplicateHandle
CreateSemaphoreA
ReleaseSemaphore
GetNativeSystemInfo
OpenEventA
ResetEvent
CreateIoCompletionPort
QueueUserAPC
TerminateThread
WaitForMultipleObjects
GetQueuedCompletionStatus
InterlockedCompareExchange
TlsSetValue
GetProcessHeap
HeapFree
HeapAlloc
GetPrivateProfileStringW
GetTempPathW
FormatMessageW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
GetComputerNameW
GetDriveTypeW
GetVolumeInformationW
FileTimeToSystemTime
DeviceIoControl
SetThreadPriority
GetCurrentThread
HeapReAlloc
SetUnhandledExceptionFilter
HeapSize
FileTimeToLocalFileTime
GetStringTypeW
EncodePointer
IsDebuggerPresent
OutputDebugStringW
LoadLibraryA
LCMapStringW
LCMapStringA
GetUserDefaultLCID
GetStringTypeExA
GetCurrentDirectoryW
GetFileInformationByHandle
GetFullPathNameW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFileTime
GetModuleHandleA
CopyFileW
AreFileApisANSI
WaitForMultipleObjectsEx
ResumeThread
CreateWaitableTimerA
IsProcessorFeaturePresent
GetCommandLineW
CreateThread
ExitThread
GetCPInfo
RtlUnwind
UnhandledExceptionFilter
GetStartupInfoW
CompareStringW
IsValidLocale
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
ReadConsoleW
GetConsoleCP
FlushFileBuffers
FindFirstFileExW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
PeekNamedPipe
QueryPerformanceFrequency
GetThreadTimes
GetPrivateProfileIntW
WritePrivateProfileStringW
SwitchToThread
SetThreadAffinityMask
UnmapViewOfFile
CreateFileMappingA
OpenFileMappingA
MapViewOfFileEx
LocalAlloc
OpenEventW
GetExitCodeThread
GetTempFileNameW
SetFilePointer
LocalFileTimeToFileTime
GetOverlappedResult
lstrlenA

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 840KB - Virtual size: 840KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TeamViewer_StaticRes.dll
.dll windows:5 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ad:49:f8:54:26:c9:01:2f:eb:6b:4e:43:97:38:10:16:48:4c:a7:14
Signer

Actual PE Digest

ad:49:f8:54:26:c9:01:2f:eb:6b:4e:43:97:38:10:16:48:4c:a7:14

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
tv_w32.dll
.dll windows:5 windows x86 arch:x86

dc85c437b37935c861af3e5554a4eb80

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

83:43:1a:c2:f5:cf:ac:ec:48:e5:59:2a:98:db:c9:cf:84:c1:e6:21
Signer

Actual PE Digest

83:43:1a:c2:f5:cf:ac:ec:48:e5:59:2a:98:db:c9:cf:84:c1:e6:21

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\TeamViewer_10.0_Release\BuildTarget\Release2013\tv_w32dll.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

comctl32

InitCommonControlsEx

kernel32

CloseHandle
GetCurrentProcessId
GlobalLock
InitializeCriticalSection
GetVersionExW
LeaveCriticalSection
FileTimeToSystemTime
GlobalUnlock
EnterCriticalSection
GetFileAttributesExW
DeleteCriticalSection
FreeLibrary
GetSystemDirectoryA
LoadLibraryA
GetLocalTime
GetCurrentThreadId
InterlockedCompareExchange
Thread32First
GetExitCodeProcess
Thread32Next
InterlockedExchange
OpenMutexW
DisableThreadLibraryCalls
OpenThread
GetModuleFileNameA
SuspendThread
ResumeThread
LoadLibraryW
Sleep
GetModuleFileNameW
FreeLibraryAndExitThread
CreateThread
CreateMutexW
MapViewOfFile
UnmapViewOfFile
VirtualQuery
InterlockedIncrement
InterlockedDecrement
GetCurrentProcess
WaitForSingleObject
SetEvent
GetTickCount
IsBadReadPtr
IsBadWritePtr
CreateFileMappingW
CreateEventW
OpenFileMappingW
ReleaseMutex
LocalFree
Module32Next
LocalAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStringTypeW
FatalAppExitA
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetFileType
GetStdHandle
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetCurrentThread
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
SetConsoleCtrlHandler
GetOEMCP
GetACP
IsValidCodePage
CreateSemaphoreW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DecodePointer
EncodePointer
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
LoadLibraryExW
RtlUnwind
HeapReAlloc
SetStdHandle
WriteConsoleW
QueryPerformanceFrequency
CreateToolhelp32Snapshot
VirtualProtect
GetModuleHandleA
VirtualAlloc
GetLastError
Module32First
OpenProcess
CreateRemoteThread
GetProcessHeap
VirtualFree
GetModuleHandleW
HeapFree
QueryPerformanceCounter
HeapAlloc
GetProcAddress
OutputDebugStringW
HeapSize
FlushFileBuffers
SetLastError
CreateFileW

user32

GetUpdateRect
FindWindowW
ClientToScreen
GetDC
GetDesktopWindow
FindWindowExW
MapWindowPoints
EndPaint
GetClassNameA
IsIconic
PostMessageW
IsZoomed
TrackMouseEvent
GetWindowInfo
GetClientRect
BeginPaint
InvalidateRect
GetWindowLongW
SystemParametersInfoW
SetWindowLongW
RedrawWindow
GetSysColor
ShowWindow
LoadBitmapW
GetActiveWindow
GetSystemMetrics
CallWindowProcW
GetWindow
MoveWindow
IsRectEmpty
GetWindowRect
GetWindowDC
ReleaseDC
SetWindowPos
IsWindow
IsWindowVisible
LoadCursorW
GetClassInfoExW
RegisterClassExW
SendNotifyMessageW
SetTimer
RegisterWindowMessageW
UnregisterClassW
KillTimer
CallNextHookEx
SendMessageTimeoutW
SetWindowsHookExW
UnhookWindowsHookEx
RegisterClipboardFormatW
DefWindowProcW
DestroyWindow
CreateWindowExW
SendMessageW

gdi32

Polyline
GetObjectW
CreateCompatibleBitmap
LineTo
GetPixel
CreateSolidBrush
Rectangle
CreatePen
GetStockObject
BitBlt
DeleteDC
CreateDIBSection
GdiFlush
DeleteObject
SelectObject
CreateCompatibleDC
MoveToEx
ExtCreatePen
RectVisible
SetPixel

shell32

DragQueryFileW

ole32

CoUninitialize
CoInitialize
CoCreateInstance
ReleaseStgMedium

Exports

Exports

GetLoaderInterface
GetTeamViewerInterface

Sections

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tv_w32.exe
.exe windows:5 windows x86 arch:x86

e28a2cb5a0cc9b9f7d18a86e321f5c6e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

dd:39:ad:e1:7f:b0:18:f0:11:81:f4:f6:61:1d:82:b1:da:8b:d5:1f
Signer

Actual PE Digest

dd:39:ad:e1:7f:b0:18:f0:11:81:f4:f6:61:1d:82:b1:da:8b:d5:1f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer_10.0_Release\BuildTarget\Release2013\tv_w32exe.pdb

Imports

kernel32

GetLastError
SetLastError
CreateEventW
CloseHandle
DeleteFileW
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
Sleep
GetSystemDirectoryW
LoadLibraryW
GetTickCount
OpenMutexA
CreateMutexW
GetVersionExW
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId
GetCommandLineW
GetCurrentProcess
GetCommandLineA
GetSystemDirectoryA
LoadLibraryExA
CopyFileW
SetEvent
SetFilePointer
MoveFileExW
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
HeapFree
RtlUnwind
GetCPInfo
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
ExitProcess
GetModuleHandleExW
HeapSize
GetProcessHeap
GetStdHandle
GetFileType
GetModuleFileNameW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
SetStdHandle
WriteConsoleW
FlushFileBuffers

advapi32

RegCloseKey
RegOpenKeyExW
RegSetValueExW

Sections

.text
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tv_x64.dll
.dll windows:5 windows x64 arch:x64

d876e905ada429863c3d18bc7c192f51

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8a:1b:d7:76:5a:1a:98:91:0d:c0:19:9a:93:82:e1:2f:26:5a:b8:53
Signer

Actual PE Digest

8a:1b:d7:76:5a:1a:98:91:0d:c0:19:9a:93:82:e1:2f:26:5a:b8:53

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\TeamViewer_10.0_Release\BuildTarget\Release2013\tv_x64dll.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

comctl32

InitCommonControlsEx

kernel32

CloseHandle
GetCurrentProcessId
GlobalLock
InitializeCriticalSection
GetVersionExW
LeaveCriticalSection
FileTimeToSystemTime
GlobalUnlock
EnterCriticalSection
GetFileAttributesExW
DeleteCriticalSection
FreeLibrary
GetSystemDirectoryA
LoadLibraryA
GetLocalTime
GetCurrentThreadId
Thread32First
Thread32Next
OpenMutexW
DisableThreadLibraryCalls
OpenThread
GetModuleFileNameA
SuspendThread
ResumeThread
LoadLibraryW
Sleep
GetModuleFileNameW
FreeLibraryAndExitThread
CreateThread
CreateMutexW
MapViewOfFile
UnmapViewOfFile
VirtualQuery
WaitForSingleObject
SetEvent
GetTickCount
IsBadReadPtr
IsBadWritePtr
CreateFileMappingW
CreateEventW
OpenFileMappingW
ReleaseMutex
LocalFree
SetLastError
LocalAlloc
GetUserDefaultLCID
IsValidLocale
Module32Next
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStringTypeW
FatalAppExitA
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetFileType
GetStdHandle
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetCurrentThread
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
CreateSemaphoreW
GetStartupInfoW
EnumSystemLocalesW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
DecodePointer
EncodePointer
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
SetConsoleCtrlHandler
LoadLibraryExW
HeapReAlloc
SetStdHandle
WriteConsoleW
QueryPerformanceFrequency
CreateToolhelp32Snapshot
VirtualProtect
GetModuleHandleA
VirtualAlloc
GetLastError
Module32First
OpenProcess
CreateRemoteThread
GetProcessHeap
VirtualFree
GetModuleHandleW
HeapFree
QueryPerformanceCounter
HeapAlloc
GetProcAddress
OutputDebugStringW
HeapSize
FlushFileBuffers
GetLocaleInfoW
CreateFileW

user32

ClientToScreen
FindWindowW
GetUpdateRect
GetDC
GetDesktopWindow
FindWindowExW
MapWindowPoints
EndPaint
GetClassNameA
IsIconic
PostMessageW
IsZoomed
TrackMouseEvent
GetWindowInfo
GetWindowLongPtrW
GetClientRect
BeginPaint
InvalidateRect
SystemParametersInfoW
RedrawWindow
GetSysColor
LoadBitmapW
GetActiveWindow
GetSystemMetrics
SetWindowLongPtrW
SendMessageW
CallWindowProcW
GetWindow
MoveWindow
IsRectEmpty
GetWindowRect
GetWindowDC
ReleaseDC
SetWindowPos
IsWindow
IsWindowVisible
LoadCursorW
GetClassInfoExW
RegisterClassExW
SendNotifyMessageW
SetTimer
RegisterWindowMessageW
UnregisterClassW
KillTimer
CallNextHookEx
SendMessageTimeoutW
SetWindowsHookExW
UnhookWindowsHookEx
RegisterClipboardFormatW
DefWindowProcW
DestroyWindow
CreateWindowExW
ShowWindow

gdi32

LineTo
MoveToEx
ExtCreatePen
SetPixel
CreateCompatibleBitmap
GetObjectW
Polyline
GetPixel
CreateSolidBrush
Rectangle
CreatePen
GetStockObject
BitBlt
DeleteDC
CreateDIBSection
GdiFlush
DeleteObject
SelectObject
CreateCompatibleDC
RectVisible

shell32

DragQueryFileW

ole32

CoUninitialize
CoInitialize
CoCreateInstance
ReleaseStgMedium

Exports

Exports

GetLoaderInterface

Sections

.text
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shared
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tv_x64.exe
.exe windows:5 windows x64 arch:x64

ee838f81314c2cf6b852215846ef499b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

05/09/2017, 23:59

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:31:2f:86:12:9b:93:46:2e:41:9f:8d:01:fe:14:4a:01:cf:1a:7a
Signer

Actual PE Digest

0b:31:2f:86:12:9b:93:46:2e:41:9f:8d:01:fe:14:4a:01:cf:1a:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\TeamViewer_10.0_Release\BuildTarget\Release2013\tv_x64exe.pdb

Imports

kernel32

GetLastError
SetLastError
CreateEventW
CloseHandle
DeleteFileW
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetSystemDirectoryW
LoadLibraryW
GetTickCount
OpenMutexA
GetVersionExW
SetFilePointer
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId
GetCommandLineW
GetCurrentProcess
GetCommandLineA
GetSystemDirectoryA
LoadLibraryExA
CopyFileW
SetEvent
CreateMutexW
MoveFileExW
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
HeapFree
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetCPInfo
HeapAlloc
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
ExitProcess
GetModuleHandleExW
HeapSize
GetProcessHeap
GetStdHandle
GetFileType
GetModuleFileNameW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
SetStdHandle
WriteConsoleW
FlushFileBuffers

advapi32

RegCloseKey
RegOpenKeyExW
RegSetValueExW

Sections

.text
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_3_/tvqsfilesx64.7z
.7z
x64/TVMonitor.inf
x64/TVMonitor.sy_
.sys windows:6 windows x64 arch:x64

f24b69173de020aa0ac1739d7b40e04c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3b
Signer

Actual PE Digest

28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

j:\teamviewer6.0\monitordriver\objfre_wlh_amd64\amd64\TVMonitor.pdb

Imports

ntoskrnl.exe

IoAcquireRemoveLockEx
KeClearEvent
IoDeleteSymbolicLink
_snwprintf
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoReleaseRemoveLockEx
IoDetachDevice
PoRequestPowerIrp
KeSetTimerEx
PsCreateSystemThread
PsTerminateSystemThread
PoStartNextPowerIrp
ZwClose
IofCompleteRequest
IoReleaseRemoveLockAndWaitEx
ObReferenceObjectByHandle
KeWaitForSingleObject
IoGetAttachedDeviceReference
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateSymbolicLink
ObfDereferenceObject
IoInitializeRemoveLockEx
IoCreateDevice
KeInitializeTimerEx
KeCancelTimer
KeWaitForMultipleObjects
IofCallDriver
KeBugCheckEx

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/tvmonitor.cat
$_3_/tvqsfilesx86.7z
.7z
x86/TVMonitor.inf
x86/TVMonitor.sy_
.sys windows:6 windows x86 arch:x86

bc06eb1dad5e8285411e580cdee99e10

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83
Signer

Actual PE Digest

a9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

j:\teamviewer6.0\monitordriver\objfre_wxp_x86\i386\TVMonitor.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
_snwprintf
IofCompleteRequest
IoReleaseRemoveLockEx
PoCallDriver
IoAcquireRemoveLockEx
PoStartNextPowerIrp
IofCallDriver
ObfDereferenceObject
IoGetAttachedDeviceReference
IoDeleteDevice
IoDetachDevice
KeWaitForSingleObject
KeSetEvent
PoRequestPowerIrp
IoAttachDeviceToDeviceStack
IoDeleteSymbolicLink
IoInitializeRemoveLockEx
IoCreateSymbolicLink
IoCreateDevice
InterlockedIncrement
IoReleaseRemoveLockAndWaitEx
PsTerminateSystemThread
KeCancelTimer
KeWaitForMultipleObjects
KeSetTimerEx
KeClearEvent
KeInitializeTimerEx
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
KeTickCount
KeBugCheckEx
KeInitializeEvent
KeGetCurrentThread

hal

KeGetCurrentIrql

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 277B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 384B - Virtual size: 274B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/tvmonitor.cat

Sharing

General

Malware Config

Signatures

Files

32f3282581436269b3a75b6675fe3e08

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

8d:42:0a:6a:be:bf:2a:0e:75:e4:0d:78:32:1a:b1:3a:90:c9:86:ecSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 415KB

.ndata Size: - Virtual size: 708KB

.rsrc Size: 26KB - Virtual size: 25KB

.reloc Size: 4KB - Virtual size: 3KB

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 963B

.data Size: 512B - Virtual size: 64B

.reloc Size: 1024B - Virtual size: 588B

14e0ed23a737a24ab5884c7197f5adf9

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

8d:42:0a:6a:be:bf:2a:0e:75:e4:0d:78:32:1a:b1:3a:90:c9:86:ec
Signer

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 415KB

.ndata
Size: - Virtual size: 708KB

.rsrc
Size: 26KB - Virtual size: 25KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

.text
Size: 101KB - Virtual size: 101KB

.rdata
Size: 35KB - Virtual size: 34KB

.data
Size: 5KB - Virtual size: 20KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 8KB - Virtual size: 8KB

.text
Size: 128KB - Virtual size: 127KB

.rdata
Size: 27KB - Virtual size: 26KB

.data
Size: 6KB - Virtual size: 23KB

.rsrc
Size: 1024B - Virtual size: 840B

.reloc
Size: 12KB - Virtual size: 11KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

fa:d5:76:83:af:16:8b:b7:9c:e9:a2:15:01:f6:33:b5:e5:7f:90:53
Signer

.text
Size: 8.4MB - Virtual size: 8.4MB

.rdata
Size: 2.1MB - Virtual size: 2.1MB

.data
Size: 439KB - Virtual size: 470KB

.tls
Size: 512B - Virtual size: 9B

.rodata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 26KB - Virtual size: 25KB

.reloc
Size: 455KB - Virtual size: 455KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate