TVQS_es[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
TVQS_es.exe
Size 3.0MB
Sample260627-pegmgsav2t
SHA256 e602ef45c100fdf7548fb3a86c100a00351985680672bef8c53f15165a236bc0
MD5 de047c41c166bdae1a845e68c0386d94
SHA1 faaf0b24798e78093ac4dba44b2d4d11164a70b9
SHA512 faa48f4a7b6b82ea4b2be59f408715c4c70ec9cda23268a5f1e76943dc8db97518a44c5d2303b4dbbf8ed13ac7d11a3975fec574b60e31c1c5490faf20d04e6c
SSDEEP 49152:IxDns8+OKHUmn3eKN2AfeRdBqr2Xwafj65mohBvZXKKdtCEZQbpQWuuYXu:g6uK0ChaXBj6r60dptXu
TLSH
T1DEE533F346366CDAC8494A75B1E1C23A27B4009C1DCEEA8FA4C83B2758FDF621616DD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx installer

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/TvGetVersion.dll
unpack001/$PLUGINSDIR/nsis7z.dll
unpack001/out.upx

Untrusted Codesign Signers 12 IoCs

Codesigned file was signed by an untrusted entity.

resource
TVQS_es.exe
unpack002/TeamViewer.exe
unpack002/TeamViewer_Desktop.exe
unpack002/TeamViewer_Resource_es.dll
unpack002/TeamViewer_Service.exe
unpack002/TeamViewer_StaticRes.dll
unpack002/tv_w32.dll
unpack002/tv_w32.exe
unpack002/tv_x64.dll
unpack002/tv_x64.exe
unpack003/x64/TVMonitor.sy_
unpack004/x86/TVMonitor.sy_

NSIS installer 1 IoCs

installer

resource	yara_rule
static1/unpack001/out.upx	nsis_installer_2

File Explorer

TVQS_es.exe

.exe 3.0MB
$PLUGINSDIR/InstallOptions.dll

.dll 14KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/TvGetVersion.dll

.dll 130KB
$PLUGINSDIR/nsis7z.dll

.dll 176KB
$PLUGINSDIR/wincheck.ini

185B
$_2_/tvqsfiles.7z

.7z 2.7MB
TeamViewer.exe

.exe 6.4MB
TeamViewer_Desktop.exe

.exe 2.2MB
TeamViewer_Resource_es.dll

.dll 252KB
TeamViewer_Service.exe

.exe 2.6MB
TeamViewer_StaticRes.dll

.dll 2.4MB
tv_w32.dll

.dll 65KB
tv_w32.exe

.exe 103KB
tv_x64.dll

.dll 78KB
tv_x64.exe

.exe 126KB
$_2_/tvqsfilesx64.7z

.7z 9KB
x64/TVMonitor.inf

1KB
x64/TVMonitor.sy_

.sys 15KB
x64/tvmonitor.cat

7KB
$_2_/tvqsfilesx86.7z

.7z 8KB
x86/TVMonitor.inf

1KB
x86/TVMonitor.sy_

.sys 12KB
x86/tvmonitor.cat

7KB
out.upx

.exe 55KB

TVQS_es.exe

SHA256 e602ef45c100fdf7548fb3a86c100a00351985680672bef8c53f15165a236bc0
MD5 de047c41c166bdae1a845e68c0386d94
SHA1 faaf0b24798e78093ac4dba44b2d4d11164a70b9
SHA512 faa48f4a7b6b82ea4b2be59f408715c4c70ec9cda23268a5f1e76943dc8db97518a44c5d2303b4dbbf8ed13ac7d11a3975fec574b60e31c1c5490faf20d04e6c
SSDEEP 49152:IxDns8+OKHUmn3eKN2AfeRdBqr2Xwafj65mohBvZXKKdtCEZQbpQWuuYXu:g6uK0ChaXBj6r60dptXu
TLSH
T1DEE533F346366CDAC8494A75B1E1C23A27B4009C1DCEEA8FA4C83B2758FDF621616DD5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

59:38:96:ef:72:01:ff:5b:c9:f5:d1:0d:9b:68:6b:0c:a2:46:84:97

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Chains

Aug 31, 2012

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Serial Number

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2011 - Aug 7, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

226224

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
TLSH
T172622A11778888F3DB92013EB4533707AF9D5126B4929ED2CA271FC66D2B09D3EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T113325B5993A0C1F3D5A0823C0DA73A7B1379722016B14FA3CFA35841AE196D7AC7D237
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/TvGetVersion.dll

IMPHASH 88d67657017b9d8004b8a2d8a16f30a6
SHA256 681cb2b67e87915f37b6f716d53626b939d534c0c3e5e9810ad025760c798270
MD5 b7641fc2d6eb0b3d81347d4936ced0bd
SHA1 f05955337fbb1dd1974021927a8c07fefae6637b
SHA512 f7f006a7855beaaecd0159b7e4bc2d2cd6d8b1bceb1f1f2b4e73382d34aa07cbf9c3cfadd882fe79c6b971143b04fb02410ede77c7c89b429068207d3d7ddb0a
SSDEEP 1536:xP/WJk7hV2vFFL4o3Ua8MoaRXICZVI8UE3ySYENseC4rtYfB5H83ir:AxKoUx8UuyveCutYjH83i
TLSH
T15BD39D2776D1C072C2E6403E6844DB3597FBA8319DB84943F7914FDA3EA46D4AB3A207
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31173

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

SHDeleteKeyA SHCopyKeyA

kernel32

LocalFree InterlockedDecrement GetModuleFileNameA RtlUnwind CreateDirectoryA FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA MoveFileA DeleteFileA GetCurrentThreadId GetCommandLineA HeapFree HeapAlloc GetProcessHeap GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetFullPathNameA GetCurrentDirectoryA ExitProcess GetVersionExA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA Sleep GetLocaleInfoA HeapSize VirtualAlloc HeapReAlloc WriteFile SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers InitializeCriticalSection SetFilePointer GetTimeZoneInformation LoadLibraryA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile CompareStringA CompareStringW SetEnvironmentVariableA lstrcpynA lstrcpyA lstrlenA lstrcatA GetDriveTypeA CreateFileA GetFileSize GlobalAlloc ReadFile CloseHandle GlobalFree GetLastError GetCurrentProcessId GetModuleHandleA GetProcAddress lstrcmpiA FreeEnvironmentStringsA GetStringTypeW

user32

GetSystemMetrics wsprintfA SendMessageA

winspool.drv

EnumPrintProcessorsA EnumPrinterDriversA

advapi32

RegEnumValueA RegCreateKeyExA RegDeleteValueA LookupAccountNameA ConvertSidToStringSidA DeleteService ControlService StartServiceA OpenSCManagerA OpenServiceA CloseServiceHandle QueryServiceStatus RegCloseKey RegEnumKeyExA RegOpenKeyExA RegFlushKey RegSetValueExA RegQueryValueExA GetUserNameA

shell32

ShellExecuteA SHFileOperationA

ole32

CoUninitialize CLSIDFromString CLSIDFromProgID CoCreateInstance OleRun CoInitialize

oleaut32

VariantClear SysAllocString GetErrorInfo SysFreeString

$PLUGINSDIR/nsis7z.dll

IMPHASH b22ed27c346f001ed1b4410c1073cfa9
SHA256 0dedad042a306da32784c3ce79bfac0475b827e416c17e1a1dfdb461151f4271
MD5 06ff2b95b8e123d32487b0cb73409031
SHA1 8cb3f584112db4e74cea4ed02d4ce0b3a5373bfa
SHA512 174e7599ba87bc45111ce340d7563771353df71988d6b9094d8bdeab4b45ec730cbd2e6bf3943ad66daa02d7f1f1eac0020b987109fabed96b2e0def8d0602c6
SSDEEP 3072:rfSCQ4FYoKhEHvf4aytolZ8MMNjXtWXTkibb7zHetRYFJ8:HFYosEH3UtoX8fUtXPOm
TLSH
T1EA048D2236E0C07AE31F0332CD17AB6172AAF6508F61D54B3F894F4D5F726999E29706
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

97681

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError WideCharToMultiByte MultiByteToWideChar GetTickCount LoadLibraryA GetModuleFileNameA RemoveDirectoryW MoveFileA MoveFileW CreateDirectoryA CreateDirectoryW DeleteFileA DeleteFileW GetFullPathNameA GetFullPathNameW GetCurrentThreadId GetCurrentProcessId SetLastError CreateFileW SetFileTime CloseHandle SetFileAttributesA SetFileAttributesW RemoveDirectoryA FindClose FindFirstFileA FindFirstFileW CreateFileA GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile GetProcAddress GetCurrentProcess GetSystemInfo GetModuleHandleA GetStdHandle EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects DeleteCriticalSection AreFileApisANSI VirtualFree VirtualAlloc GetVersionExA ResetEvent WaitForSingleObject SetEvent InitializeCriticalSection CreateEventA SetFileApisToOEM SetFileApisToANSI GlobalFree lstrcpyA lstrcpynA GlobalAlloc RaiseException LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetLocaleInfoA WriteConsoleW GetConsoleOutputCP WriteConsoleA HeapAlloc HeapFree HeapReAlloc ExitThread CreateThread GetCommandLineA GetProcessHeap HeapDestroy HeapCreate ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA Sleep HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind GetConsoleCP GetConsoleMode FlushFileBuffers FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage SetStdHandle VirtualQuery

user32

CharUpperW CharUpperA GetDlgItem FindWindowExA SetWindowTextA wsprintfA SendMessageA

oleaut32

VariantCopy VariantClear SysAllocString

TeamViewer.exe

IMPHASH 06ff1b63b833db0a9e6fcdb280057163
SHA256 0f7734f333279350dc9e20ebba61cf02b5b26378bf394e7c2c0701d4404274ab
MD5 3d9249683e9ad9b96984d6acdac3c996
SHA1 1407707328e6b39c1c014049273003a8876db881
SHA512 22a186dc99b173047de2658cd277b5ba6322d0bf296c47abef345680539c7a50b1f4aa3666069eb2144073cd2c5cb612aee143effb2eb7073d76f29252927d9d
SSDEEP 98304:J9ic67DbYGESMDAsbfqh4ebfbaMgxD1eyrTx26Abq4rMbNeTtTaE4bfho+Md14nU:JItSDA7iebBgfCqzAJX22SiD
TLSH
T177669D317AE6C47ED6B313B1582DA39955F6B9708E70855B72A4872E3B74E839030F32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fb:d0:e1:c6:cf:e6:ea:c3:5b:06:dc:e2:e4:45:f9:49:b5:c1:c6:1a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Chains

Aug 31, 2012

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Serial Number

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2011 - Aug 7, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

3441808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\TeamViewer_7.0_Release\TeamViewer\QS_Release2008\TeamViewer.pdb

avicap32

capGetDriverDescriptionW

msvfw32

DrawDibOpen DrawDibDraw DrawDibClose

winmm

waveOutGetNumDevs waveOutUnprepareHeader waveInClose waveInReset waveInStart waveOutOpen waveOutPrepareHeader waveOutWrite waveInUnprepareHeader waveInAddBuffer waveInPrepareHeader waveInOpen timeEndPeriod timeBeginPeriod mixerSetControlDetails mixerGetControlDetailsW mixerClose mixerGetLineControlsW mixerGetLineInfoW mixerGetID waveOutGetDevCapsW waveInGetDevCapsW mixerGetDevCapsW mixerOpen waveInGetNumDevs waveOutClose waveOutReset waveOutRestart waveOutPause

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

CompareFileTime CompareStringW GetVolumeInformationW GetDriveTypeW lstrcpyW FindFirstFileW GetFullPathNameW GetThreadTimes GetSystemDirectoryA ExpandEnvironmentStringsA SetEnvironmentVariableA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA FlushFileBuffers GetConsoleMode GetConsoleCP GetFileType SetHandleCount GetStringTypeA IsValidCodePage GetOEMCP GetACP GetTimeZoneInformation HeapCreate GetModuleFileNameA GetStdHandle CompareStringA GetStringTypeW LCMapStringW LCMapStringA GetDateFormatA GetTimeFormatA ExitProcess GetStartupInfoA GetCommandLineA ExitThread GetCPInfo IsDebuggerPresent UnhandledExceptionFilter RtlUnwind CreateWaitableTimerA CreateFileMappingA MapViewOfFileEx CreateFileA UnmapViewOfFile FindClose GetModuleHandleA GetFileTime GetFileInformationByHandle RaiseException FormatMessageA GetLocaleInfoA HeapSize HeapReAlloc HeapDestroy IsProcessorFeaturePresent LoadLibraryA lstrlenA GetComputerNameW SetFileAttributesW SetEndOfFile ReadFileEx GetOverlappedResult CancelIo WaitForMultipleObjectsEx GetFileAttributesExW SetFileTime GetCurrentDirectoryW LocalFileTimeToFileTime GetFileAttributesW GlobalSize GetSystemTime WaitForSingleObjectEx GetLogicalDriveStringsW DeviceIoControl GetDateFormatW SystemTimeToTzSpecificLocalTime GetTempPathW SystemTimeToFileTime GetSystemDefaultUILanguage GetUserDefaultUILanguage MoveFileExW CreateProcessW TerminateProcess WaitNamedPipeW ProcessIdToSessionId GetPrivateProfileIntW InterlockedCompareExchange GetQueuedCompletionStatus TerminateThread QueueUserAPC CreateIoCompletionPort OpenEventA TlsSetValue TlsGetValue InitializeCriticalSectionAndSpinCount OpenProcess ExpandEnvironmentStringsW FormatMessageW LocalFree SetThreadAffinityMask QueryPerformanceCounter QueryPerformanceFrequency MoveFileW SetFilePointer GetSystemDirectoryW SetUnhandledExceptionFilter FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW GetCurrentThread ResetEvent SetThreadPriority GetPriorityClass EnterCriticalSection GetCurrentDirectoryA PeekNamedPipe GetFullPathNameA FindFirstFileA GetDriveTypeA RemoveDirectoryW LocalAlloc LeaveCriticalSection FlushInstructionCache GetCurrentProcess CloseHandle HeapFree GetProcessHeap GetCurrentThreadId SetLastError CreateEventA HeapAlloc SetPriorityClass TryEnterCriticalSection VirtualAlloc VirtualFree GetLocaleInfoW DuplicateHandle GetLocalTime GetTimeFormatW DeleteFileW GetCurrentProcessId CopyFileW GetCommandLineW LoadLibraryExW MultiByteToWideChar lstrcmpiW GetModuleHandleW CreateMutexW ReleaseMutex TlsAlloc TlsFree GlobalHandle lstrcmpW MulDiv FindResourceExW FindResourceW LoadResource LockResource SizeofResource CreateThread ResumeThread GetExitCodeThread InterlockedDecrement WaitForMultipleObjects ReleaseSemaphore CreateSemaphoreA GetModuleFileNameW CreateDirectoryW SetErrorMode SetProcessShutdownParameters lstrcpynW GetVersionExW WritePrivateProfileStringW GetFileSize ReadFile GetPrivateProfileStringW CreateWaitableTimerW CreateEventW InterlockedExchangeAdd InterlockedExchange PostQueuedCompletionStatus SetWaitableTimer GetSystemTimeAsFileTime InterlockedIncrement SleepEx LoadLibraryW FreeLibrary WideCharToMultiByte GetProcAddress GlobalAlloc GlobalLock CreateFileW WriteFile GlobalUnlock GlobalFree Sleep DeleteCriticalSection InitializeCriticalSection lstrlenW GetLastError GetTickCount SetEvent AreFileApisANSI WaitForSingleObject

user32

BringWindowToTop GetWindowRect GetDC ShowWindow SetFocus IsWindow DestroyWindow ReleaseDC GetAsyncKeyState CreateDialogParamW SetClassLongW LoadCursorW GetSystemMenu GetMessagePos DrawEdge LoadAcceleratorsW GetActiveWindow CreatePopupMenu AppendMenuW InsertMenuW InsertMenuItemW IsMenu CreateMenu DestroyMenu PostMessageW InvalidateRect IsWindowVisible PtInRect GetCursorPos GetWindowLongW UnregisterClassA BlockInput GetClassInfoW RegisterClassW RegisterClipboardFormatW EnumDisplayMonitors SendMessageW EnumDisplayDevicesW AttachThreadInput EnumChildWindows GetUpdateRgn LoadBitmapW SwitchToThisWindow SetWindowsHookExW CallNextHookEx ActivateKeyboardLayout GetKeyboardLayout SendInput GetKeyboardState ExitWindowsEx UnhookWindowsHookEx MapVirtualKeyW ToUnicode OpenDesktopW SetThreadDesktop CloseDesktop GetNextDlgTabItem SetWindowPlacement GetWindowPlacement TranslateAcceleratorW GetMessageW GetKeyState GetCursorInfo GetDlgItemTextW DrawIcon DrawIconEx GetCapture FrameRect DrawFocusRect DrawStateW MonitorFromWindow GetSysColorBrush EnumDisplaySettingsW SendNotifyMessageW LoadStringW CallWindowProcW DefWindowProcW MoveWindow GetClientRect ScreenToClient InvalidateRgn SetTimer KillTimer SetCapture ScrollWindowEx SetParent SetScrollInfo GetClassInfoExW CopyRect IsRectEmpty InflateRect SendDlgItemMessageW GetClassLongW GetWindowThreadProcessId WindowFromPoint CopyIcon BeginDeferWindowPos DeferWindowPos EndDeferWindowPos OffsetRect DestroyIcon SetWindowPos MapWindowPoints VkKeyScanExW GetForegroundWindow ChildWindowFromPointEx SetForegroundWindow SetRect SetMenuInfo GetLastInputInfo GetWindow RegisterClassExW CreateWindowExW SystemParametersInfoW UpdateWindow SetScrollPos GetScrollInfo BeginPaint EndPaint SetCursorPos SetCursor CreateIconIndirect ReleaseCapture MessageBoxA SetWindowContextHelpId MapDialogRect CreateDialogIndirectParamW RegisterWindowMessageW CreateAcceleratorTableW GetFocus DestroyAcceleratorTable IsChild CharNextW GetSysColor GetCursor UnionRect DestroyCursor SetActiveWindow UpdateLayeredWindow MonitorFromPoint GetMenuItemCount IntersectRect SetLayeredWindowAttributes RedrawWindow MsgWaitForMultipleObjects PostQuitMessage TrackPopupMenuEx AdjustWindowRectEx IsIconic GetMenu DrawTextExW DialogBoxParamW MessageBoxW MessageBeep SetDlgItemTextW IsWindowEnabled EmptyClipboard SetClipboardData IsClipboardFormatAvailable GetClipboardData CloseClipboard OpenClipboard GetClipboardViewer SetClipboardViewer ChangeClipboardChain FindWindowW CheckMenuItem PeekMessageW MsgWaitForMultipleObjectsEx TranslateMessage DispatchMessageW PostThreadMessageW GetClassNameW DrawTextW GetWindowDC EndDialog LoadImageW LoadIconW MonitorFromRect GetMonitorInfoW AdjustWindowRect GetSystemMetrics FillRect SetRectEmpty ShowScrollBar ClientToScreen GetMenuState IsDialogMessageW GetDesktopWindow GetDlgItem EnableWindow GetWindowTextLengthW GetWindowTextW SetWindowTextW GetDlgCtrlID GetSubMenu LoadMenuW CheckMenuRadioItem GetMenuStringW DeleteMenu RemoveMenu TrackMouseEvent EqualRect SetWindowRgn GetParent SetMenuItemInfoW GetMenuItemInfoW EnableMenuItem SetWindowLongW

gdi32

MoveToEx GetTextExtentPoint32W GetTextMetricsW GetStockObject SetBkMode SelectClipRgn CreatePolygonRgn SetLayout ExtTextOutW GetObjectType SetBkColor SetTextColor SetPixel SetViewportOrgEx SetBrushOrgEx CreateCompatibleBitmap BitBlt SelectObject CreateCompatibleDC LineTo CreateFontIndirectW CombineRgn CreateRectRgn StretchBlt SetStretchBltMode CreateDIBSection RealizePalette SelectPalette DeleteDC GetDeviceCaps DeleteObject Ellipse Polygon Rectangle SetDIBColorTable GetClipBox GetViewportOrgEx PatBlt CreatePen GetPixel CreatePatternBrush SetRectRgn OffsetRgn GetObjectW CreateSolidBrush RoundRect GetLayout GetBitmapBits GetBkMode GetTextColor GetRgnBox CreateFontW SetWindowOrgEx CreateBitmap GetCurrentObject TextOutW BeginPath EndPath StrokeAndFillPath CreateRectRgnIndirect CreatePalette CreateRoundRectRgn

comdlg32

GetOpenFileNameW CommDlgExtendedError GetSaveFileNameW

advapi32

InitiateSystemShutdownW GetSidIdentifierAuthority CryptGenRandom CryptReleaseContext RegOpenKeyExW CryptAcquireContextA LsaLookupNames LsaFreeMemory LsaClose ConvertSidToStringSidW LsaOpenPolicy RegFlushKey GetUserNameW ImpersonateLoggedOnUser AllocateAndInitializeSid GetSecurityInfo SetSecurityInfo CreateProcessAsUserW LogonUserW LookupAccountSidW LookupAccountNameW EqualSid FreeSid RegCreateKeyW RegOpenCurrentUser StartServiceW CloseServiceHandle SetEntriesInAclW GetNamedSecurityInfoW GetAce DeleteAce SetNamedSecurityInfoW InitializeSecurityDescriptor SetSecurityDescriptorDacl RevertToSelf RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegCreateKeyExW RegDeleteValueW RegDeleteKeyW RegCloseKey

shell32

SHGetPathFromIDListW SHGetMalloc ShellExecuteW SHBrowseForFolderW DragAcceptFiles SHGetSpecialFolderPathW ord680 SHGetFileInfoW SHGetSpecialFolderLocation ord155 ExtractIconExW DragQueryFileW ExtractIconW SHAppBarMessage ShellExecuteExW Shell_NotifyIconW DragFinish

ole32

OleDuplicateData CoGetInterfaceAndReleaseStream PropVariantClear CLSIDFromString CoCreateInstance DoDragDrop ReleaseStgMedium CoMarshalInterThreadInterfaceInStream CoCreateGuid RegisterDragDrop RevokeDragDrop StringFromGUID2 OleLockRunning CoGetClassObject CLSIDFromProgID CreateStreamOnHGlobal OleInitialize OleUninitialize CoTaskMemRealloc CoTaskMemFree CoInitializeSecurity CoTaskMemAlloc

oleaut32

LoadTypeLi VarUI4FromStr OleCreatePropertyFrame SysFreeString SysStringLen VariantInit VariantClear SysAllocStringLen SysAllocString LoadRegTypeLi OleCreateFontIndirect

shlwapi

PathCompactPathW

comctl32

ImageList_GetIconSize InitCommonControlsEx ImageList_SetBkColor ImageList_Create ImageList_Destroy ImageList_Remove ImageList_ReplaceIcon ImageList_GetIcon ImageList_DragLeave ImageList_DragEnter ImageList_DragMove ImageList_EndDrag ImageList_BeginDrag ImageList_Draw

ws2_32

socket select getsockname __WSAFDIsSet ntohl htonl inet_addr ioctlsocket shutdown setsockopt recv closesocket ntohs WSACreateEvent htons connect sendto WSAResetEvent WSACloseEvent WSAWaitForMultipleEvents WSAEventSelect WSASetEvent bind recvfrom accept listen WSASetLastError WSARecv WSARecvFrom WSASend WSASocketW WSADuplicateSocketW gethostbyname WSAGetLastError inet_ntoa send getpeername WSACleanup WSAStartup getservbyname gethostbyaddr getservbyport WSAAddressToStringA getsockopt

msimg32

AlphaBlend

mpr

WNetOpenEnumW WNetCloseEnum WNetEnumResourceW

netapi32

NetApiBufferFree NetUserModalsGet NetServerEnum NetWkstaGetInfo NetUserGetInfo

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiOpenDevRegKey

sensapi

IsNetworkAlive

wininet

InternetSetOptionW InternetCloseHandle HttpEndRequestA InternetOpenW HttpQueryInfoW InternetReadFile InternetQueryDataAvailable InternetWriteFile InternetConnectW HttpSendRequestA InternetErrorDlg InternetQueryOptionW InternetGoOnlineA HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestExA

iphlpapi

GetIpAddrTable GetBestInterface GetAdaptersInfo GetAdapterIndex DeleteIPAddress FlushIpNetTable IpRenewAddress SendARP GetIfEntry

imagehlp

ImageGetCertificateData ImageGetCertificateHeader ImageEnumerateCertificates

secur32

GetUserNameExW

crypt32

CryptHashCertificate CertFreeCertificateContext CertGetNameStringW CryptVerifyMessageSignature

wintrust

WinVerifyTrust

userenv

CreateEnvironmentBlock UnloadUserProfile DestroyEnvironmentBlock LoadUserProfileW

wtsapi32

WTSQuerySessionInformationW WTSCloseServer WTSEnumerateSessionsW WTSFreeMemory WTSEnumerateProcessesW

mswsock

AcceptEx GetAcceptExSockaddrs

Name

.text

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

221KB

Virtual Size

300KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

503KB

Virtual Size

503KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

TeamViewer_Desktop.exe

IMPHASH a8a7799a0300a0e639e26eb9d35b7df2
SHA256 7d85e125d0f1553797a165b8d409a8b4c52743c82b602b4c2aec1f67e9813366
MD5 35e52ae0d1dcc111a3bdd9d55603095c
SHA1 ceb89087cbb5d924646758ee2bb664a23c0772fa
SHA512 ee6f47d13d8a0e6fc7a1d9da249758ec0f41dc0c102848786e182cbd898a9405b516f3a9e31d11b84c5fa2b379c21b266a019986e169711b080cf6a7e7340307
SSDEEP 49152:qB0E8uPnnkQdBI9XeQBwgaJzAFyOjSjsaYsJ7R:jE1PkWI9FaJzoms
TLSH
T1D7B58D3277D6C43FE1A30772991D925952F6F8704E34C99BB2E4572E2BB4A838531F22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

87:32:3e:18:82:bd:ab:e3:7d:f4:87:9f:6f:b2:10:5f:4f:1f:7f:d1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Chains

Aug 31, 2012

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Serial Number

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2011 - Aug 7, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

1150486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\TeamViewer_7.0_Release\TeamViewer\QS_Release2008\TeamViewer_Desktop.pdb

wtsapi32

WTSEnumerateProcessesW WTSEnumerateSessionsW WTSFreeMemory

kernel32

GetCurrentProcess lstrlenW InterlockedIncrement InterlockedDecrement GetProcAddress GetModuleHandleW lstrcmpiW FreeLibrary GetThreadTimes SetEnvironmentVariableA CreateFileA SetStdHandle MultiByteToWideChar GetConsoleOutputCP WriteConsoleA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeA FlushInstructionCache GetConsoleMode GetConsoleCP GetTimeZoneInformation GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA IsValidCodePage GetOEMCP GetACP HeapCreate GetModuleFileNameA GetStdHandle ExitProcess CompareStringW CompareStringA GetStringTypeW LCMapStringW LCMapStringA GetCPInfo SizeofResource LoadResource FindResourceW LockResource LoadLibraryExW GetModuleFileNameW SetProcessShutdownParameters GetProcessShutdownParameters GetCurrentProcessId GetCommandLineW SleepEx GetExitCodeThread SetWaitableTimer PostQueuedCompletionStatus InterlockedExchangeAdd QueueUserAPC CreateEventW CreateWaitableTimerW lstrcpyW DeviceIoControl CreateFileW Sleep LocalFree LocalAlloc LoadLibraryW GetCurrentThread CreateMutexA TlsAlloc TlsFree DuplicateHandle FindResourceExW WriteConsoleW RaiseException InterlockedExchange WaitForMultipleObjects GetLastError SetLastError ReleaseSemaphore CreateSemaphoreA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetSystemTimeAsFileTime GetCurrentThreadId SetEvent GetDateFormatA GetTimeFormatA GetStartupInfoA GetCommandLineA ExitThread IsDebuggerPresent UnhandledExceptionFilter RtlUnwind CreateWaitableTimerA GetSystemInfo AreFileApisANSI GetModuleHandleA WaitForSingleObject HeapAlloc CreateEventA FormatMessageA GetLocaleInfoA HeapSize HeapReAlloc HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA SetEndOfFile ReadFileEx GetOverlappedResult CancelIo WaitForMultipleObjectsEx GetSystemTime CreateThread GetProcessHeap HeapFree CloseHandle GetTickCount FlushFileBuffers ResumeThread GetFileAttributesW SetFileAttributesW GlobalLock GlobalUnlock FileTimeToSystemTime FileTimeToLocalFileTime SetUnhandledExceptionFilter GetSystemDirectoryW DeleteFileW FindClose FindNextFileW FindFirstFileW GetFileSize WriteFile SetFilePointer ReleaseMutex CreateMutexW CreateDirectoryW QueryPerformanceFrequency QueryPerformanceCounter SetThreadAffinityMask GetVersionExW WideCharToMultiByte FormatMessageW GetLocalTime OpenProcess TerminateProcess ProcessIdToSessionId ReadFile InitializeCriticalSectionAndSpinCount TlsGetValue TlsSetValue OpenEventA ResetEvent CreateIoCompletionPort TerminateThread GetQueuedCompletionStatus InterlockedCompareExchange GetPrivateProfileIntW WritePrivateProfileStringW GetPrivateProfileStringW GetLocaleInfoW GetUserDefaultUILanguage GetSystemDefaultUILanguage SystemTimeToFileTime

user32

DestroyWindow GetClassNameW GetWindowInfo MonitorFromWindow GetMonitorInfoW GetWindowRect IsZoomed ShowWindow SetWindowPos GetForegroundWindow SystemParametersInfoW EqualRect IntersectRect OffsetRect IsRectEmpty PtInRect SetRectEmpty CopyRect InflateRect InvalidateRect IsWindow GetCursorPos SendMessageW LockWorkStation EnumWindows MapWindowPoints FindWindowW FindWindowExW SetWindowsHookExW UnhookWindowsHookEx GetCursorInfo GetIconInfo DrawTextW GetSystemMetrics GetWindowRgn IsWindowEnabled WindowFromPoint GetDesktopWindow CallNextHookEx GetWindow GetWindowDC UnionRect RedrawWindow GetWindowThreadProcessId GetGUIThreadInfo GetParent GetDC ReleaseDC FillRect GetWindowLongW CallWindowProcW DefWindowProcW GetClientRect SetLayeredWindowAttributes MsgWaitForMultipleObjectsEx GetUserObjectInformationW LoadStringW OpenInputDesktop SetThreadDesktop ExitWindowsEx EnumDisplayDevicesW ChangeDisplaySettingsExW EnumDisplaySettingsW EnumDisplayMonitors ScreenToClient SetWindowLongW GetDlgItem LoadBitmapW GetAsyncKeyState LoadImageW ToUnicode MapVirtualKeyW VkKeyScanExW GetKeyboardState GetKeyState GetKeyboardLayout ActivateKeyboardLayout RegisterClipboardFormatW UnregisterClassA GetThreadDesktop BlockInput KillTimer SetTimer OpenDesktopW EnumDesktopWindows CloseDesktop PostThreadMessageW IsWindowVisible PostMessageW SendInput SendNotifyMessageW MessageBoxA PostQuitMessage MessageBoxW CreateDialogParamW CreateWindowExW RegisterClassExW CharNextW PeekMessageW GetMessageW TranslateMessage DispatchMessageW LoadCursorW GetClassInfoExW

gdi32

DeleteObject SetBkMode GetSystemPaletteEntries GetDIBits GetDeviceCaps StretchBlt CreateCompatibleDC GetObjectW RectInRegion CreateRectRgnIndirect CreateDIBSection SetPixel CreateDCW GetTextExtentPoint32W SetBkColor CreatePen DeleteDC CreateSolidBrush TextOutW RoundRect GetDCOrgEx BitBlt PtInRegion GetRgnBox OffsetRgn SetRectRgn Rectangle SelectClipRgn SelectObject GetRegionData CombineRgn CreateRectRgn CreateCompatibleBitmap GetStockObject CreatePatternBrush CreateFontIndirectW ExtCreateRegion GdiFlush

advapi32

GetSidIdentifierAuthority StartServiceW CloseServiceHandle CryptGenRandom CryptReleaseContext CryptAcquireContextA GetUserNameW RegFlushKey InitializeSecurityDescriptor SetSecurityDescriptorDacl RegOpenCurrentUser RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW InitiateSystemShutdownW RevertToSelf FreeSid EqualSid LookupAccountNameW LookupAccountSidW LogonUserW SetSecurityInfo SetEntriesInAclW GetSecurityInfo AllocateAndInitializeSid SetNamedSecurityInfoW GetNamedSecurityInfoW ImpersonateLoggedOnUser RegCreateKeyW DeregisterEventSource ReportEventW RegisterEventSourceW

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteExW ShellExecuteW SHGetFileInfoW SHGetMalloc

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitializeSecurity OleUninitialize OleInitialize CoGetInterfaceAndReleaseStream CoCreateInstance ReleaseStgMedium

oleaut32

SafeArrayGetElement VariantClear SafeArrayGetDim VarUI4FromStr SysAllocString SysFreeString VariantInit VariantCopy VariantChangeType

comctl32

ImageList_Draw InitCommonControlsEx

msimg32

AlphaBlend

ws2_32

ioctlsocket htonl shutdown gethostbyname getsockname getsockopt closesocket listen WSAGetLastError inet_ntoa inet_addr WSAAddressToStringA select WSASocketW WSASend WSARecv WSACleanup WSAStartup setsockopt WSASetLastError ntohl htons __WSAFDIsSet accept bind connect

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

imagehlp

ImageEnumerateCertificates ImageGetCertificateHeader ImageGetCertificateData

crypt32

CryptHashCertificate CertFreeCertificateContext CertGetNameStringW CryptVerifyMessageSignature

wintrust

WinVerifyTrust

netapi32

NetApiBufferFree NetUserModalsGet

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

409KB

Virtual Size

408KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

54KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

203KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

TeamViewer_Resource_es.dll

SHA256 c75dec93aea4701dd100706f0763a1d38428cda78c6253d22f909812a6179255
MD5 188be45d42282aadea472165e4b4945e
SHA1 6dca8c0f537571a659c713a50bb91b406f3dd6a7
SHA512 9c81978caf4e99aca3bb39a5a8e3eb35c8ce8a6da526e5e7a2c2539dfe2186ec7eea3a9656db6e5acd98b72b084cf403fd7a405b1237f51d418cd35fa38a364a
SSDEEP 3072:PLc4DdofYRxYv0sSpMU4HBpPZVCN8fyolzFyXeaOfweQsZHDBM+Ew68:TcVSh4HLPZ7yolzFyXeaOfweQS1M+
TLSH
T16144B65067FD6246F6F37F38A97916658E7ABD92EC38814D4220125E1DB0F84CEA4B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a4:93:4c:bf:32:39:34:eb:96:8c:25:b1:3f:ba:7c:d4:6b:19:72:47

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Chains

Aug 31, 2012

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Serial Number

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2011 - Aug 7, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

TeamViewer_Service.exe

IMPHASH 16390213abc6fd8bbe87e56bd0a98b21
SHA256 a2fc05250de0c2e31d843608e7b268f17738fdab11de7f09d608ced468f8a149
MD5 330a97944860648feaa03ce0ef0a12db
SHA1 f6364e91e012bd2ebc80551b1a7a808500ea690c
SHA512 f73f65f13590fac00b50d8d0f85e39ddcb4a595e8121fe8b076f8b55065c92bbf0d3a5bf508f684a7d9c84661a786bc7615bb493ff86222289a9689a01367d20
SSDEEP 49152:atbL2BTmiF361TrPFJ3H8D4PQcxBZzrLDe+X7OocOyTzVKNt3V2p:AITm0q1/XcuxB5rLDe+X7O3w
TLSH
T126D58C313BD1C83AE6B30A71992DA29A95F6B9705E70C15F72D4472E3B74AC3C125F22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

9b:4b:4d:94:22:18:46:6d:1d:a3:ac:03:d6:d0:d8:3c:86:02:3e:d8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Chains

Aug 31, 2012

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Serial Number

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2011 - Aug 7, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

1206582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\TeamViewer_7.0_Release\TeamViewer\QS_Release2008\TeamViewer_Service.pdb

kernel32

TlsAlloc InterlockedExchangeAdd PostQueuedCompletionStatus TlsFree LeaveCriticalSection EnterCriticalSection InterlockedDecrement InterlockedIncrement InterlockedExchange GetModuleFileNameW lstrcmpiW SetConsoleCtrlHandler SetLastError GetLastError Sleep GetThreadTimes GetSystemDirectoryA ExpandEnvironmentStringsA lstrlenA SetEnvironmentVariableA CreateFileA SetStdHandle WriteConsoleW WriteConsoleA LoadLibraryA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeA FlushFileBuffers GetConsoleMode GetConsoleCP IsValidCodePage GetOEMCP GetACP GetTimeZoneInformation GetStartupInfoA GetFileType SetHandleCount GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentDirectoryA PeekNamedPipe GetFullPathNameA FindFirstFileA GetDriveTypeA HeapReAlloc VirtualAlloc VirtualFree HeapCreate GetExitCodeThread GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileIntW GetConsoleOutputCP GetModuleFileNameA GetStdHandle ExitProcess HeapSize CompareStringW CompareStringA GetStringTypeW LCMapStringW LCMapStringA GetCPInfo GetDateFormatA GetTimeFormatA ExitThread FileTimeToSystemTime FileTimeToLocalFileTime SetUnhandledExceptionFilter GetSystemDirectoryW FreeLibrary CloseHandle CreateFileW GetProcAddress LoadLibraryW DeleteFileW FindClose FindNextFileW FindFirstFileW GetCurrentProcess GetCurrentProcessId GetSystemTimeAsFileTime ReleaseSemaphore WaitForSingleObject CreateEventA CreateSemaphoreA DuplicateHandle SetEvent GetTickCount GetFileSize SleepEx InitializeCriticalSection DeleteCriticalSection SetWaitableTimer WriteFile SetFilePointer ReleaseMutex CreateMutexW CreateDirectoryW MoveFileW CreateEventW CreateWaitableTimerW LocalFree OpenProcess QueryPerformanceFrequency QueryPerformanceCounter GetCurrentThread SetThreadAffinityMask GetVersionExW WideCharToMultiByte FormatMessageW MultiByteToWideChar GetLocalTime ProcessIdToSessionId WaitNamedPipeW TerminateProcess ReadFile CreateProcessW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount HeapFree GetProcessHeap TlsGetValue TlsSetValue OpenEventA ResetEvent HeapAlloc CreateIoCompletionPort QueueUserAPC TerminateThread GetQueuedCompletionStatus InterlockedCompareExchange GetLocaleInfoW GetUserDefaultUILanguage GetSystemDefaultUILanguage SystemTimeToFileTime DeviceIoControl GetVolumeInformationW RaiseException lstrlenW GetModuleHandleW SizeofResource LoadResource FindResourceW LoadLibraryExW ResumeThread CreateThread SetThreadPriority GetOverlappedResult GetComputerNameW GetLocaleInfoA FormatMessageA SetEndOfFile GetFileAttributesW GetFileInformationByHandle SetFileAttributesW GetModuleHandleA AreFileApisANSI CreateWaitableTimerA RtlUnwind UnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId

user32

MsgWaitForMultipleObjectsEx MessageBoxA FindWindowW SendMessageW PostThreadMessageW PeekMessageW GetMessageW TranslateMessage DispatchMessageW ExitWindowsEx MessageBoxW CharNextW DestroyWindow

advapi32

InitiateSystemShutdownW RevertToSelf SetSecurityDescriptorDacl InitializeSecurityDescriptor SetNamedSecurityInfoW DeleteAce GetAce GetNamedSecurityInfoW SetEntriesInAclW CloseServiceHandle StartServiceW QueryServiceStatus ControlService DeleteService FreeSid EqualSid LookupAccountSidW LogonUserW RegCloseKey RegOpenCurrentUser RegCreateKeyExW RegOpenKeyExW RegSetValueExW DeregisterEventSource ReportEventW RegisterEventSourceW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RegQueryValueExW RegCreateKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW CreateProcessAsUserW CryptGenRandom CryptReleaseContext CryptAcquireContextA LsaLookupNames LsaFreeMemory LsaClose ConvertSidToStringSidW LsaOpenPolicy GetUserNameW RegFlushKey ImpersonateLoggedOnUser AllocateAndInitializeSid GetSecurityInfo SetSecurityInfo

ole32

CoInitializeSecurity OleInitialize StringFromGUID2 OleUninitialize CoCreateGuid CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoTaskMemFree

oleaut32

VarUI4FromStr SysAllocString VariantClear SysFreeString

ws2_32

connect htons WSACreateEvent ntohs getpeername WSAResetEvent socket send getsockname __WSAFDIsSet ntohl inet_addr ioctlsocket getsockopt setsockopt recv closesocket gethostbyname WSAGetLastError WSACloseEvent WSAWaitForMultipleEvents WSAEventSelect WSASetEvent bind htonl recvfrom shutdown WSAStartup WSACleanup inet_ntoa accept listen WSASetLastError WSARecv WSASend WSASocketW WSADuplicateSocketW sendto select WSARecvFrom getservbyname gethostbyaddr getservbyport

mpr

WNetOpenEnumW WNetEnumResourceW WNetCloseEnum

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiOpenDevRegKey

sensapi

IsNetworkAlive

wininet

HttpEndRequestA InternetQueryDataAvailable InternetReadFile HttpSendRequestExA HttpQueryInfoW InternetOpenW InternetSetOptionW InternetWriteFile InternetConnectW HttpSendRequestA InternetErrorDlg InternetQueryOptionW InternetGoOnlineA HttpOpenRequestA HttpAddRequestHeadersA InternetCloseHandle

iphlpapi

GetBestInterface GetIfEntry SendARP IpRenewAddress FlushIpNetTable DeleteIPAddress GetAdapterIndex GetAdaptersInfo GetIpAddrTable

imagehlp

ImageGetCertificateData ImageGetCertificateHeader ImageEnumerateCertificates

secur32

GetUserNameExW

crypt32

CryptHashCertificate CertFreeCertificateContext CryptVerifyMessageSignature CertGetNameStringW

wintrust

WinVerifyTrust

userenv

UnloadUserProfile LoadUserProfileW CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW WTSCloseServer WTSEnumerateProcessesW WTSFreeMemory WTSEnumerateSessionsW

shell32

ShellExecuteExW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc ShellExecuteW

mswsock

GetAcceptExSockaddrs AcceptEx

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

533KB

Virtual Size

532KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

53KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

213KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

TeamViewer_StaticRes.dll

SHA256 0b6c90a473e91194097e2bda37dbc12da2aad821746e33007b993e3fbf822435
MD5 cc0650781e1ee82af22781f2f3aa0bcf
SHA1 c7364e38eb63a8818efcfd70f13e815b4acfc39f
SHA512 8647ac8f10816a39bbaf7aea45e4882cb7305dd9310cc1c5765864118d866f62c03e034c0515877c39db69c746723dac76c9e011b45573441c3e6ca995eab216
SSDEEP 12288:97FRMxerSauRDWje2CPE8L+YoBSNPramjvT1VgQr7:1prSaj0L1T1S
TLSH
T14EB5038E0060CB45DE8F96F0C66C7DFC4446FDEB82AA00AF3943FA5934FB2518567699
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

33:c1:26:d5:ae:65:6e:42:62:b2:2c:88:98:e9:ea:96:0a:4b:26:c1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Chains

Aug 31, 2012

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Serial Number

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2011 - Aug 7, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

tv_w32.dll

IMPHASH 714e5bc40dee78cd885497d6a83a0771
SHA256 fbc5878e2c1e7b07a51373ca2c7831692c8c2670cceb11dbc74ae52e5cbdfe98
MD5 9ed6a6feba4446e188424913a18b1769
SHA1 b49b4961736c6f88f4dff12568f25b38687d52d5
SHA512 cfb2ae85de031ef6b6f646d8dcb3c447b2f5828857e22b6468769f2eb9c1368f5a5abada70c72497979b274f95e74048efdaaacbb4e0dc67b4642b6f6ef3a39b
SSDEEP 768:8tvRDZg0/JsjxGPWO6/6qSBiVi6u9Fb1+b6DzTH+WyOOSvDIILs:8N5i2sdGhiHuPIbfWv
TLSH
T1CB634B124203D839E5D9363989BE1A952C38EB960F7963C792B93391E8786D43D3D373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

0c:2e:1f:58:4a:e7:aa:43:c9:e7:cd:72:c5:32:f3:35:1c:25:24:4b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Chains

Aug 31, 2012

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Serial Number

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2011 - Aug 7, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

38550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_w32dll.pdb

crtdll

strncat strncpy _vsnprintf _snprintf _strlwr strrchr memmove memcpy wcsstr _wcslwr _global_unwind2 _local_unwind2 _initterm malloc __dllonexit strncmp memset

comctl32

InitCommonControlsEx

kernel32

GetFileAttributesExW HeapAlloc GlobalLock DeleteCriticalSection GetProcAddress LoadLibraryA FreeLibrary GetSystemDirectoryA GetLocalTime InterlockedCompareExchange GlobalUnlock DisableThreadLibraryCalls OpenMutexW GetModuleFileNameA FreeLibraryAndExitThread Sleep LoadLibraryW GetModuleFileNameW CreateThread LocalFree CreateMutexW CreateEventW UnmapViewOfFile ReleaseMutex WaitForSingleObject InterlockedDecrement InterlockedIncrement SetEvent GetTickCount IsBadWritePtr IsBadReadPtr MapViewOfFile OpenFileMappingW CreateFileMappingW LocalAlloc SetLastError GlobalFree GlobalAlloc GetVersion QueryPerformanceCounter GetVersionExW VirtualProtect ResumeThread GetCurrentProcess GetCurrentProcessId GetCurrentThreadId CreateToolhelp32Snapshot Thread32First OpenThread SuspendThread Thread32Next CloseHandle GetProcessHeap HeapFree EnterCriticalSection LeaveCriticalSection GetLastError InitializeCriticalSection FileTimeToSystemTime InterlockedExchange

user32

ShowWindow GetWindow GetWindowLongW GetSysColor LoadBitmapW GetSystemMetrics SystemParametersInfoW SendMessageW GetClientRect IsZoomed GetWindowInfo IsRectEmpty CallWindowProcW RedrawWindow MoveWindow IsIconic PostMessageW TrackMouseEvent InvalidateRect EndPaint BeginPaint GetActiveWindow SetWindowLongW FindWindowExW FindWindowW GetClassNameA GetDesktopWindow ClientToScreen GetDC GetUpdateRect GetWindowRect ReleaseDC IsWindow IsWindowVisible SetWindowPos GetClassInfoExW LoadCursorW RegisterClassExW CallNextHookEx DestroyWindow DefWindowProcW KillTimer SetTimer RegisterClipboardFormatW CreateWindowExW UnregisterClassW SendMessageTimeoutW UnhookWindowsHookEx SendNotifyMessageW SetWindowsHookExW RegisterWindowMessageW MapWindowPoints GetWindowDC

gdi32

DeleteObject GdiFlush BitBlt SelectObject CreateDIBSection CreateCompatibleDC Rectangle GetStockObject CreatePen Polyline ExtCreatePen LineTo MoveToEx CreateSolidBrush CreateCompatibleBitmap GetObjectW SetPixel GetPixel RectVisible DeleteDC

shell32

DragQueryFileW

ole32

ReleaseStgMedium CoCreateInstance

Name

.text

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.shared

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

tv_w32.exe

IMPHASH 50a1bd551f06f6cf63b0687e32d02be5
SHA256 39d4d07bb3a5a09c95d13e61dda88f4051dc032941cca24ca37687b026d7f9b2
MD5 627b4968b2a5d6fe37d904324694eb32
SHA1 f30c54bdf00ad0756bfe6374750d5d003466a46e
SHA512 67dff5e25ce061174e8d4680257a763c2ca58107e058b61c347730ef43cd77551610d129b695321b48684ad91a1fa87af7dbf23500369e5a58b8ca1d5c566657
SSDEEP 1536:RQLuOPfckAlDOuWen7dqxCuRcCfKZjwkDi/55JlYR5v7r:eLvckAxdcjkk/5qR5v7
TLSH
T18FA38D227690C072D55655339D6AD7B69A3CF5304B749EC3F7884BB95F303C0AA3A24B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

8f:61:b8:a1:22:f8:65:0f:05:4f:24:9c:84:f8:3e:60:6c:5e:7f:34

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Chains

Aug 31, 2012

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Serial Number

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2011 - Aug 7, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

29493

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_w32exe.pdb

kernel32

SetEvent GetVersionExW GetLastError CreateEventW CloseHandle FreeLibrary GetProcAddress LoadLibraryA GetModuleFileNameA Sleep GetSystemDirectoryW LoadLibraryW GetTickCount OpenMutexA CreateMutexW SetFilePointer InterlockedIncrement InterlockedDecrement WaitForSingleObject WriteFile CreateFileW GetLocalTime GetCurrentThreadId ReleaseMutex GetCurrentProcessId GetCommandLineW GetCurrentProcess CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent WideCharToMultiByte GetCommandLineA GetStartupInfoA EnterCriticalSection LeaveCriticalSection RaiseException RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError LCMapStringW HeapFree HeapAlloc ExitProcess GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA MultiByteToWideChar GetStringTypeA GetStringTypeW GetLocaleInfoA VirtualAlloc HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount WriteConsoleA VirtualQuery

user32

PeekMessageW DispatchMessageW SendInput BlockInput MsgWaitForMultipleObjectsEx TranslateMessage

shell32

ShellExecuteExW

tv_x64.dll

IMPHASH 2b7e8ea5f94b83a0c345d3ae26628b16
SHA256 89665638b0a1d14ab7b41647124a2f0ab1f392567e82da64ff3b1c9fd862acf8
MD5 ec6ef6e3e9459a4c3ff32b98817ff07f
SHA1 a92f11abcf3db086cf7936d9df402db54125a5f4
SHA512 b2ec727ab905c4a0b558d957fea105b3731dc7218608784c4ff97a5244307711f182b83706d2a811db8c5bb75f1b3b50460edda3811eb837906a3c7dd85138b4
SSDEEP 1536:S7BqTaUmDeu0RftUF/4fXHQHF1M78hLIV2p0y:S7BqQYU6fXwHF19p
TLSH
T15D835B59969A04A5E473823AD8B60A12C771B491077063CF8071E3658F777E3BE3EB4B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c9:12:6f:1d:8a:de:d1:9b:51:a1:1d:16:fe:45:85:ad:dd:79:48:4c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Chains

Aug 31, 2012

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Serial Number

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2011 - Aug 7, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

45808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_x64dll.pdb

msvcrt

_onexit __dllonexit realloc calloc malloc free _initterm _wcslwr wcsstr strncmp memmove __C_specific_handler strrchr _strlwr _snprintf _vsnprintf strncpy strncat memcpy memset

comctl32

InitCommonControlsEx

kernel32

FileTimeToSystemTime InitializeCriticalSection GetLastError LeaveCriticalSection EnterCriticalSection HeapFree GetProcessHeap CloseHandle Thread32Next SuspendThread OpenThread Thread32First CreateToolhelp32Snapshot GetCurrentThreadId GetCurrentProcessId GetCurrentProcess ResumeThread VirtualProtect GetVersionExW QueryPerformanceCounter GlobalUnlock GetFileAttributesExW HeapAlloc GlobalLock DeleteCriticalSection GetProcAddress LoadLibraryA FreeLibrary GetSystemDirectoryA GetLocalTime DisableThreadLibraryCalls OpenMutexW GetModuleFileNameA FreeLibraryAndExitThread Sleep LoadLibraryW GetModuleFileNameW CreateThread LocalFree CreateMutexW CreateEventW UnmapViewOfFile ReleaseMutex WaitForSingleObject SetEvent GetTickCount IsBadWritePtr IsBadReadPtr MapViewOfFile OpenFileMappingW CreateFileMappingW LocalAlloc SetLastError

user32

SendNotifyMessageW UnhookWindowsHookEx SendMessageTimeoutW UnregisterClassW CreateWindowExW RegisterClipboardFormatW SetTimer KillTimer DefWindowProcW DestroyWindow CallNextHookEx RegisterClassExW LoadCursorW GetClassInfoExW SetWindowPos IsWindowVisible IsWindow ReleaseDC GetWindowRect GetWindowDC GetClassNameA ShowWindow GetWindow GetWindowLongPtrW GetSysColor LoadBitmapW GetSystemMetrics SystemParametersInfoW SendMessageW GetClientRect IsZoomed GetWindowInfo IsRectEmpty CallWindowProcW RedrawWindow MoveWindow IsIconic PostMessageW TrackMouseEvent InvalidateRect GetActiveWindow SetWindowLongPtrW EndPaint BeginPaint FindWindowExW FindWindowW MapWindowPoints GetDesktopWindow ClientToScreen GetDC GetUpdateRect RegisterWindowMessageW SetWindowsHookExW

gdi32

RectVisible GetPixel SetPixel GetObjectW CreateCompatibleBitmap CreateSolidBrush MoveToEx LineTo DeleteObject Polyline CreatePen GetStockObject Rectangle CreateCompatibleDC CreateDIBSection SelectObject BitBlt GdiFlush ExtCreatePen DeleteDC

shell32

DragQueryFileW

ole32

ReleaseStgMedium CoCreateInstance

Name

.text

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.shared

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

320B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

tv_x64.exe

IMPHASH 2c5c62562658e3dcbc628c79afc9f4a7
SHA256 b04856d833675181328d4a735f4986c9152a91b7e9fdf6fc4366e0c33bd89346
MD5 915f51801da48223d4e755aa4f6d5281
SHA1 622eea27e92126e029a6e8e196470a16130a6b9b
SHA512 224995258bdc785eec92bf2f8e53fc846e9524658e39057c1b1e2b9e13467e65611c8e0fab0d6ab55cd8ecd038af84c02eeee863c02717c3c1236c81792df49a
SSDEEP 3072:LUwSVG88g4kZsVlgGQZkc+DnFKPcQmlZKFdv/5Qt:LI+VlgZZ5+MPcQ4ZYvW
TLSH
T127C36B4BB7A540F8C84AC17ACAA68712D771B41A4B7443CF172887565F23BD1EE3A732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e7:09:b5:d9:b0:a4:0a:8e:8c:ba:71:8d:4b:88:6d:ab:27:f6:ba:c5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Chains

Aug 31, 2012

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Serial Number

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2011 - Aug 7, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

39824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_x64exe.pdb

kernel32

SetEvent GetVersionExW GetLastError CreateEventW CloseHandle FreeLibrary GetProcAddress LoadLibraryA GetModuleFileNameA Sleep GetSystemDirectoryW LoadLibraryW GetTickCount OpenMutexA CreateMutexW SetFilePointer WaitForSingleObject WriteFile CreateFileW GetLocalTime GetCurrentThreadId ReleaseMutex GetCurrentProcessId GetCommandLineW GetCurrentProcess CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WideCharToMultiByte GetCommandLineA GetStartupInfoA EnterCriticalSection LeaveCriticalSection RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer DecodePointer FlsGetValue FlsSetValue FlsFree SetLastError FlsAlloc LCMapStringW HeapFree HeapAlloc GetModuleHandleW ExitProcess GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapSetInformation HeapCreate QueryPerformanceCounter GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA MultiByteToWideChar GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize InitializeCriticalSectionAndSpinCount HeapReAlloc

user32

PeekMessageW DispatchMessageW MsgWaitForMultipleObjectsEx TranslateMessage

shell32

ShellExecuteExW

x64/TVMonitor.sy_

IMPHASH f24b69173de020aa0ac1739d7b40e04c
SHA256 05d30728d7204aba2437259ecf929a94e6573f7621baf35d76eba26f5489a6cf
MD5 95314c3a08589471983c2c8173f23cda
SHA1 a84b8b7c7c08f4642655e2f1df9161b8d3b0b665
SHA512 200c9af5a7ac032bcbde1830001f2c7cf4e9dd02b964a6bbdf7fe5e4bd29cd152a4fbea3bac53defa9f321e0417af3d170900ab3de390fcfc1d411237d238c06
SSDEEP 384:PxWDUVvF0r2UHKZCmYFJulYJLWOtbeFV6jlV:k0vFGXH7XuAL/beFVmP
TLSH
T17F7208E707645466ECE78B36C5E6CAB36D71F1906F9281DF0025819A2D42BF43B3E21B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Chains

Nov 25, 2010

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Serial Number

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 16, 2008 - Feb 22, 2011

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

Major OS version

Entry point

24676

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

j:\teamviewer6.0\monitordriver\objfre_wlh_amd64\amd64\TVMonitor.pdb

Name

.text

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

204B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/TVMonitor.sy_

IMPHASH bc06eb1dad5e8285411e580cdee99e10
SHA256 d933340af838d94f25c74f9d46a74de3b45f29b896afa49a03676bab8cd400cf
MD5 111a023266532c621ee69ae96e47081e
SHA1 4f1dde3508a85fa4beda1d8110e98db248be1af1
SHA512 bf6252a52ad61bafb8b86589b4436069d4bc277b91a89e90c4b237e3e49a7388bc8e1d5d29a1790f4505de2a52eb26e0bef112e946f7505f0641b3ebd5643354
SSDEEP 192:7hkFKqiEedsBgI/yowJL/aMjGwP7QM3PXD+ebMdHFVZgjlJMVc83:Vkcqod5CYJLWOtbeFV6jK
TLSH
T1CE52189B0B242871EDD68F70C4EEE6275C77B2905F94A08B107885D96DA2BF03B2570F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Chains

Nov 25, 2010

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Serial Number

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 16, 2008 - Feb 22, 2011

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

Major OS version

Entry point

4158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

j:\teamviewer6.0\monitordriver\objfre_wxp_x86\i386\TVMonitor.pdb

Name

.text

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

384B

Virtual Size

277B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

384B

Virtual Size

274B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

out.upx

SHA256 7628defd736ef567a165952240f1a2be4bbb74f0b96df4566678fa7d1056fb44
MD5 3000c6640a69f2f8dbb1c41152429782
SHA1 56bdcde2d03c8d97373da33c26ad50516e86eebd
SHA512 c16890b64e176908558c37fd8c3eeb465c06989f69936ee9e852fdba1e59766ea6048825c4803ac56d4e2a63a1f0e85604546722f5a2e37c38a3e27c321fdfc0
SSDEEP 1536:NQpQ5EP0ijnRMofYRxYv0sDnpMU4HVzp1X:NQIURMofYRxYv0sTpMU4HV11X
TLSH
T1F2439E27F2C4DCB3D843357048EBD631E3BAB318BE215B5B67262F6E6521393552220B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

TVQS_es.exe

PE Signature issue

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/TvGetVersion.dll

shlwapi

kernel32

user32

winspool.drv

advapi32

shell32

ole32

oleaut32

generic

$PLUGINSDIR/nsis7z.dll

kernel32

user32

oleaut32

generic

$PLUGINSDIR/wincheck.ini

$_2_/tvqsfiles.7z

TeamViewer.exe

PE Signature issue

avicap32

msvfw32

winmm

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

ws2_32

msimg32

mpr

netapi32

setupapi

sensapi

wininet

iphlpapi

imagehlp

secur32

crypt32

wintrust

userenv

wtsapi32

mswsock

generic

TeamViewer_Desktop.exe

PE Signature issue

wtsapi32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32