395759e0aa62622a4ec95823fb2368d4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

395759e0aa62622a4ec95823fb2368d4_JaffaCakes118
Size

2.9MB
MD5

395759e0aa62622a4ec95823fb2368d4
SHA1

d7b3c28ee81102de16434531049f2237b294688e
SHA256

739b166d23bc5d105e819237531d956e2a9734a3e078b55d0f7b47faa45f403a
SHA512

baf99511a74b5cd9bbf187b60eda5864027a9fa3ff942e36ab7872953589ac25e61fc8382e35d90dd1c103dbbfa5627371a61cd505bb510b66e3cf179f9df6b3
SSDEEP

49152:pEN6oZDhMcToUcHx0ZrKSrseqPs4OB8ecNifpf0a7YPb/lIKftzDKtj36T:SNjDhMOoUcHSr2s4OB+Mt0BT/lIKftI+

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/ReadCustomerData.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/TvGetVersion.dll
unpack001/$PLUGINSDIR/nsis7z.dll
unpack001/out.upx

NSIS installer 1 IoCs

installer

resource	yara_rule
static1/unpack001/out.upx	nsis_installer_2

Files

395759e0aa62622a4ec95823fb2368d4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:d3:04:f2:29:90:41:f1:f8:24:72:0a:88:d0:91:93:1a:aa:ab:7c
Signer

Actual PE Digest

0d:d3:04:f2:29:90:41:f1:f8:24:72:0a:88:d0:91:93:1a:aa:ab:7c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 200KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ReadCustomerData.dll
.dll windows:4 windows x86 arch:x86

d29e408dd9048e10d5936c6f2bfca832

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
MultiByteToWideChar
GetLastError
ReadFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
CloseHandle
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
RtlUnwind
RaiseException
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
FlushFileBuffers
VirtualAlloc
HeapReAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
InitializeCriticalSection
HeapSize
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetEndOfFile
LCMapStringA
LCMapStringW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GlobalFree
lstrcpyA

Exports

Exports

ReadCustomerData

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/TvGetVersion.dll
.dll windows:4 windows x86 arch:x86

7f27fb2f8604769e3f1416e79e2b660f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
GetVersionExA
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
lstrcpynA
GetTickCount
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
lstrcmpiA
lstrcpyA
lstrlenA
lstrcatA
GetDriveTypeA
CreateFileA
GetFileSize
GlobalAlloc
ReadFile
CloseHandle
GlobalFree
GetLastError
GetCurrentProcessId
GetModuleHandleA
QueryPerformanceCounter
GetProcAddress

user32

GetSystemMetrics
SendMessageA
wsprintfA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA
DeleteService
ControlService
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
RegDeleteValueA
RegCreateKeyExA
RegEnumKeyExA
RegEnumValueA
RegSetValueExA

Exports

Exports

GetCurrentSessionId
GetServiceStatus
IsNetPath
IsServiceInstalled
IsTvPasswordSet
LoadFile
RegCopyKey
RegCopyValue
RemoveService
RemoveServiceWait
RunService
RunServiceWait
StopService
StopServiceWait
WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsVersion
WindowsVersionMajor
WindowsVersionMinor

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsis7z.dll
.dll windows:4 windows x86 arch:x86

b22ed27c346f001ed1b4410c1073cfa9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
LoadLibraryA
GetModuleFileNameA
RemoveDirectoryW
MoveFileA
MoveFileW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
GetFullPathNameA
GetFullPathNameW
GetCurrentThreadId
GetCurrentProcessId
SetLastError
CreateFileW
SetFileTime
CloseHandle
SetFileAttributesA
SetFileAttributesW
RemoveDirectoryA
FindClose
FindFirstFileA
FindFirstFileW
CreateFileA
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GetProcAddress
GetCurrentProcess
GetSystemInfo
GetModuleHandleA
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
DeleteCriticalSection
AreFileApisANSI
VirtualFree
VirtualAlloc
GetVersionExA
ResetEvent
WaitForSingleObject
SetEvent
InitializeCriticalSection
CreateEventA
SetFileApisToOEM
SetFileApisToANSI
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
RaiseException
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapAlloc
HeapFree
HeapReAlloc
ExitThread
CreateThread
GetCommandLineA
GetProcessHeap
HeapDestroy
HeapCreate
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
Sleep
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
VirtualQuery

user32

CharUpperW
CharUpperA
GetDlgItem
FindWindowExA
SetWindowTextA
wsprintfA
SendMessageA

oleaut32

VariantCopy
VariantClear
SysAllocString

Exports

Exports

Extract
ExtractWithCallback
ExtractWithDetails

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/wincheck.ini
$_2_/tvqsfiles.7z
.7z
TeamViewer.exe
.exe windows:5 windows x86 arch:x86

f6e72ae7bc091ffa9e18ef49ede11c96

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:6b:a0:a7:2c:77:b0:39:d3:df:43:2d:b9:4a:f4:fb:ba:26:ef:c0
Signer

Actual PE Digest

5f:6b:a0:a7:2c:77:b0:39:d3:df:43:2d:b9:4a:f4:fb:ba:26:ef:c0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\QS_Release2008\TeamViewer.pdb

Imports

avicap32

capGetDriverDescriptionA

msvfw32

DrawDibOpen
DrawDibDraw
DrawDibClose

winmm

waveOutReset
waveOutClose
waveOutUnprepareHeader
waveOutRestart
waveInGetNumDevs
waveOutPause
waveOutPrepareHeader
waveOutOpen
waveInStart
waveInReset
waveInClose
waveInUnprepareHeader
waveInAddBuffer
waveInPrepareHeader
waveInOpen
timeEndPeriod
timeBeginPeriod
mixerSetControlDetails
mixerGetControlDetailsW
mixerClose
mixerGetLineControlsW
mixerGetLineInfoW
mixerGetID
waveOutGetDevCapsW
waveInGetDevCapsW
mixerGetDevCapsW
mixerOpen
waveOutGetNumDevs
waveOutWrite

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

iphlpapi

GetAdaptersInfo
GetAdapterIndex
DeleteIPAddress
SendARP

kernel32

CompareStringW
GetThreadTimes
GetSystemDirectoryA
GetVersionExA
ExpandEnvironmentStringsA
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetStringTypeA
IsValidCodePage
GetOEMCP
GetACP
GetTimeZoneInformation
HeapCreate
GetModuleFileNameA
GetStdHandle
CompareStringA
GetStringTypeW
LCMapStringW
LCMapStringA
GetDateFormatA
GetTimeFormatA
ExitProcess
GetStartupInfoA
GetCommandLineA
ExitThread
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
CreateWaitableTimerA
CreateFileMappingA
MapViewOfFileEx
CreateFileA
UnmapViewOfFile
AreFileApisANSI
GetModuleHandleA
GetFileTime
GetVolumeInformationW
RemoveDirectoryW
FormatMessageA
HeapSize
HeapReAlloc
HeapDestroy
IsProcessorFeaturePresent
LoadLibraryA
lstrlenA
DeviceIoControl
SetFileAttributesW
SetEndOfFile
CompareFileTime
GetOverlappedResult
CancelIo
GlobalSize
WaitForMultipleObjectsEx
GetFileAttributesExW
GetSystemTime
SetFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetFileAttributesW
WaitForSingleObjectEx
GetLogicalDriveStringsW
GetDateFormatW
SystemTimeToTzSpecificLocalTime
GetTempPathW
SystemTimeToFileTime
GetSystemDefaultLCID
GetUserDefaultLCID
GetLocaleInfoA
MoveFileExW
CreateProcessW
TerminateProcess
WaitNamedPipeW
GetPrivateProfileIntW
InterlockedCompareExchange
GetQueuedCompletionStatus
TerminateThread
QueueUserAPC
CreateIoCompletionPort
OpenEventA
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
OpenProcess
ExpandEnvironmentStringsW
FormatMessageW
LocalFree
SetThreadAffinityMask
QueryPerformanceCounter
QueryPerformanceFrequency
MoveFileW
SetFilePointer
GetSystemDirectoryW
SetUnhandledExceptionFilter
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDriveTypeW
lstrcpyW
FindFirstFileW
GetFullPathNameW
FindClose
GetCurrentDirectoryA
GetFullPathNameA
FindNextFileW
GetCurrentThread
ResetEvent
SetThreadPriority
GetPriorityClass
SetPriorityClass
TryEnterCriticalSection
VirtualAlloc
VirtualFree
DuplicateHandle
GetLocalTime
GetTimeFormatW
DeleteFileW
GetCurrentProcessId
CopyFileW
GetCommandLineW
LoadLibraryExW
MultiByteToWideChar
CloseHandle
FindFirstFileA
GetDriveTypeA
ReadFileEx
LocalAlloc
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
CreateMutexW
lstrcmpiW
GetModuleHandleW
ReleaseMutex
GetCurrentProcess
TlsAlloc
TlsFree
GlobalHandle
InterlockedDecrement
lstrcmpW
MulDiv
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
CreateThread
ResumeThread
GetExitCodeThread
WaitForMultipleObjects
ReleaseSemaphore
CreateSemaphoreA
GetModuleFileNameW
CreateDirectoryW
SetErrorMode
SetProcessShutdownParameters
lstrcpynW
GetVersionExW
WritePrivateProfileStringW
GetFileSize
ReadFile
GetPrivateProfileStringW
CreateWaitableTimerW
CreateEventW
InterlockedExchangeAdd
InterlockedExchange
PostQueuedCompletionStatus
SetWaitableTimer
GetSystemTimeAsFileTime
InterlockedIncrement
SleepEx
LoadLibraryW
FreeLibrary
WideCharToMultiByte
GetProcAddress
GlobalAlloc
GlobalLock
CreateFileW
WriteFile
GlobalUnlock
GlobalFree
Sleep
DeleteCriticalSection
InitializeCriticalSection
lstrlenW
GetLastError
GetTickCount
SetEvent
WaitForSingleObject
HeapAlloc
CreateEventA
SetLastError
GetCurrentThreadId
GetProcessHeap
HeapFree

user32

BringWindowToTop
SendNotifyMessageW
SendMessageW
MonitorFromWindow
SetWindowLongW
ExitWindowsEx
DrawStateW
DrawFocusRect
GetSysColorBrush
SendDlgItemMessageW
GetClassLongW
GetWindowThreadProcessId
WindowFromPoint
CopyIcon
ChildWindowFromPointEx
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
SetForegroundWindow
DrawTextW
SetRect
MessageBoxA
FrameRect
MapDialogRect
GetCapture
DrawIconEx
SetFocus
IsWindow
DestroyWindow
ReleaseDC
GetAsyncKeyState
CreateDialogParamW
SetClassLongW
LoadCursorW
UnregisterClassA
BlockInput
RegisterClipboardFormatW
GetDC
RegisterClassW
EnumDisplaySettingsW
AttachThreadInput
EnumChildWindows
GetUpdateRgn
LoadBitmapW
SetWindowsHookExW
CallNextHookEx
ActivateKeyboardLayout
GetKeyboardLayout
SendInput
GetKeyboardState
VkKeyScanExW
UnhookWindowsHookEx
MapVirtualKeyW
ToUnicode
OpenDesktopW
SetThreadDesktop
CloseDesktop
LoadStringW
GetActiveWindow
CreatePopupMenu
AppendMenuW
InsertMenuW
InsertMenuItemW
DrawIcon
GetDlgItemTextW
GetKeyState
GetMessageW
TranslateAcceleratorW
IsIconic
GetWindowPlacement
SetWindowPlacement
GetNextDlgTabItem
SendMessageTimeoutW
LoadAcceleratorsW
DrawEdge
GetMessagePos
GetSystemMenu
GetClassInfoW
ShowWindow
IsMenu
CreateMenu
DestroyMenu
PostMessageW
GetWindowRect
InvalidateRect
IsWindowVisible
PtInRect
GetCursorPos
GetWindowLongW
CallWindowProcW
DefWindowProcW
MoveWindow
GetClientRect
ScreenToClient
InvalidateRgn
SetTimer
CreateDialogIndirectParamW
RegisterWindowMessageW
CreateAcceleratorTableW
GetFocus
KillTimer
SetCapture
ScrollWindowEx
SetParent
SetWindowContextHelpId
DestroyAcceleratorTable
IsChild
CharNextW
GetSysColor
GetCursor
UnionRect
DestroyCursor
SetActiveWindow
MonitorFromPoint
GetMenuItemCount
GetClassNameW
IntersectRect
RedrawWindow
MsgWaitForMultipleObjects
PostQuitMessage
TrackPopupMenuEx
AdjustWindowRectEx
GetMenu
DeleteMenu
DrawTextExW
DialogBoxParamW
MessageBoxW
MessageBeep
SetDlgItemTextW
IsWindowEnabled
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
OpenClipboard
GetClipboardViewer
SetClipboardViewer
ChangeClipboardChain
FindWindowW
GetForegroundWindow
PeekMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage
DispatchMessageW
PostThreadMessageW
GetWindowDC
EndDialog
LoadImageW
LoadIconW
MonitorFromRect
GetMonitorInfoW
AdjustWindowRect
GetSystemMetrics
FillRect
SetRectEmpty
ShowScrollBar
ClientToScreen
GetMenuState
IsDialogMessageW
GetDesktopWindow
GetDlgItem
EnableWindow
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetDlgCtrlID
GetSubMenu
LoadMenuW
CheckMenuRadioItem
GetMenuStringW
RemoveMenu
TrackMouseEvent
EqualRect
SetWindowRgn
GetParent
SetMenuItemInfoW
GetMenuItemInfoW
EnableMenuItem
CheckMenuItem
ReleaseCapture
CreateIconIndirect
SetCursor
SetCursorPos
EndPaint
BeginPaint
GetScrollInfo
SetScrollPos
UpdateWindow
SystemParametersInfoW
CreateWindowExW
RegisterClassExW
GetWindow
MapWindowPoints
SetWindowPos
DestroyIcon
OffsetRect
InflateRect
IsRectEmpty
CopyRect
GetClassInfoExW
SetScrollInfo

gdi32

CreatePolygonRgn
SetLayout
ExtTextOutW
GetObjectType
SetBkColor
SetTextColor
SetPixel
SetViewportOrgEx
SetBrushOrgEx
CreateCompatibleBitmap
BitBlt
SelectObject
CreateCompatibleDC
GetObjectW
CreatePalette
CombineRgn
SelectClipRgn
StretchBlt
SetStretchBltMode
CreateDIBSection
RealizePalette
SelectPalette
DeleteDC
GetDeviceCaps
DeleteObject
BeginPath
EndPath
StrokeAndFillPath
CreateRectRgnIndirect
RoundRect
CreateRoundRectRgn
PatBlt
SetBkMode
GetStockObject
GetTextExtentPoint32W
MoveToEx
LineTo
CreatePen
GetPixel
CreatePatternBrush
SetRectRgn
OffsetRgn
CreateSolidBrush
CreateFontIndirectW
Ellipse
Polygon
Rectangle
SetDIBColorTable
GetClipBox
GetViewportOrgEx
CreateFontW
TextOutW
SetWindowOrgEx
CreateBitmap
CreateRectRgn
GetCurrentObject
GetBitmapBits
GetBkMode
GetTextColor
GetRgnBox
GetTextMetricsW

comdlg32

CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW

advapi32

GetSidIdentifierAuthority
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegOpenKeyExW
LsaLookupNames
LsaFreeMemory
LsaClose
ConvertSidToStringSidW
LsaOpenPolicy
RegFlushKey
GetUserNameW
ImpersonateLoggedOnUser
AllocateAndInitializeSid
GetSecurityInfo
SetSecurityInfo
CreateProcessAsUserW
LookupAccountSidW
LookupAccountNameW
EqualSid
FreeSid
RegCreateKeyW
StartServiceW
CloseServiceHandle
SetEntriesInAclW
GetNamedSecurityInfoW
GetAce
DeleteAce
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RevertToSelf
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegCloseKey

shell32

DragQueryFileW
ExtractIconW
SHAppBarMessage
DragFinish
SHGetFileInfoW
SHGetSpecialFolderLocation
ExtractIconExW
ShellExecuteW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHGetMalloc
SHBrowseForFolderW
ord680
DragAcceptFiles
ord155
ShellExecuteExW
SHGetPathFromIDListW

ole32

ReleaseStgMedium
CoMarshalInterThreadInterfaceInStream
OleDuplicateData
CoTaskMemFree
CoTaskMemRealloc
OleUninitialize
OleInitialize
CoCreateGuid
CoGetInterfaceAndReleaseStream
DoDragDrop
CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
RevokeDragDrop
CoInitializeSecurity
RegisterDragDrop

oleaut32

VariantClear
VariantInit
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
OleCreatePropertyFrame

shlwapi

PathCompactPathW

comctl32

InitCommonControlsEx
ImageList_Draw
ImageList_GetIconSize
ImageList_DragLeave
ImageList_DragEnter
ImageList_DragMove
ImageList_EndDrag
ImageList_BeginDrag
ImageList_GetIcon
ImageList_SetBkColor
ImageList_Remove
ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon

ws2_32

shutdown
setsockopt
recv
closesocket
WSAGetLastError
inet_ntoa
gethostname
gethostbyname
ioctlsocket
htonl
ntohl
__WSAFDIsSet
getsockname
select
socket
WSAResetEvent
getpeername
ntohs
WSACreateEvent
htons
connect
getsockopt
sendto
send
WSACloseEvent
WSAWaitForMultipleEvents
WSAEventSelect
WSASetEvent
bind
recvfrom
accept
listen
WSASetLastError
WSARecv
WSARecvFrom
WSASend
WSASocketW
WSADuplicateSocketW
WSAAddressToStringA
inet_addr
WSACleanup
WSAStartup
getservbyport
getservbyname
gethostbyaddr

mpr

WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW

netapi32

NetApiBufferFree
NetUserGetInfo
NetWkstaGetInfo

setupapi

SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW

sensapi

IsNetworkAlive

wininet

InternetConnectW
HttpSendRequestA
InternetErrorDlg
InternetQueryOptionW
InternetGoOnlineA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetQueryDataAvailable
InternetReadFile
HttpQueryInfoW
InternetOpenW
InternetSetOptionW
InternetCloseHandle

imagehlp

ImageGetCertificateHeader
ImageGetCertificateData
ImageEnumerateCertificates

secur32

GetUserNameExW

crypt32

CertGetNameStringA
CertGetNameStringW
CertFreeCertificateContext
CryptVerifyMessageSignature

mswsock

GetAcceptExSockaddrs
AcceptEx

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 230KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 496KB - Virtual size: 496KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TeamViewer_Desktop.exe
.exe windows:5 windows x86 arch:x86

de8b218615d3a6d615cedf7273b2fb7b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a4:91:92:78:0e:23:15:f3:6b:d2:9f:42:28:ff:df:86:e1:38:aa:d4
Signer

Actual PE Digest

a4:91:92:78:0e:23:15:f3:6b:d2:9f:42:28:ff:df:86:e1:38:aa:d4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\QS_Release2008\TeamViewer_Desktop.pdb

Imports

kernel32

InterlockedDecrement
GetProcAddress
GetModuleHandleW
lstrcmpiW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
GetCurrentProcess
GetThreadTimes
SetEnvironmentVariableA
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetStringTypeA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FindResourceW
LoadLibraryExW
GetModuleFileNameW
SetProcessShutdownParameters
GetProcessShutdownParameters
GetCurrentProcessId
GetCommandLineW
SleepEx
GetExitCodeThread
SetWaitableTimer
PostQueuedCompletionStatus
InterlockedExchangeAdd
QueueUserAPC
CreateEventW
lstrcpyW
CreateWaitableTimerW
DeviceIoControl
CreateFileW
Sleep
DuplicateHandle
LocalFree
LocalAlloc
InterlockedIncrement
GetCurrentThread
CreateMutexA
TlsAlloc
FlushInstructionCache
RaiseException
InterlockedExchange
WaitForMultipleObjects
GetLastError
SetLastError
ReleaseSemaphore
CreateSemaphoreA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime
GetTickCount
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
GetModuleFileNameA
GetStdHandle
ExitProcess
CompareStringW
CompareStringA
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
GetDateFormatA
GetTimeFormatA
GetCurrentThreadId
SetEvent
WaitForSingleObject
GetStartupInfoA
GetCommandLineA
ExitThread
RtlUnwind
IsDebuggerPresent
UnhandledExceptionFilter
CreateWaitableTimerA
GetSystemInfo
AreFileApisANSI
GetModuleHandleA
LoadLibraryW
lstrlenW
FormatMessageA
HeapSize
HeapReAlloc
HeapAlloc
CreateEventA
GetProcessHeap
HeapFree
TlsFree
FileTimeToSystemTime
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
GetSystemDirectoryW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
QueryPerformanceFrequency
QueryPerformanceCounter
SetThreadAffinityMask
GetVersionExW
FormatMessageW
WideCharToMultiByte
GetLocalTime
GetFileSize
WriteFile
SetFilePointer
ReleaseMutex
CreateMutexW
CreateDirectoryW
OpenProcess
TerminateProcess
ReadFile
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
OpenEventA
ResetEvent
CreateIoCompletionPort
TerminateThread
GetQueuedCompletionStatus
InterlockedCompareExchange
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetLocaleInfoA
GetUserDefaultLCID
GetSystemDefaultLCID
SystemTimeToFileTime
GlobalUnlock
GlobalLock
SetFileAttributesW
GetFileAttributesW
ResumeThread
CreateThread
LockResource
FindResourceExW
GetSystemTime
WaitForMultipleObjectsEx
CancelIo
GetOverlappedResult
ReadFileEx
SetEndOfFile
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapDestroy
CloseHandle

user32

GetWindowThreadProcessId
CopyRect
IsRectEmpty
PtInRect
SetRectEmpty
InflateRect
OffsetRect
IntersectRect
EqualRect
SystemParametersInfoW
GetClassNameW
IsWindow
GetForegroundWindow
GetWindowRect
SendMessageW
EnumWindows
SetWindowPos
FindWindowW
FindWindowExW
SetWindowsHookExW
UnhookWindowsHookEx
GetCursorInfo
GetIconInfo
DrawTextW
GetDC
GetSystemMetrics
GetWindowRgn
IsWindowEnabled
WindowFromPoint
GetDesktopWindow
CallNextHookEx
GetWindow
ReleaseDC
GetWindowDC
LoadStringW
OpenInputDesktop
SetThreadDesktop
ExitWindowsEx
ChangeDisplaySettingsExW
EnumDisplaySettingsW
ScreenToClient
FillRect
GetDlgItem
LoadBitmapW
GetAsyncKeyState
LoadImageW
ToUnicode
DestroyWindow
VkKeyScanExW
GetKeyboardState
GetKeyState
GetKeyboardLayout
ActivateKeyboardLayout
RegisterClipboardFormatW
UnregisterClassA
MapWindowPoints
UnionRect
RedrawWindow
GetCursorPos
MapVirtualKeyW
GetGUIThreadInfo
GetParent
GetWindowLongW
CallWindowProcW
DefWindowProcW
GetClientRect
SetLayeredWindowAttributes
MsgWaitForMultipleObjectsEx
GetUserObjectInformationW
GetThreadDesktop
BlockInput
KillTimer
SetTimer
OpenDesktopW
EnumDesktopWindows
CloseDesktop
PostThreadMessageW
IsWindowVisible
PostMessageW
SendInput
SendNotifyMessageW
MessageBoxA
PostQuitMessage
MessageBoxW
CreateDialogParamW
CreateWindowExW
RegisterClassExW
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadCursorW
GetClassInfoExW
SetWindowLongW

gdi32

SelectObject
SetBkMode
GetSystemPaletteEntries
GetDIBits
GetDeviceCaps
StretchBlt
CreateCompatibleDC
GetObjectW
RectInRegion
CreateRectRgnIndirect
CreateDIBSection
SetPixel
CreateDCW
DeleteDC
GetDCOrgEx
BitBlt
PtInRegion
GetRgnBox
OffsetRgn
SetRectRgn
Rectangle
SelectClipRgn
CreateCompatibleBitmap
DeleteObject
GetRegionData
CombineRgn
CreateRectRgn
GetStockObject
RoundRect
CreatePatternBrush
CreateFontIndirectW
CreatePen
GetTextExtentPoint32W
ExtCreateRegion
GdiFlush
SetBkColor
CreateSolidBrush
TextOutW

advapi32

GetSidIdentifierAuthority
StartServiceW
CloseServiceHandle
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenCurrentUser
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
GetUserNameW
RevertToSelf
FreeSid
EqualSid
LookupAccountNameW
LookupAccountSidW
SetSecurityInfo
SetEntriesInAclW
GetSecurityInfo
AllocateAndInitializeSid
SetNamedSecurityInfoW
GetNamedSecurityInfoW
ImpersonateLoggedOnUser
RegCreateKeyW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegFlushKey

ole32

OleInitialize
CoGetInterfaceAndReleaseStream
ReleaseStgMedium
CoInitializeSecurity
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
OleUninitialize

oleaut32

SafeArrayGetElement
VariantClear
VariantChangeType
VariantCopy
VariantInit
SafeArrayGetDim
SysFreeString
SysAllocString
VarUI4FromStr

comctl32

ImageList_Draw
InitCommonControlsEx

ws2_32

inet_ntoa
WSAGetLastError
inet_addr
closesocket
setsockopt
shutdown
ioctlsocket
gethostname
gethostbyname
WSACleanup
WSAAddressToStringA
select
WSASocketW
WSASend
WSARecv
listen
htonl
getsockname
WSASetLastError
ntohl
htons
__WSAFDIsSet
accept
bind
connect
getsockopt
WSAStartup

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

imagehlp

ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData

crypt32

CertFreeCertificateContext
CertGetNameStringA
CertGetNameStringW
CryptVerifyMessageSignature

shell32

ShellExecuteW
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHGetFileInfoW

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 406KB - Virtual size: 406KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 203KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TeamViewer_Resource_en.dll
.dll windows:5 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:77:04:8b:01:12:9c:01:6e:24:7c:5d:94:32:e1:ba:10:69:f7:c2
Signer

Actual PE Digest

56:77:04:8b:01:12:9c:01:6e:24:7c:5d:94:32:e1:ba:10:69:f7:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TeamViewer_Service.exe
.exe windows:5 windows x86 arch:x86

3d195209ce847960d828e89eb51485a4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b4:f9:fc:9e:9e:5f:b7:63:7d:16:92:ce:d8:93:b9:ea:82:90:9a:3f
Signer

Actual PE Digest

b4:f9:fc:9e:9e:5f:b7:63:7d:16:92:ce:d8:93:b9:ea:82:90:9a:3f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\QS_Release2008\TeamViewer_Service.pdb

Imports

kernel32

GetDriveTypeA
FindFirstFileA
GetFullPathNameA
GetCurrentDirectoryA
TlsAlloc
InterlockedExchangeAdd
PostQueuedCompletionStatus
TlsFree
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
GetModuleFileNameW
lstrcmpiW
GetThreadTimes
GetSystemDirectoryA
GetVersionExA
ExpandEnvironmentStringsA
lstrlenA
SetEnvironmentVariableA
CreateFileA
SetStdHandle
WriteConsoleW
WriteConsoleA
GetLocaleInfoW
LoadLibraryA
IsValidLocale
EnumSystemLocalesA
GetStringTypeA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetTimeZoneInformation
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
HeapSize
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
GetExitCodeThread
GetPrivateProfileStringW
WritePrivateProfileStringW
GetConsoleOutputCP
GetPrivateProfileIntW
GetModuleFileNameA
GetStdHandle
CompareStringW
CompareStringA
SetConsoleCtrlHandler
SetLastError
GetLastError
Sleep
GetCurrentThreadId
FileTimeToSystemTime
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
GetSystemDirectoryW
FreeLibrary
CloseHandle
CreateFileW
GetProcAddress
LoadLibraryW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
GetCurrentProcess
GetCurrentProcessId
GetSystemTimeAsFileTime
ReleaseSemaphore
WaitForSingleObject
CreateEventA
CreateSemaphoreA
DuplicateHandle
SetEvent
GetTickCount
GetFileSize
SleepEx
InitializeCriticalSection
DeleteCriticalSection
SetWaitableTimer
WriteFile
SetFilePointer
ReleaseMutex
CreateMutexW
CreateDirectoryW
MoveFileW
CreateEventW
CreateWaitableTimerW
LocalFree
OpenProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentThread
SetThreadAffinityMask
GetVersionExW
FormatMessageW
WideCharToMultiByte
GetLocalTime
MultiByteToWideChar
GetVolumeInformationW
WaitNamedPipeW
TerminateProcess
ReadFile
CreateProcessW
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
HeapFree
GetProcessHeap
TlsGetValue
TlsSetValue
OpenEventA
ResetEvent
HeapAlloc
CreateIoCompletionPort
QueueUserAPC
TerminateThread
GetQueuedCompletionStatus
InterlockedCompareExchange
GetLocaleInfoA
GetUserDefaultLCID
GetSystemDefaultLCID
SystemTimeToFileTime
RaiseException
lstrlenW
GetModuleHandleW
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
DeviceIoControl
ResumeThread
CreateThread
SetThreadPriority
GetOverlappedResult
FormatMessageA
SetEndOfFile
GetFileAttributesW
SetFileAttributesW
GetModuleHandleA
AreFileApisANSI
CreateWaitableTimerA
RtlUnwind
UnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetTimeFormatA
GetDateFormatA
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeW

user32

MessageBoxW
GetMessageW
TranslateMessage
DispatchMessageW
MessageBoxA
PostThreadMessageW
CharNextW
DestroyWindow
SendMessageW
FindWindowW
PeekMessageW
MsgWaitForMultipleObjectsEx
ExitWindowsEx

advapi32

DeleteService
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RevertToSelf
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetNamedSecurityInfoW
DeleteAce
GetAce
GetNamedSecurityInfoW
SetEntriesInAclW
CloseServiceHandle
StartServiceW
QueryServiceStatus
ControlService
CreateProcessAsUserW
FreeSid
EqualSid
LookupAccountSidW
RegCloseKey
RegCreateKeyExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
LsaLookupNames
LsaFreeMemory
LsaClose
ConvertSidToStringSidW
LsaOpenPolicy
GetUserNameW
RegFlushKey
ImpersonateLoggedOnUser
AllocateAndInitializeSid
GetSecurityInfo
SetSecurityInfo
RegCreateKeyW

ole32

CoInitializeSecurity
CoTaskMemAlloc
StringFromGUID2
OleInitialize
OleUninitialize
CoTaskMemRealloc
CoCreateInstance
CoCreateGuid
CoTaskMemFree

oleaut32

VariantClear
SysFreeString
SysAllocString
VarUI4FromStr

ws2_32

socket
htonl
select
getsockname
__WSAFDIsSet
ntohl
ioctlsocket
shutdown
setsockopt
WSAResetEvent
closesocket
inet_addr
WSAGetLastError
inet_ntoa
gethostname
gethostbyname
WSACleanup
WSAStartup
WSADuplicateSocketW
getpeername
ntohs
WSACreateEvent
htons
connect
getsockopt
sendto
send
WSACloseEvent
WSAWaitForMultipleEvents
WSAEventSelect
WSASetEvent
bind
recvfrom
accept
WSASetLastError
listen
WSARecv
WSARecvFrom
recv
WSASocketW
WSASend
gethostbyaddr
getservbyname
getservbyport

mpr

WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW

netapi32

NetApiBufferFree
NetWkstaGetInfo

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey

sensapi

IsNetworkAlive

wininet

HttpSendRequestA
InternetErrorDlg
InternetQueryOptionW
InternetGoOnlineA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetQueryDataAvailable
InternetReadFile
HttpQueryInfoW
InternetOpenW
InternetSetOptionW
InternetCloseHandle
InternetConnectW

iphlpapi

DeleteIPAddress
GetAdapterIndex
GetAdaptersInfo
SendARP

imagehlp

ImageGetCertificateHeader
ImageGetCertificateData
ImageEnumerateCertificates

crypt32

CertGetNameStringA
CertGetNameStringW
CryptVerifyMessageSignature
CertFreeCertificateContext

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetMalloc
ShellExecuteW

mswsock

AcceptEx
GetAcceptExSockaddrs

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 516KB - Virtual size: 515KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TeamViewer_StaticRes.dll
.dll windows:5 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:36:70:b8:2d:27:68:f8:47:b9:d3:0e:d3:45:af:31:c5:e7:6e:b3
Signer

Actual PE Digest

44:36:70:b8:2d:27:68:f8:47:b9:d3:0e:d3:45:af:31:c5:e7:6e:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
tv_w32.dll
.dll windows:5 windows x86 arch:x86

2ca28be43421dd21ac4263087f72f259

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6a:89:40:b1:10:2a:ee:6c:80:ed:9d:89:68:a0:a5:f4:6a:33:f9:28
Signer

Actual PE Digest

6a:89:40:b1:10:2a:ee:6c:80:ed:9d:89:68:a0:a5:f4:6a:33:f9:28

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_w32dll.pdb

Imports

crtdll

strncat
strncpy
_vsnprintf
_snprintf
_strlwr
strrchr
memmove
memcpy
wcsstr
_wcslwr
_global_unwind2
_local_unwind2
_initterm
malloc
__dllonexit
strncmp
memset

comctl32

InitCommonControlsEx

kernel32

GetFileAttributesExW
HeapAlloc
GlobalLock
DeleteCriticalSection
GetProcAddress
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
GetLocalTime
InterlockedCompareExchange
GlobalUnlock
DisableThreadLibraryCalls
OpenMutexW
GetModuleFileNameA
FreeLibraryAndExitThread
Sleep
LoadLibraryW
GetModuleFileNameW
CreateThread
LocalFree
CreateMutexW
CreateEventW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
SetEvent
GetTickCount
IsBadWritePtr
IsBadReadPtr
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
LocalAlloc
SetLastError
GlobalFree
GlobalAlloc
GetVersion
QueryPerformanceCounter
GetVersionExW
VirtualProtect
ResumeThread
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateToolhelp32Snapshot
Thread32First
OpenThread
SuspendThread
Thread32Next
CloseHandle
GetProcessHeap
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSection
FileTimeToSystemTime
InterlockedExchange

user32

GetWindow
GetWindowLongW
GetSysColor
LoadBitmapW
GetSystemMetrics
SystemParametersInfoW
SendMessageW
GetClientRect
IsZoomed
GetWindowInfo
GetClassNameA
IsRectEmpty
CallWindowProcW
RedrawWindow
MoveWindow
IsIconic
PostMessageW
TrackMouseEvent
InvalidateRect
EndPaint
BeginPaint
GetActiveWindow
SetWindowLongW
FindWindowExW
FindWindowW
ShowWindow
GetDesktopWindow
ClientToScreen
GetDC
GetUpdateRect
GetWindowRect
ReleaseDC
IsWindow
IsWindowVisible
SetWindowPos
GetClassInfoExW
LoadCursorW
RegisterClassExW
CallNextHookEx
DestroyWindow
DefWindowProcW
KillTimer
SetTimer
RegisterClipboardFormatW
CreateWindowExW
UnregisterClassW
SendMessageTimeoutW
UnhookWindowsHookEx
SendNotifyMessageW
SetWindowsHookExW
RegisterWindowMessageW
MapWindowPoints
GetWindowDC

gdi32

DeleteObject
GdiFlush
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
Rectangle
GetStockObject
CreatePen
Polyline
ExtCreatePen
LineTo
MoveToEx
CreateSolidBrush
CreateCompatibleBitmap
GetObjectW
SetPixel
GetPixel
RectVisible
DeleteDC

shell32

DragQueryFileW

ole32

ReleaseStgMedium
CoCreateInstance

Exports

Exports

GetLoaderInterface
GetTeamViewerInterface

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tv_w32.exe
.exe windows:5 windows x86 arch:x86

50a1bd551f06f6cf63b0687e32d02be5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:81:5e:d3:20:a0:c9:c5:82:28:5b:8d:ac:7a:3a:16:9c:34:75:f9
Signer

Actual PE Digest

48:81:5e:d3:20:a0:c9:c5:82:28:5b:8d:ac:7a:3a:16:9c:34:75:f9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_w32exe.pdb

Imports

kernel32

SetEvent
GetVersionExW
GetLastError
CreateEventW
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
Sleep
GetSystemDirectoryW
LoadLibraryW
GetTickCount
OpenMutexA
CreateMutexW
SetFilePointer
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId
GetCommandLineW
GetCurrentProcess
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
GetCommandLineA
GetStartupInfoA
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringW
HeapFree
HeapAlloc
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
WriteConsoleA
VirtualQuery

user32

PeekMessageW
DispatchMessageW
SendInput
BlockInput
MsgWaitForMultipleObjectsEx
TranslateMessage

shell32

ShellExecuteExW

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tv_x64.dll
.dll windows:5 windows x64 arch:x64

4ddc3c35228a7a7ce89029d91ef1da7b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fd:89:4f:3d:28:df:8d:df:4b:58:03:69:de:20:5f:fe:c1:d6:9a:a9
Signer

Actual PE Digest

fd:89:4f:3d:28:df:8d:df:4b:58:03:69:de:20:5f:fe:c1:d6:9a:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_x64dll.pdb

Imports

msvcrt

_onexit
__dllonexit
realloc
calloc
malloc
free
_initterm
_wcslwr
wcsstr
strncmp
memmove
__C_specific_handler
strrchr
_strlwr
_snprintf
_vsnprintf
strncpy
strncat
memcpy
memset

comctl32

InitCommonControlsEx

kernel32

FileTimeToSystemTime
InitializeCriticalSection
GetLastError
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetProcessHeap
CloseHandle
Thread32Next
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
ResumeThread
VirtualProtect
GetVersionExW
QueryPerformanceCounter
GlobalUnlock
GetFileAttributesExW
HeapAlloc
GlobalLock
DeleteCriticalSection
GetProcAddress
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
GetLocalTime
DisableThreadLibraryCalls
OpenMutexW
GetModuleFileNameA
FreeLibraryAndExitThread
Sleep
LoadLibraryW
GetModuleFileNameW
CreateThread
LocalFree
CreateMutexW
CreateEventW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
SetEvent
GetTickCount
IsBadWritePtr
IsBadReadPtr
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
LocalAlloc
SetLastError

user32

SendNotifyMessageW
UnhookWindowsHookEx
SendMessageTimeoutW
UnregisterClassW
CreateWindowExW
RegisterClipboardFormatW
SetTimer
KillTimer
DefWindowProcW
DestroyWindow
CallNextHookEx
RegisterClassExW
LoadCursorW
GetClassInfoExW
SetWindowPos
IsWindowVisible
IsWindow
ReleaseDC
GetWindowRect
GetWindowDC
ShowWindow
GetWindow
GetWindowLongPtrW
GetSysColor
LoadBitmapW
GetSystemMetrics
SystemParametersInfoW
SendMessageW
GetClientRect
IsZoomed
GetWindowInfo
GetClassNameA
IsRectEmpty
CallWindowProcW
RedrawWindow
MoveWindow
IsIconic
PostMessageW
TrackMouseEvent
InvalidateRect
GetActiveWindow
SetWindowLongPtrW
EndPaint
BeginPaint
FindWindowExW
FindWindowW
MapWindowPoints
GetDesktopWindow
ClientToScreen
GetDC
GetUpdateRect
RegisterWindowMessageW
SetWindowsHookExW

gdi32

RectVisible
GetPixel
SetPixel
GetObjectW
CreateCompatibleBitmap
CreateSolidBrush
MoveToEx
LineTo
DeleteObject
Polyline
CreatePen
GetStockObject
Rectangle
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt
GdiFlush
ExtCreatePen
DeleteDC

shell32

DragQueryFileW

ole32

ReleaseStgMedium
CoCreateInstance

Exports

Exports

GetLoaderInterface

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shared
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 306B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tv_x64.exe
.exe windows:5 windows x64 arch:x64

2c5c62562658e3dcbc628c79afc9f4a7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ea:15:51:b4:e5:dd:90:69:6b:01:68:36:9a:fe:8f:0b:35:30:fa:44
Signer

Actual PE Digest

ea:15:51:b4:e5:dd:90:69:6b:01:68:36:9a:fe:8f:0b:35:30:fa:44

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_x64exe.pdb

Imports

kernel32

SetEvent
GetVersionExW
GetLastError
CreateEventW
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
Sleep
GetSystemDirectoryW
LoadLibraryW
GetTickCount
OpenMutexA
CreateMutexW
SetFilePointer
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId
GetCommandLineW
GetCurrentProcess
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
GetCommandLineA
GetStartupInfoA
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
FlsAlloc
LCMapStringW
HeapFree
HeapAlloc
GetModuleHandleW
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
InitializeCriticalSectionAndSpinCount
HeapReAlloc

user32

PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage

shell32

ShellExecuteExW

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/TVMonitor.inf
x64/TVMonitor.sys
.sys windows:6 windows x64 arch:x64

f24b69173de020aa0ac1739d7b40e04c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3b
Signer

Actual PE Digest

28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

j:\teamviewer6.0\monitordriver\objfre_wlh_amd64\amd64\TVMonitor.pdb

Imports

ntoskrnl.exe

IoAcquireRemoveLockEx
KeClearEvent
IoDeleteSymbolicLink
_snwprintf
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoReleaseRemoveLockEx
IoDetachDevice
PoRequestPowerIrp
KeSetTimerEx
PsCreateSystemThread
PsTerminateSystemThread
PoStartNextPowerIrp
ZwClose
IofCompleteRequest
IoReleaseRemoveLockAndWaitEx
ObReferenceObjectByHandle
KeWaitForSingleObject
IoGetAttachedDeviceReference
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateSymbolicLink
ObfDereferenceObject
IoInitializeRemoveLockEx
IoCreateDevice
KeInitializeTimerEx
KeCancelTimer
KeWaitForMultipleObjects
IofCallDriver
KeBugCheckEx

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/tvmonitor.cat
x86/TVMonitor.inf
x86/TVMonitor.sys
.sys windows:6 windows x86 arch:x86

bc06eb1dad5e8285411e580cdee99e10

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83
Signer

Actual PE Digest

a9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

j:\teamviewer6.0\monitordriver\objfre_wxp_x86\i386\TVMonitor.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
_snwprintf
IofCompleteRequest
IoReleaseRemoveLockEx
PoCallDriver
IoAcquireRemoveLockEx
PoStartNextPowerIrp
IofCallDriver
ObfDereferenceObject
IoGetAttachedDeviceReference
IoDeleteDevice
IoDetachDevice
KeWaitForSingleObject
KeSetEvent
PoRequestPowerIrp
IoAttachDeviceToDeviceStack
IoDeleteSymbolicLink
IoInitializeRemoveLockEx
IoCreateSymbolicLink
IoCreateDevice
InterlockedIncrement
IoReleaseRemoveLockAndWaitEx
PsTerminateSystemThread
KeCancelTimer
KeWaitForMultipleObjects
KeSetTimerEx
KeClearEvent
KeInitializeTimerEx
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
KeTickCount
KeBugCheckEx
KeInitializeEvent
KeGetCurrentThread

hal

KeGetCurrentIrql

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 277B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 384B - Virtual size: 274B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/tvmonitor.cat
out.upx
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

0d:d3:04:f2:29:90:41:f1:f8:24:72:0a:88:d0:91:93:1a:aa:ab:7cSigner

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 200KB

UPX1 Size: 17KB - Virtual size: 20KB

.rsrc Size: 25KB - Virtual size: 28KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

d29e408dd9048e10d5936c6f2bfca832

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 42KB - Virtual size: 42KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 176B

.reloc Size: 5KB - Virtual size: 5KB

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 1024B - Virtual size: 520B

7f27fb2f8604769e3f1416e79e2b660f

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

0d:d3:04:f2:29:90:41:f1:f8:24:72:0a:88:d0:91:93:1a:aa:ab:7c
Signer

UPX0
Size: - Virtual size: 200KB

UPX1
Size: 17KB - Virtual size: 20KB

.rsrc
Size: 25KB - Virtual size: 28KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 42KB - Virtual size: 42KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 32KB - Virtual size: 32KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 3KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 129KB - Virtual size: 129KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 6KB - Virtual size: 22KB

.rsrc
Size: 1024B - Virtual size: 840B

.reloc
Size: 12KB - Virtual size: 11KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

5f:6b:a0:a7:2c:77:b0:39:d3:df:43:2d:b9:4a:f4:fb:ba:26:ef:c0
Signer

.text
Size: 4.2MB - Virtual size: 4.2MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB