TeamViewer[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/TvGetVersion.dll
unpack001/$PLUGINSDIR/nsis7z.dll
unpack003/$PLUGINSDIR/FindProcDLL.dll
unpack003/$PLUGINSDIR/KillProcDLL.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/TvGetVersion.dll

resource
unpack002/TeamViewer.exe
unpack002/TeamViewer_Desktop.exe
unpack002/TeamViewer_Note.exe
unpack002/TeamViewer_Resource_pl.dll
unpack002/TeamViewer_Service.exe
unpack002/TeamViewer_StaticRes.dll
unpack002/tv_w32.dll
unpack002/tv_w32.exe
unpack002/tv_x64.dll
unpack002/tv_x64.exe
unpack002/uninstall.exe
unpack004/x64/TVMonitor.sy_
unpack005/x86/TVMonitor.sy_

TeamViewer.exe

IMPHASH 4ea4df5d94204fc550be1874e1b77ea7
SHA256 5a72cd6f1d7a06a50867e2524b88066fd000b97d7001ac9346990adc635bdf14
MD5 ec451d8e7ca456a9d5f466548c7b0f6c
SHA1 c07b6cdca4dc3b28940e61755c13e468d248078f
SHA512 f8d9017d6dc818dd3ba652629b18cb2d01076f150e99b11cbdf2804d2d2f8c18ccf2902a43ea65a2b675574cb19650486d083ca21f4af7e6567b31dccf4e921a
SSDEEP 196608:NjVUuOMTvDD2w1sLYY3bjJ3IvtHamV6ClLg2W8mm5fE63Z:FVt1tsLYY/St6mkMLg2xj5tZ
TLSH
T1F7A623AD97E35387F8321D3ADB52963454363EC164E82DF54688BB2C4E302DE931B92D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Digest

50:9f:f0:72:14:9c:17:f2:43:2f:e5:b8:a1:9c:e8:e2:47:59:88:ca:46:ec:94:86:91:5c:d5:2a:5e:49:74:57

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Chains

Dec 15, 2016

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

2c:f4:d6:14:a0:03:c1:2b:6f:d3:bc:32:ba:a8:ae:b0:60:a4:5d:d6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Chains

Dec 15, 2016

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Serial Number

7e:c0:da:c3:9a:e3:64:6b:14:93:27:7f:76:1a:0e:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2016 - Mar 3, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Serial Number

69:29:d5:2f:01:56:b5:fd:28:f8:9e:14:ab:c6:a2:6c

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2016 - Mar 3, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Serial Number

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 11, 2015 - Dec 29, 2020

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Serial Number

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Timespan

Jan 1, 1997 - Dec 31, 2020

Minor OS version

0

Major OS version

4

Entry point

13238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode WaitForSingleObject GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GetDiskFreeSpaceW lstrlenW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/InstallOptions.dll

IMPHASH 4b45b7e00344a87332fbd12653854d1a
SHA256 c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
MD5 033ee34c40e8fa85bf2739bcb2f3e186
SHA1 2ca942f35f77f37df3fc6097acac34f2e77341b7
SHA512 2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
SSDEEP 384:ErC43tPegZ3eBaRwCPOYY7nNYXCT/Yosa:EmTgZ3eBTCmrnNAh
TLSH
T1B1624D1137D558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile SetCurrentDirectoryW GetPrivateProfileStringW GetPrivateProfileIntW MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree GlobalAlloc WriteFile SetFilePointer

user32

LoadCursorW SetWindowRgn GetDlgCtrlID CloseClipboard DrawFocusRect OpenClipboard DrawTextW SetCursor LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW GetClientRect ShowWindow GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW CallWindowProcW PostMessageW MessageBoxW GetSysColor CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW GetWindowLongW EnableMenuItem PtInRect MapWindowPoints GetClipboardData

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectW

shell32

SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
TLSH
T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/TvGetVersion.dll

IMPHASH 5fb69f8721fcb2adbb1c41cc9672c106
SHA256 f89a02e858183d373d35dfffc21359acf3d45eb96f8206c3581ba05ce49d2023
MD5 b1c0c4b14c3b6787ab1e1e4f91579c4a
SHA1 f099b16e9e33decafee22da17574771968565c58
SHA512 76718483b8f07704409a69b9a4613e9fc48fad0dc0b9dd9f435e44d1f174dce6ae8eec56c94e24b0a289aa78c5421e2258f977c12182e1422570fd33f1cf463b
SSDEEP 1536:VngJZsOHXEFxQplfzbTJ7nKdgw5TLTKbZYVo+vwCgQCQKDnjBhEKiuqX2sE2OGWl:Vg/sO0ghLQMp+GQCQ61sE3GWYy
TLSH
T17EF3191133F08035F5F72A78ACF4C6608E7ABD32AA34D14EE750C96A2970B85DA75727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

42366

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

StrChrW StrRChrW

wtsapi32

WTSEnumerateProcessesW WTSFreeMemory

msi

ord45 ord141 ord16 ord70

psapi

GetProcessImageFileNameW

kernel32

lstrcmpiA lstrcpynA lstrlenA lstrcpyW lstrcpynW Sleep GetVersionExW LocalFree FreeLibrary LoadLibraryW GetExitCodeProcess WaitForSingleObject CreateProcessW OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot TerminateProcess DeleteFileW GetWindowsDirectoryW GetTempPathW InterlockedDecrement WideCharToMultiByte GetModuleFileNameW MultiByteToWideChar RtlUnwind CreateDirectoryW FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExW MoveFileW GetCurrentThreadId DecodePointer GetCommandLineA EncodePointer HeapAlloc RaiseException HeapFree IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess GetDriveTypeW LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage TlsAlloc lstrcpyA TlsSetValue TlsFree SetLastError GetFullPathNameW GetFileInformationByHandle PeekNamedPipe GetFileType GetCurrentDirectoryW ExitProcess CreateFileW GetStdHandle GetStartupInfoW DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime HeapSize WriteFile SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer LCMapStringW GetStringTypeW SetEndOfFile GetProcessHeap GetTimeZoneInformation HeapReAlloc WriteConsoleW CompareStringW SetEnvironmentVariableA GetFileSize GlobalAlloc ReadFile CloseHandle GlobalFree lstrlenW TlsGetValue lstrcatW GetLastError GetCurrentProcessId GetModuleHandleW GetProcAddress VerSetConditionMask VerifyVersionInfoW lstrcmpiW EnterCriticalSection SetHandleCount

user32

GetSystemMetrics wsprintfW SendMessageW PostMessageW

gdi32

AddFontResourceExW RemoveFontResourceExW

winspool.drv

EnumPrintProcessorsW EnumPrinterDriversW

advapi32

RegQueryValueExW RegSetValueExW RegCloseKey RegEnumKeyExW RegDeleteKeyW GetUserNameW LookupAccountNameW ConvertSidToStringSidW DeleteService RegOpenKeyExA RegQueryValueExA OpenProcessToken OpenSCManagerW OpenServiceW CloseServiceHandle QueryServiceStatus RegEnumValueW RegCreateKeyExW RegOpenKeyExW RegFlushKey ChangeServiceConfig2W RegDeleteValueW AdjustTokenPrivileges LookupPrivilegeValueW ControlService StartServiceW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CLSIDFromString CLSIDFromProgID CoCreateInstance OleRun

oleaut32

SysAllocString SysFreeString GetErrorInfo

$PLUGINSDIR/nsis7z.dll

IMPHASH 9c8bb65ecbb91da1f2ebb6ae7a714ed0
SHA256 66b2f36274ddfeef35b1d6ae6e5755f834446e5d78a719063347543793987161
MD5 87853c0f20f065793bdc707ece66190b
SHA1 738e11a9a565923ec75400a0cd4bce4db257b21d
SHA512 febfcd11795f4ef0ff3d25cbf1856be01e7f6423a9f16028c927988c04ab21de5f0b076d7f4ce9294aa7603c0db61ea5ffb888af2e9f7c6a6a11bcabfe9795a2
SSDEEP 3072:eBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRp:6xzJSAGEdYD5JcYl78Fs
TLSH
T110049D2337E0C175E21F0732DE56EB9122BAB6504E62C8873F990F5C4F726989E2D716
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

96225

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle SetFileAttributesW RemoveDirectoryW MoveFileW CreateDirectoryW GetLastError DeleteFileW GetFullPathNameW GetCurrentThreadId GetCurrentProcessId SetLastError CreateFileW SetFileTime FindClose FindFirstFileW GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile GetCurrentProcess GetSystemInfo GetProcAddress GetStdHandle EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects DeleteCriticalSection AreFileApisANSI VirtualFree VirtualAlloc GetVersionExW WaitForSingleObject SetEvent InitializeCriticalSection ResetEvent CreateEventW SetFileApisToOEM SetFileApisToANSI GlobalFree lstrcpyW lstrcpynW GlobalAlloc RaiseException VirtualQuery LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA WideCharToMultiByte MultiByteToWideChar GetTickCount HeapFree HeapAlloc HeapReAlloc ExitThread CreateThread GetCommandLineA GetVersionExA GetProcessHeap HeapDestroy HeapCreate GetModuleHandleA ExitProcess GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep HeapSize RtlUnwind GetConsoleCP GetConsoleMode FlushFileBuffers FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime LoadLibraryA GetCPInfo GetACP GetOEMCP IsValidCodePage SetStdHandle CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoA

user32

CharUpperW GetDlgItem FindWindowExW SetWindowTextW wsprintfW SendMessageW

oleaut32

VariantCopy VariantClear SysAllocString

$PLUGINSDIR/wincheck.ini

SHA256 0375c254f677b4b3c43fd6cc892816d5b2342ac699579c1fdd70d50dfe3771f7
MD5 04f98c8509a7ff5ce42f2d56e1cd010e
SHA1 0ed6c8707f1fcd7079b12d4d8b94da36650a3812
SHA512 3c9cc57d4b6b52687c5991d2190da86815f1c4a07baec40c733c8f23c369d83022246b2d31eccefce8aea0a7c597b5395b26d6151f77e7596eef59ecef06b8f8
TLSH
T1C1C012884101439D907071510C5A7751B7D027210B0A19E8F16618A3935D8E048AC68A
MD5 SHA1 SHA512 TLSH

$_3_/tvqsfiles.7z

SHA256 15f83d5dbb78feb15fddecda36995b004c5d1c48b6aa48a0c77f0aee5a1971b3
MD5 6ebd406863f229c1549be42f84a8761b
SHA1 f98c69f2a609dfad50eb2a7ba24e3aa895cc5630
SHA512 0d99c73e698cb55b3de59287f0e2e96cf17626e2a85240e105553d601867bbd4036d06a1a4ca9c665eed61f0953ce9d960262fe932017386013ceb1a7468888f
SSDEEP 196608:wmuvThOSXNSWZIDNh8doJmjeTcMjPlmOwjR/8zUwsdc8b8emRAIyIoq4gAxSv:wmuvVxXNS6Ihh8sUvmPlm9R/yT8b8em1
TLSH
T116963320B15F5937B07092E7E94EBBD252F103C2FA81499D7CC35A4891060FDB9EAE67
MD5 SHA1 SHA512 SSDEEP TLSH

TeamViewer.exe

IMPHASH 54fa221b13403860871e478e244bc571
SHA256 df128d2bed4b62e1b51fcde808cd0fb25561440684eb51bfe85729c6017a5b5d
MD5 0845a0c0ad188ece8d013174ea2e16d9
SHA1 c5674d149d4408e369da52cd7a88a96a9c8256f5
SHA512 dd65ea134d47aa16548aebba606f0ca9be5f9f72811ca1675bf1560cafa7780ce11c3fd66874eb3a32ebb02666a4c84d9abc09bbd077bbb6eab053aaf3adec2f
SSDEEP 393216:YctdzFtUZ3SvumCjdyIzY4mw8pGrnYIEI7AG8bV6KqEuzJWR8awqgTzwg+h8pALC:YctdzFta3VpHYBpGTmh8IgXN
TLSH
T1E9573B10EB97C1E3DB6311B01276DB1D87799D881B684EE3D6087E2E5C316C1BE3B1A9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c0:c6:6b:94:64:05:2e:9a:36:54:54:a0:e3:83:6b:22:62:b2:b4:d7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Chains

Dec 15, 2016

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Serial Number

7e:c0:da:c3:9a:e3:64:6b:14:93:27:7f:76:1a:0e:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2016 - Mar 3, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

5

Entry point

20175983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TeamViewer_Workspace\TeamViewer_12.0_Release\BuildTarget\QS_Release2013\TeamViewer.pdb

kernel32

HeapReAlloc HeapAlloc InterlockedIncrement InterlockedDecrement HeapFree InterlockedCompareExchange SetEvent GetProcessHeap InitializeCriticalSectionAndSpinCount CreateEventA HeapDestroy LeaveCriticalSection RaiseException InterlockedExchange GetLastError HeapSize EnterCriticalSection InterlockedExchangeAdd DecodePointer PostQueuedCompletionStatus DeleteCriticalSection TlsAlloc CloseHandle TlsFree LoadLibraryExA GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA GetCurrentProcess FlushInstructionCache SetLastError GetCurrentThreadId InitializeCriticalSection WaitForSingleObjectEx DuplicateHandle CreateSemaphoreA ReleaseSemaphore GetSystemTimeAsFileTime TlsGetValue SetWaitableTimer WaitForSingleObject SleepEx CreateEventW CreateWaitableTimerW GetTickCount QueryPerformanceCounter GetCurrentProcessId RegisterWaitForSingleObject UnregisterWaitEx GetProcAddress FreeLibrary ResetEvent OpenEventA GetPrivateProfileStringW WritePrivateProfileStringW GlobalAlloc GlobalFree GlobalSize GlobalLock GlobalUnlock MulDiv Sleep LocalFree LocalAlloc lstrlenW FormatMessageW GetVersionExW CompareStringW CompareFileTime GetLocalTime GetTimeFormatW GetModuleHandleW WideCharToMultiByte OutputDebugStringW CreateDirectoryW SetThreadPriority WaitForMultipleObjects TlsSetValue UnregisterWait ResumeThread CreateThread GetExitCodeThread SizeofResource LockResource LoadResource FindResourceW FindResourceExW CopyFileW VirtualAlloc VirtualFree CreateFileW GetComputerNameExW FindFirstFileW SetUnhandledExceptionFilter WriteFile GetSystemDirectoryW LoadLibraryW FileTimeToSystemTime FindClose FindNextFileW FileTimeToLocalFileTime DeleteFileW GetLogicalDriveStringsW GetDriveTypeW GetFileAttributesW SetFileAttributesW GetFileSize ReadFile QueueUserAPC MoveFileExW GetTempPathW ExpandEnvironmentStringsW GetUserGeoID GetGeoInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW GetSystemInfo GlobalMemoryStatusEx GetComputerNameW MoveFileW SetFilePointer SystemTimeToFileTime GetCurrentDirectoryW MultiByteToWideChar LocalFileTimeToFileTime SetFileTime GetFileInformationByHandle CreateFileMappingW MapViewOfFile UnmapViewOfFile SetThreadAffinityMask GetCurrentThread QueryPerformanceFrequency SwitchToThread FormatMessageA CreateIoCompletionPort VerifyVersionInfoW VerSetConditionMask TerminateThread GetQueuedCompletionStatus LoadLibraryExW GetModuleFileNameW GetWindowsDirectoryW SetDllDirectoryW HeapSetInformation GetVolumeInformationW GetNativeSystemInfo OpenEventW CreateFileMappingA OpenFileMappingA MapViewOfFileEx OpenProcess WaitNamedPipeW CreateProcessW TerminateProcess GetProcessId ProcessIdToSessionId WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFilePointerEx ReleaseMutex CreateMutexW OpenMutexW GetPrivateProfileIntW GetPrivateProfileSectionW GetTimeZoneInformation SystemTimeToTzSpecificLocalTime GetDateFormatW lstrcmpiW SetThreadExecutionState SetEndOfFile GetFileAttributesExW SetErrorMode DeviceIoControl GetFullPathNameW CreateFileA FlushFileBuffers LoadLibraryA AreFileApisANSI GetPriorityClass SetPriorityClass lstrcmpW GlobalHandle GetSystemPowerStatus GetOverlappedResult GetTempFileNameW OpenThread GetComputerNameExA ExpandEnvironmentStringsA CreateSemaphoreW GetThreadTimes SetProcessShutdownParameters GetCommandLineW GetStringTypeW EncodePointer lstrlenA IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsProcessorFeaturePresent GetStringTypeExW LCMapStringW LCMapStringA GetUserDefaultLCID GetStringTypeExA GetEnvironmentVariableW RemoveDirectoryW CreateDirectoryExW WaitForMultipleObjectsEx GetLogicalProcessorInformation CreateWaitableTimerA ExitThread GetCPInfo GetCommandLineA ExitProcess GetModuleHandleExW RtlUnwind CreateTimerQueue SignalObjectAndWait GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask UnhandledExceptionFilter GetStartupInfoW IsValidLocale EnumSystemLocalesW GetConsoleCP GetConsoleMode GetStdHandle GetFileType IsValidCodePage GetACP GetOEMCP ReadConsoleW GetEnvironmentStringsW FreeEnvironmentStringsW FindFirstFileExW FreeLibraryAndExitThread VirtualProtect InterlockedFlushSList QueryDepthSList SetStdHandle WriteConsoleW SetEnvironmentVariableA PeekNamedPipe

Name

.text

Size

21.4MB

Virtual Size

21.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

818KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

298KB

Virtual Size

297KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=4, id=199, version=41118,

count=62, id=223, productName=VS2013 build 21005, version=21005,

count=9, id=225, version=20806,

count=283, id=224, productName=VS2013 build 21005, version=21005,

count=150, id=225, productName=VS2013 build 21005, version=21005,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=135, id=205, version=50522,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1017, productName=Unmarked objects (old),

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=20, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1000, id=1, productName=Unmarked objects,

count=83, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=213, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=3852, id=229, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,

TeamViewer_Desktop.exe

IMPHASH 8cf2c443f7e42f0f99568c008d9e06a1
SHA256 08ae7e2e41f7a76305e621a6ea561a8302376f36dcc8bb67e07813694e878b17
MD5 9448159d6da7b048f75da260cd92b46c
SHA1 52ff7fa4dea1297e78aae7a58e16cbb81d862411
SHA512 0071262c2104eae60a551f5c163a4096a833c4b7d63321551cb66213acf8cd9e02e0d60163cc6c52b07f8f9f36de8b1db0a277ebd998a85bb5a6f2fbf21e580c
SSDEEP 98304:h5dueGctixzy7t6rlHdC4Mq510r7rUkh09AovRDUPxPjoS34DsYUt59e3W:h5duktczcteE/Ukh0rvRoPxP/34Dsq3W
TLSH
T1D1965A80FBD3C1F7ED5301702536AB1E8575AE885B249AE3D3983E1E99312C17E37299
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fd:7a:38:9e:e7:e5:3c:ea:66:e2:2c:ed:74:bd:db:87:15:d2:8f:61

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Chains

Dec 15, 2016

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Serial Number

7e:c0:da:c3:9a:e3:64:6b:14:93:27:7f:76:1a:0e:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2016 - Mar 3, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

5

Entry point

5581091

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TeamViewer_Workspace\TeamViewer_12.0_Release\BuildTarget\QS_Release2013\TeamViewer_Desktop.pdb

kernel32

InterlockedDecrement InterlockedIncrement InterlockedCompareExchange CloseHandle InterlockedExchange WaitForSingleObjectEx CreateEventA SetEvent InterlockedExchangeAdd LeaveCriticalSection EnterCriticalSection PostQueuedCompletionStatus TlsFree GetLastError TlsAlloc TlsGetValue DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsSetValue GetCurrentProcessId OpenEventA ResetEvent GetTickCount InitializeCriticalSection GetSystemTimeAsFileTime SetWaitableTimer WaitForSingleObject SleepEx CreateEventW CreateWaitableTimerW Sleep GetCurrentThreadId QueryPerformanceCounter CreateFileW DeviceIoControl GetProcessHeap HeapFree WTSGetActiveConsoleSessionId HeapAlloc GetSystemTimes GetProcessTimes GetCurrentProcess RaiseException FlushInstructionCache SetLastError GetExitCodeProcess GetProcessId GetModuleHandleW GetModuleFileNameW LoadLibraryExA GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA GetCommandLineW GetProcessShutdownParameters SetProcessShutdownParameters DecodePointer ReleaseSemaphore DuplicateHandle CreateSemaphoreA GetProcAddress GetCurrentThread LoadLibraryW LocalAlloc LocalFree FreeLibrary HeapReAlloc FindFirstFileW SetUnhandledExceptionFilter WriteFile GetSystemDirectoryW FileTimeToSystemTime HeapSize FindClose FindNextFileW FileTimeToLocalFileTime DeleteFileW GetFileAttributesW SetThreadAffinityMask QueryPerformanceFrequency SetThreadPriority MultiByteToWideChar WideCharToMultiByte GetVersionExW GetUserGeoID GetGeoInfoW GetComputerNameW GetSystemInfo VerSetConditionMask VerifyVersionInfoW OpenProcess ReadFile ResumeThread TerminateProcess ProcessIdToSessionId RegisterWaitForSingleObject UnregisterWaitEx CreateDirectoryW LoadLibraryExW SetDllDirectoryW HeapSetInformation CreateIoCompletionPort QueueUserAPC TerminateThread WaitForMultipleObjects GetQueuedCompletionStatus SetFilePointerEx ReleaseMutex CreateMutexW OpenMutexW GetFileSize GetTimeZoneInformation GetLocalTime SystemTimeToTzSpecificLocalTime GetTimeFormatW GetDateFormatW SystemTimeToFileTime GetPrivateProfileStringW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW GlobalMemoryStatusEx SetFileAttributesW lstrcmpiW SizeofResource LoadResource FindResourceW SetThreadExecutionState GetStringTypeW EncodePointer IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsProcessorFeaturePresent VirtualAlloc VirtualFree FormatMessageA GetCurrentDirectoryW GetFileInformationByHandle GetFullPathNameW RemoveDirectoryW SetEndOfFile CopyFileW AreFileApisANSI WaitForMultipleObjectsEx GetLogicalProcessorInformation CreateWaitableTimerA LCMapStringW GetUserDefaultLCID CreateThread ExitThread GetCommandLineA RtlUnwind GetCPInfo CreateTimerQueue SignalObjectAndWait SwitchToThread GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask UnregisterWait UnhandledExceptionFilter GetStartupInfoW CreateSemaphoreW CompareStringW IsValidLocale EnumSystemLocalesW ExitProcess GetModuleHandleExW IsValidCodePage GetACP GetOEMCP GetStdHandle GetFileType GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetConsoleCP GetConsoleMode GetThreadTimes FreeLibraryAndExitThread VirtualProtect InterlockedFlushSList QueryDepthSList SetStdHandle WriteConsoleW ReadConsoleW SetEnvironmentVariableA GetPrivateProfileIntW GetPrivateProfileSectionW WritePrivateProfileStringW UnmapViewOfFile CreateFileMappingA OpenFileMappingA MapViewOfFileEx OpenEventW GetExitCodeThread FindFirstFileExW GetDriveTypeW PeekNamedPipe

Name

.text

Size

6.7MB

Virtual Size

6.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

143KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

282KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

277KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=4, id=199, version=41118,

count=50, id=223, productName=VS2013 build 21005, version=21005,

count=7, id=225, version=20806,

count=266, id=224, productName=VS2013 build 21005, version=21005,

count=144, id=225, productName=VS2013 build 21005, version=21005,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=104, id=205, version=50522,

count=79, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=877, productName=Unmarked objects (old),

count=169, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=625, id=1, productName=Unmarked objects,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=733, id=229, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,

TeamViewer_Note.exe

IMPHASH 56bf10cebc85e6d3c9cd72f2e843fd49
SHA256 e6cd8cd5a2cdc68f51225790fb611137d5e2166213d9cd24a1fcc3e31b90e9f7
MD5 6167289a8de15cc4a0147a9b0985c7a6
SHA1 1914a56e5ae440533bf837f6bbe31e4eda4ca3d6
SHA512 97e3766f39b239988669beba70f8e0a9f61c6f422be8aaa7e7efdc1fffa80fcfb230d3e7eeffbff3bb1617a7b7e9d6b0bd3d46d9acbbd49b98702bbfd615be8e
SSDEEP 3072:Rps9BQ8cAqdMP+RL+yiimZ9qUkiZAmV4WbV8vp/uDdOR11xC:mBQ8xB+L+yUCYV4WZMcDdCLC
TLSH
T13714AE1176C0C071E8A6423288B8AFF3557DFD728B7019DBB3C43A5E69755D01A3ABA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fb:10:33:8f:2d:61:ce:6e:6c:61:80:72:86:df:42:4a:46:47:c3:a3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Chains

Dec 15, 2016

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Serial Number

7e:c0:da:c3:9a:e3:64:6b:14:93:27:7f:76:1a:0e:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2016 - Mar 3, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

5

Entry point

33982

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TeamViewer_Workspace\TeamViewer_12.0_Release\Installer\Tools\LeaveNote\LeaveNote\Release\TeamViewer_Note.pdb

kernel32

LoadLibraryExA GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA GetModuleFileNameW GetCurrentProcess FlushInstructionCache SetLastError EnterCriticalSection LeaveCriticalSection GetCurrentThreadId RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetFileAttributesW CreateFileW CloseHandle SetDllDirectoryW HeapSetInformation GetSystemDirectoryW LoadLibraryExW GetProcAddress FreeLibrary ResetEvent OpenEventA GetCurrentProcessId SetEvent CreateEventA WaitForSingleObjectEx VerSetConditionMask VerifyVersionInfoW DecodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsProcessorFeaturePresent VirtualAlloc VirtualFree IsDebuggerPresent OutputDebugStringW LocalFree FormatMessageA EncodePointer GetCommandLineW RtlUnwind ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetStdHandle GetFileType GetStartupInfoW WriteFile QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo LCMapStringW GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode SetStdHandle SetFilePointerEx WriteConsoleW

TeamViewer_Resource_pl.dll

SHA256 eeaff063bc5483bfe1dbc0d248ff6eded799be4b7556b2e59103d8179baa90f9
MD5 4f7b9f47d8e2a0175e2ba468ad453706
SHA1 18770d0fd055b0aca5856e1a5a1dd3403f4dbe7d
SHA512 b5adc00f72a15cfac1b7562910807d9e3f63bec0eaf5dc8bde3b1a8813f295f65321644eff4d0297d9d0cd0540091949cd7a217770ad0e0de2f3ebc499b7ba1b
SSDEEP 3072:v079NYVUTMDZi5GfqPpt5aODeWy9vZA6UOEtB/djMP9P8BPV3jfT7Yfo8O+11:sDMDZidPpmVxPB8A9OG1
TLSH
T1C4E4DC5063F90297F5F36F34DAB522A44A3B7DE2B9B489EE1540720C09706D8DA25B3F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

0e:12:34:d4:f5:7d:02:b7:4b:9b:1a:af:70:75:b5:ba:e0:9f:aa:55

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Chains

Dec 15, 2016

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Serial Number

7e:c0:da:c3:9a:e3:64:6b:14:93:27:7f:76:1a:0e:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2016 - Mar 3, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

TeamViewer_Service.exe

IMPHASH 22714a494f5ae6fac115d7dba69c5f0e
SHA256 cb352f4c852de75c3f2bbfb3a7b9412687cacee2cb18a3f20c6b4f6dc90baf4c
MD5 a3e61244246bba5d12bd241aa44dd33b
SHA1 0a4cb412a21722e0ff8a432ad3fe6dc3f0ab560f
SHA512 fc95f0d26e0b5d0afe8f4b55014796eca779119cce5d1e303ff07406731ea220bdfe6b1ea9f870bf5bdfa738cee6602584c6480d4f613ad93d993a072fd06b9d
SSDEEP 98304:m6CpGbLzIHSYLxRJa/LhleKF8HA9Kzbg2+WmY8+S:wGvz6Swa/LXiHEibgbZd
TLSH
T1F5862B00FB97C1B2EE5315B02676D75DC47AAD841B345FE7C2483E2E99306C1B93B2A9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

6e:d3:fe:80:8b:45:0a:26:a4:78:9d:af:81:b6:8f:ee:7e:75:d5:f2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Chains

Dec 15, 2016

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Serial Number

7e:c0:da:c3:9a:e3:64:6b:14:93:27:7f:76:1a:0e:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2016 - Mar 3, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

5

Entry point

4937087

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TeamViewer_Workspace\TeamViewer_12.0_Release\BuildTarget\QS_Release2013\TeamViewer_Service.pdb

kernel32

InterlockedDecrement GetCurrentThreadId GetModuleFileNameW InterlockedIncrement LoadLibraryExA GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA GetLastError lstrcmpiW SetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection DecodePointer GetModuleHandleW RaiseException LeaveCriticalSection EnterCriticalSection FreeLibrary GetProcAddress MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW InterlockedCompareExchange SetEvent CreateEventA InterlockedExchange InterlockedExchangeAdd PostQueuedCompletionStatus TlsAlloc CloseHandle TlsFree Sleep InitializeCriticalSection HeapReAlloc FindFirstFileW HeapAlloc SetUnhandledExceptionFilter GetCurrentProcess HeapFree GetProcessHeap WriteFile GetSystemDirectoryW LoadLibraryW FileTimeToSystemTime CreateFileW HeapSize FindClose FindNextFileW FileTimeToLocalFileTime DeleteFileW GetCurrentProcessId WaitForSingleObjectEx GetTickCount MoveFileExW CreateDirectoryW GetSystemTimeAsFileTime TlsGetValue SetWaitableTimer WaitForSingleObject SleepEx CreateEventW CreateWaitableTimerW OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW LocalFree WaitNamedPipeW ReadFile ResumeThread CreateProcessW TerminateProcess GetProcessId ProcessIdToSessionId WTSGetActiveConsoleSessionId RegisterWaitForSingleObject UnregisterWaitEx ResetEvent OpenEventA SetDllDirectoryW HeapSetInformation GetFileAttributesW GetSystemInfo SetFilePointerEx ReleaseMutex CreateMutexW OpenMutexW GetFileSize GetVersionExW GetUserGeoID GetGeoInfoW GetComputerNameW WideCharToMultiByte GetTimeZoneInformation GetLocalTime SystemTimeToTzSpecificLocalTime GetTimeFormatW GetDateFormatW SystemTimeToFileTime VerSetConditionMask VerifyVersionInfoW GetNativeSystemInfo GetPrivateProfileStringW DuplicateHandle CreateSemaphoreA ReleaseSemaphore CreateIoCompletionPort QueueUserAPC TerminateThread WaitForMultipleObjects GetQueuedCompletionStatus TlsSetValue SetThreadPriority QueryPerformanceCounter SetFileAttributesW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW GlobalMemoryStatusEx SetFilePointer GetSystemPowerStatus IsDebuggerPresent OutputDebugStringW GetStringTypeW EncodePointer FormatMessageA LoadLibraryA LCMapStringW LCMapStringA GetUserDefaultLCID GetStringTypeExA GetCurrentDirectoryW GetFileInformationByHandle GetFullPathNameW RemoveDirectoryW SetEndOfFile DeviceIoControl CopyFileW AreFileApisANSI WaitForMultipleObjectsEx GetLogicalProcessorInformation CreateWaitableTimerA IsProcessorFeaturePresent GetCommandLineW RtlUnwind CreateThread ExitThread GetCPInfo CreateTimerQueue SignalObjectAndWait SwitchToThread GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask UnregisterWait UnhandledExceptionFilter GetStartupInfoW CreateSemaphoreW CompareStringW IsValidLocale EnumSystemLocalesW GetCurrentThread ExitProcess GetModuleHandleExW GetStdHandle GetFileType GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetConsoleCP GetConsoleMode IsValidCodePage GetACP GetOEMCP GetThreadTimes FreeLibraryAndExitThread VirtualAlloc VirtualFree VirtualProtect InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList SetStdHandle WriteConsoleW ReadConsoleW SetEnvironmentVariableA ExpandEnvironmentStringsA QueryPerformanceFrequency GetPrivateProfileIntW GetPrivateProfileSectionW WritePrivateProfileStringW LocalAlloc GetVolumeInformationW UnmapViewOfFile CreateFileMappingA OpenFileMappingA MapViewOfFileEx OpenEventW GetExitCodeThread GetOverlappedResult FindFirstFileExW GetDriveTypeW PeekNamedPipe lstrlenA

Name

.text

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

200KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

281KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

312KB

Virtual Size

312KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=3, id=199, version=41118,

count=48, id=223, productName=VS2013 build 21005, version=21005,

count=269, id=224, productName=VS2013 build 21005, version=21005,

count=7, id=225, version=20806,

count=147, id=225, productName=VS2013 build 21005, version=21005,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=45, id=205, version=50522,

count=126, productName=Unmarked objects (old),

count=70, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=71, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=468, id=1, productName=Unmarked objects,

count=669, id=229, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,

TeamViewer_StaticRes.dll

SHA256 c917e01bfa61d9f98fb21a4fd416a27c0dd1e063cff711bed9b23339f6ae3556
MD5 b8fa15355c889d14dff87fa723c336e1
SHA1 ff33f4fab283d9ba75088c755931ecc49223e640
SHA512 9fda6621e50d72290b14671f78b7f634234321ddb8bf9cad27f3bef88eedb18ac07a6c431143fe2c39e1d719cd2b5efff79556482688f554aeb81a556d00d0ff
SSDEEP 24576:gxKYX3aB3IZCG6qVeSVms1oyQWdaqevJ+eb7Ll:MnaIBLGyHeh+eZ
TLSH
T1A755CFD3EEA1ACA5D44E613385DC4800DDA39DD7BE221A1FBA8DB86D4F313885EC1647
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

9b:7b:17:06:fe:07:ff:9b:bb:cc:83:6e:38:58:47:e4:a1:7f:ec:0f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Chains

Dec 15, 2016

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Serial Number

7e:c0:da:c3:9a:e3:64:6b:14:93:27:7f:76:1a:0e:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2016 - Mar 3, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

tv_w32.dll

IMPHASH a077d161ae6ed5f6d18334aa1cc3ddd0
SHA256 66f1a2040a1fe4e08e3354db8ca896d123d6ada86d8885ce75b2d3128e5aafab
MD5 7a41da04d8845f15d45a48ee41456ff0
SHA1 05a367a773891015fa5c79758e0c5acd0dbfe92f
SHA512 06422cac12efe9d92b79824265f7f763d996234fc144ffed52f8d7f00c3a2928ec61fcaa21f44e1de73b1f2e603826ddcf46505c6b37d12621eb4761d7a16da2
SSDEEP 3072:7WET2auTvFxV7KE5yHgMNH9V4pu9YyThfQkog2DEciSsrL7Mz0njVDs+:7WET2auHMNP4ofY9gZGUFs+
TLSH
T1E3347D017587C930E0B3027A5528FB920A7E7EB64B35A8CF67E529BD49744C076B9B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f8:d0:bf:d8:f6:65:19:44:53:7e:ca:07:37:18:3b:83:fd:c1:79:bc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Chains

Dec 15, 2016

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Serial Number

7e:c0:da:c3:9a:e3:64:6b:14:93:27:7f:76:1a:0e:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2016 - Mar 3, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

5

Entry point

73977

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\TeamViewer_Workspace\TeamViewer_12.0_Release\BuildTarget\Release2013\tv_w32dll.pdb

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

comctl32

InitCommonControlsEx

kernel32

CloseHandle GetCurrentProcessId GlobalLock InitializeCriticalSection GetVersionExW LeaveCriticalSection FileTimeToSystemTime GlobalUnlock EnterCriticalSection GetFileAttributesExW DeleteCriticalSection FreeLibrary GetSystemDirectoryA LoadLibraryA GetLocalTime GetCurrentThreadId InterlockedCompareExchange Thread32First GetExitCodeProcess Thread32Next InterlockedExchange OpenMutexW DisableThreadLibraryCalls OpenThread GetModuleFileNameA SuspendThread ResumeThread LoadLibraryW Sleep GetModuleFileNameW FreeLibraryAndExitThread CreateThread CreateMutexW MapViewOfFile UnmapViewOfFile VirtualQuery InterlockedIncrement VerSetConditionMask InterlockedDecrement GetCurrentProcess WaitForSingleObject SetEvent GetTickCount IsBadReadPtr IsBadWritePtr VerifyVersionInfoW CreateFileMappingW CreateEventW OpenFileMappingW ReleaseMutex LocalFree Module32Next LocalAlloc Module32FirstW Module32NextW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetStringTypeW FatalAppExitA SetFilePointerEx GetConsoleMode GetConsoleCP WriteFile FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetFileType GetStdHandle AreFileApisANSI GetModuleHandleExW ExitProcess GetCurrentThread SetConsoleCtrlHandler WideCharToMultiByte MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage CreateSemaphoreW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter DecodePointer EncodePointer GetCommandLineA IsProcessorFeaturePresent IsDebuggerPresent LoadLibraryExW RtlUnwind HeapReAlloc SetStdHandle WriteConsoleW QueryPerformanceFrequency CreateToolhelp32Snapshot VirtualProtect GetModuleHandleA VirtualAlloc GetLastError Module32First OpenProcess CreateRemoteThread GetProcessHeap VirtualFree GetModuleHandleW HeapFree QueryPerformanceCounter HeapAlloc GetProcAddress OutputDebugStringW HeapSize FlushFileBuffers SetLastError CreateFileW

user32

FindWindowW ClientToScreen GetUpdateRect GetDC GetDesktopWindow FindWindowExW MapWindowPoints EndPaint IsIconic PostMessageW IsZoomed TrackMouseEvent GetWindowInfo GetClientRect BeginPaint InvalidateRect GetWindowLongW SystemParametersInfoW GetClassNameW SetWindowLongW RedrawWindow GetSysColor ShowWindow LoadBitmapW GetActiveWindow GetSystemMetrics SendMessageW CallWindowProcW IsRectEmpty GetWindowRect GetWindowDC ReleaseDC SetWindowPos IsWindow IsWindowVisible LoadCursorW GetClassInfoExW RegisterClassExW SendNotifyMessageW SetTimer RegisterWindowMessageW UnregisterClassW KillTimer CallNextHookEx SendMessageTimeoutW SetWindowsHookExW UnhookWindowsHookEx RegisterClipboardFormatW DefWindowProcW DestroyWindow CreateWindowExW GetWindow

gdi32

GetObjectW CreateCompatibleBitmap SetPixel MoveToEx Polyline GetPixel CreateSolidBrush Rectangle CreatePen GetStockObject BitBlt DeleteDC CreateDIBSection GdiFlush DeleteObject SelectObject CreateCompatibleDC ExtCreatePen RectVisible LineTo

shell32

DragQueryFileW

ole32

CoUninitialize CoInitialize CoCreateInstance ReleaseStgMedium

Name

.text

Size

169KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.shared

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

tv_w32.exe

IMPHASH 466d4e694fad427f2ce7eaccabdec5de
SHA256 40535e5d76eaec277089c24578925bdf8efd42e0be015285cce4897f41eedb05
MD5 b2e31add16c2e3e8408330443839c1fd
SHA1 2ba56ea53c3b1fb544e5cb6dc3fbe94c9c24a57b
SHA512 1fd8a838bc14a6bff6d097c0d1ee05bea59be242dc78dd9ce68d54bc503d6e7dc5af3ee570df904b027caa1dd83a5b6ea5d784e525bfab6a75e1b815dadc8b71
SSDEEP 3072:C9StClW7Bn2MDna3x9EcjmBwJGwrL+kSxYOh/uIeh70gHip86QAgvKYP8G:C9StrIVnr6kL+JCqD1pgvKYP8G
TLSH
T1D5349D017B91C032E57302B74AAA9B26057CFC224B765AD7E7D80F0EDA346D1A736727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a1:d7:33:78:e7:a7:66:1a:ae:19:21:49:73:40:72:e7:68:b6:a5:52

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Chains

Dec 15, 2016

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Serial Number

7e:c0:da:c3:9a:e3:64:6b:14:93:27:7f:76:1a:0e:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2016 - Mar 3, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

5

Entry point

100415

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TeamViewer_Workspace\TeamViewer_12.0_Release\BuildTarget\Release2013\tv_w32exe.pdb

setupapi

SetupDiGetDeviceInfoListDetailW SetupDiSetClassInstallParamsW SetupUninstallOEMInfW SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiCallClassInstaller SetupDiGetClassDevsExW CM_Get_Device_ID_ExW

kernel32

VerifyVersionInfoW GetLastError SetLastError CreateEventW CloseHandle GetWindowsDirectoryW DeleteFileW FreeLibrary GetProcAddress LoadLibraryA GetModuleFileNameA GetSystemDirectoryW LoadLibraryW SetWaitableTimer OpenMutexW CreateWaitableTimerW CreateFileW SetFilePointer InterlockedIncrement InterlockedDecrement WaitForSingleObject WriteFile GetLocalTime GetCurrentThreadId ReleaseMutex GetCurrentProcessId GetCommandLineW GetCurrentProcess GetSystemDirectoryA GetModuleHandleA LoadLibraryExA GetModuleFileNameW ReadFile CopyFileW Sleep GetTickCount SetEvent MoveFileExW VerSetConditionMask LoadLibraryExW GetConsoleCP GetConsoleMode SetFilePointerEx OutputDebugStringW SetStdHandle WriteConsoleW FlushFileBuffers CreateMutexW RaiseException WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection IsDebuggerPresent IsProcessorFeaturePresent HeapFree GetCommandLineA RtlUnwind GetCPInfo HeapAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW HeapSize IsValidCodePage GetACP GetOEMCP GetProcessHeap GetStdHandle GetFileType QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc

advapi32

RegCloseKey RegSetValueExW RegOpenKeyExW CryptHashData CryptDestroyHash ControlService QueryServiceStatusEx CryptCreateHash RegOpenKeyW RegQueryValueExW CryptReleaseContext OpenServiceW OpenSCManagerW DeleteService CryptAcquireContextW CloseServiceHandle CryptGetHashParam

tv_x64.dll

IMPHASH 58e7de7ac2944a8a58bfd8063614cb66
SHA256 8d6c45de7afc008ad2bac1a0ab364c21844f5aefd23ec7562f46c445243a3178
MD5 3c09a063e09c15d85d286c6787fcc982
SHA1 197fa541b14bda5aeeaf16bc058fc78864002dae
SHA512 2f3501b2455a0e189864e34c8e30e625a44f7233195685d32d273dc30c12c94d9e63d18bcec07f49aa1c4ff71052fc9e9f4465ec7ed258fed04f25bc87d8bf6e
SSDEEP 3072:Lu6mJ+i7pFk1pQTcZVywO74hN7TjTgUZTPkzQ4+aQ1XhqhfCd7uVH8oMJpK+dIUQ:vK+sSfQoZVyynT9Z4zV+pZhq2yusqQ
TLSH
T113444B55B3910CFAE8639239C963D641DA727C520371E7CF03E492A91E336D1BA3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

72:93:3e:96:57:37:1a:a3:c2:9c:2d:6d:d1:e5:a0:b9:bf:63:bc:61

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Chains

Dec 15, 2016

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Serial Number

7e:c0:da:c3:9a:e3:64:6b:14:93:27:7f:76:1a:0e:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2016 - Mar 3, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

80356

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\TeamViewer_Workspace\TeamViewer_12.0_Release\BuildTarget\Release2013\tv_x64dll.pdb

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

comctl32

InitCommonControlsEx

kernel32

CloseHandle GetCurrentProcessId GlobalLock InitializeCriticalSection GetVersionExW LeaveCriticalSection FileTimeToSystemTime GlobalUnlock EnterCriticalSection GetFileAttributesExW DeleteCriticalSection FreeLibrary GetSystemDirectoryA LoadLibraryA GetLocalTime GetCurrentThreadId Thread32First Thread32Next OpenMutexW DisableThreadLibraryCalls OpenThread GetModuleFileNameA SuspendThread ResumeThread LoadLibraryW Sleep GetModuleFileNameW FreeLibraryAndExitThread CreateThread CreateMutexW MapViewOfFile UnmapViewOfFile VirtualQuery VerSetConditionMask WaitForSingleObject SetEvent GetTickCount IsBadReadPtr IsBadWritePtr VerifyVersionInfoW CreateFileMappingW CreateEventW OpenFileMappingW ReleaseMutex LocalFree SetLastError LocalAlloc GetUserDefaultLCID Module32Next GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetStringTypeW FatalAppExitA SetFilePointerEx GetConsoleMode GetConsoleCP WriteFile RtlUnwindEx FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetFileType GetStdHandle AreFileApisANSI GetModuleHandleExW ExitProcess GetCurrentThread WideCharToMultiByte MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW CreateSemaphoreW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DecodePointer EncodePointer GetCommandLineA IsProcessorFeaturePresent IsDebuggerPresent SetConsoleCtrlHandler LoadLibraryExW HeapReAlloc SetStdHandle QueryPerformanceFrequency CreateToolhelp32Snapshot VirtualProtect GetModuleHandleA VirtualAlloc GetLastError Module32First OpenProcess CreateRemoteThread GetProcessHeap VirtualFree GetModuleHandleW HeapFree QueryPerformanceCounter HeapAlloc GetProcAddress OutputDebugStringW HeapSize FlushFileBuffers IsValidLocale CreateFileW WriteConsoleW

user32

ClientToScreen FindWindowW GetUpdateRect GetDC GetDesktopWindow FindWindowExW MapWindowPoints EndPaint IsIconic PostMessageW IsZoomed TrackMouseEvent GetWindowInfo GetWindowLongPtrW GetClientRect BeginPaint InvalidateRect SystemParametersInfoW GetClassNameW RedrawWindow GetSysColor ShowWindow GetActiveWindow GetSystemMetrics SetWindowLongPtrW SendMessageW CallWindowProcW GetWindow IsRectEmpty GetWindowRect GetWindowDC ReleaseDC SetWindowPos IsWindow IsWindowVisible LoadCursorW GetClassInfoExW RegisterClassExW SendNotifyMessageW SetTimer RegisterWindowMessageW UnregisterClassW KillTimer CallNextHookEx SendMessageTimeoutW SetWindowsHookExW UnhookWindowsHookEx RegisterClipboardFormatW DefWindowProcW DestroyWindow CreateWindowExW LoadBitmapW

gdi32

LineTo MoveToEx ExtCreatePen SetPixel CreateCompatibleBitmap GetObjectW Polyline GetPixel CreateSolidBrush Rectangle CreatePen GetStockObject BitBlt DeleteDC CreateDIBSection GdiFlush DeleteObject SelectObject CreateCompatibleDC RectVisible

shell32

DragQueryFileW

ole32

CoUninitialize CoInitialize CoCreateInstance ReleaseStgMedium

Name

.text

Size

171KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.shared

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

tv_x64.exe

IMPHASH 65875178d6c608dcd2b2cfbe75dffe0b
SHA256 02348a9bcfd2ee3b07a4fcd4575b3774f777ec9c01cc674aeaae113a87d1e02f
MD5 fc1ec1e1f5b894f21f994563ee0deb5c
SHA1 9afa1cb08f46611c0bffda15eecda1e148ef24a6
SHA512 2b1146ebe451f49169281972daa8d617c3f73a51c79063b345d55989582b8c33f80105d4697a177ddcd4465224c502e125e779b79788beb7dfb9e99923673a6d
SSDEEP 6144:Uh8xauaWN2e86lr0RL2TVX+QxUL3zruMA4Nx:g8Aufb86loLOSuy
TLSH
T1BE544A0932A40CF5DD67C23D8D928542E7B2B85A4771D7DF13A4029E5F37AE09E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

03:59:7e:8b:e3:a3:50:7f:e4:04:bc:de:5a:da:97:cf:e2:f5:74:f9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Chains

Dec 15, 2016

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Serial Number

7e:c0:da:c3:9a:e3:64:6b:14:93:27:7f:76:1a:0e:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2016 - Mar 3, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

106892

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\TeamViewer_Workspace\TeamViewer_12.0_Release\BuildTarget\Release2013\tv_x64exe.pdb

setupapi

SetupDiGetDeviceInfoListDetailW SetupDiSetClassInstallParamsW SetupUninstallOEMInfW SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiCallClassInstaller SetupDiGetClassDevsExW CM_Get_Device_ID_ExW

kernel32

VerifyVersionInfoW GetLastError SetLastError CreateEventW CloseHandle GetWindowsDirectoryW DeleteFileW FreeLibrary GetProcAddress LoadLibraryA GetModuleFileNameA GetSystemDirectoryW LoadLibraryW SetWaitableTimer CreateFileW CreateWaitableTimerW CreateMutexW SetFilePointer WaitForSingleObject WriteFile GetLocalTime GetCurrentThreadId ReleaseMutex GetCurrentProcessId GetCommandLineW GetCurrentProcess GetSystemDirectoryA GetModuleHandleA LoadLibraryExA GetModuleFileNameW ReadFile CopyFileW Sleep GetTickCount SetEvent MoveFileExW VerSetConditionMask LoadLibraryExW GetConsoleCP GetConsoleMode SetFilePointerEx OutputDebugStringW SetStdHandle WriteConsoleW FlushFileBuffers OpenMutexW RaiseException WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection IsDebuggerPresent IsProcessorFeaturePresent HeapFree GetCommandLineA RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx GetCPInfo HeapAlloc RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW HeapSize IsValidCodePage GetACP GetOEMCP GetProcessHeap GetStdHandle GetFileType QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc

advapi32

RegCloseKey RegOpenKeyExW CryptHashData CryptDestroyHash ControlService QueryServiceStatusEx CryptCreateHash RegOpenKeyW RegQueryValueExW CryptReleaseContext OpenServiceW OpenSCManagerW DeleteService CryptAcquireContextW CloseServiceHandle CryptGetHashParam RegSetValueExW

uninstall.exe

IMPHASH 4ea4df5d94204fc550be1874e1b77ea7
SHA256 b7e7d2f2e1cd2d519183cb173aca882ff735114cbe6c1120cdb73e93364743f5
MD5 7fb082f0c4f42ee21681ac897fdf6b36
SHA1 67f83a1e7bf89eec76e0c83f80137e58be1790de
SHA512 fb4917d6694cc500b49ece56647dc895fdb22602f446a7fab504dbf0ba6cee112080767a278b884cfc12cbf76b3ecc5a4b11382a4a68965ebc8ca54946cd385b
SSDEEP 3072:0Ae+3aJpqWXTBum5GfqP/bbIa8h3Q7IO1r/ImdOiXFA+/xarG3bF/:nB+pqUFdPT9h7jum2+/xcGB/
TLSH
T1C99463E9D7E356D3F8326E36CB91523460323EC9A4E46DF556C8B72C49301DEA21E92C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d0:81:59:de:76:55:cf:45:03:42:e3:f0:e1:b0:80:76:1f:88:8b:63

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Chains

Dec 15, 2016

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=TeamViewer GmbH,O=TeamViewer GmbH,L=Goeppingen,ST=Baden-Wuerttemberg,C=DE

Serial Number

7e:c0:da:c3:9a:e3:64:6b:14:93:27:7f:76:1a:0e:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2016 - Mar 3, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

13238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode WaitForSingleObject GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GetDiskFreeSpaceW lstrlenW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/FindProcDLL.dll

IMPHASH e26d7460d0c04056b9226a899477ba4d
SHA256 6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9
MD5 6f73b00aef6c49eac62128ef3eca677e
SHA1 1b6aff67d570e5ee61af2376247590eb49b728a1
SHA512 678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938
SSDEEP 384:DZoRF0XXUuJReQg0Tw67ADWBTgmldIogUD3GLgFmyaX/fVYcWJQCDmrinogRdBl:DZaF0HtTwuz9yu3KgwRX1nWJ1q+noI
TLSH
T12DC26C107C9042B7D28E5671A1E50F075B3F6E512AE65883CF256ADA2D612F0FA3F31B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6100

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/KillProcDLL.dll

IMPHASH d806a080e21508dd768fa70be247d2ae
SHA256 de1177a4bd1c56c3555f366d40b37d7dd9cb25e16c4973d0a4d22bf9a8af7aed
MD5 1cc87d2b5a79b18f133b4f944e2f2f74
SHA1 98e0ddb727c76e06be1668434d754e5b80a0c154
SHA512 d8fee1c09fef9af4e1f38baaffa3a6d059713b14ecad900815c086cc22855644fcdeacd6bba31ea6e6925831e650f7b0d34e6dea4c57a978fb4f5bf0cd6d72a9
SSDEEP 384:JLmJwO50x66T9JOpOUT38YZvml7xoKdyuwlx8xSiorppugBwUdJopS:JW50hJwwUTsXdPwxvtpDtdJo
TLSH
T1DFF26C507C8144F7C28E4235A5A9AB179FBF692036E55983CF269EDA1C311F0E93B307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6841

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
TLSH
T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/TvGetVersion.dll

IMPHASH 5fb69f8721fcb2adbb1c41cc9672c106
SHA256 f89a02e858183d373d35dfffc21359acf3d45eb96f8206c3581ba05ce49d2023
MD5 b1c0c4b14c3b6787ab1e1e4f91579c4a
SHA1 f099b16e9e33decafee22da17574771968565c58
SHA512 76718483b8f07704409a69b9a4613e9fc48fad0dc0b9dd9f435e44d1f174dce6ae8eec56c94e24b0a289aa78c5421e2258f977c12182e1422570fd33f1cf463b
SSDEEP 1536:VngJZsOHXEFxQplfzbTJ7nKdgw5TLTKbZYVo+vwCgQCQKDnjBhEKiuqX2sE2OGWl:Vg/sO0ghLQMp+GQCQ61sE3GWYy
TLSH
T17EF3191133F08035F5F72A78ACF4C6608E7ABD32AA34D14EE750C96A2970B85DA75727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

42366

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

StrChrW StrRChrW

wtsapi32

WTSEnumerateProcessesW WTSFreeMemory

msi

ord45 ord141 ord16 ord70

psapi

GetProcessImageFileNameW

kernel32

lstrcmpiA lstrcpynA lstrlenA lstrcpyW lstrcpynW Sleep GetVersionExW LocalFree FreeLibrary LoadLibraryW GetExitCodeProcess WaitForSingleObject CreateProcessW OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot TerminateProcess DeleteFileW GetWindowsDirectoryW GetTempPathW InterlockedDecrement WideCharToMultiByte GetModuleFileNameW MultiByteToWideChar RtlUnwind CreateDirectoryW FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExW MoveFileW GetCurrentThreadId DecodePointer GetCommandLineA EncodePointer HeapAlloc RaiseException HeapFree IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess GetDriveTypeW LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage TlsAlloc lstrcpyA TlsSetValue TlsFree SetLastError GetFullPathNameW GetFileInformationByHandle PeekNamedPipe GetFileType GetCurrentDirectoryW ExitProcess CreateFileW GetStdHandle GetStartupInfoW DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime HeapSize WriteFile SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer LCMapStringW GetStringTypeW SetEndOfFile GetProcessHeap GetTimeZoneInformation HeapReAlloc WriteConsoleW CompareStringW SetEnvironmentVariableA GetFileSize GlobalAlloc ReadFile CloseHandle GlobalFree lstrlenW TlsGetValue lstrcatW GetLastError GetCurrentProcessId GetModuleHandleW GetProcAddress VerSetConditionMask VerifyVersionInfoW lstrcmpiW EnterCriticalSection SetHandleCount

user32

GetSystemMetrics wsprintfW SendMessageW PostMessageW

gdi32

AddFontResourceExW RemoveFontResourceExW

winspool.drv

EnumPrintProcessorsW EnumPrinterDriversW

advapi32

RegQueryValueExW RegSetValueExW RegCloseKey RegEnumKeyExW RegDeleteKeyW GetUserNameW LookupAccountNameW ConvertSidToStringSidW DeleteService RegOpenKeyExA RegQueryValueExA OpenProcessToken OpenSCManagerW OpenServiceW CloseServiceHandle QueryServiceStatus RegEnumValueW RegCreateKeyExW RegOpenKeyExW RegFlushKey ChangeServiceConfig2W RegDeleteValueW AdjustTokenPrivileges LookupPrivilegeValueW ControlService StartServiceW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CLSIDFromString CLSIDFromProgID CoCreateInstance OleRun

oleaut32

SysAllocString SysFreeString GetErrorInfo

$_3_/tvqsfilesx64.7z

SHA256 b4a0f78cb61ce7d34c4694f926d2c19cd344fd40c64126c54f10815391ad2071
MD5 6199d99a17f8c7e568e818167212f081
SHA1 c077ab6f625a2c6a49bc74525ab452c88380bcf4
SHA512 59f0048ccdf32b6f40aed7a4eaddbe9784ec030a28449fda3f9744695b5cabe2d82156cc19cdaea8adf3e94dd33a05983771826b75b299fbed749275a7e4b997
SSDEEP 192:zWFeji1YNx+29+ohg8l8TuR1OBwNPGaJR6FiB/G:w2i1YN829+ohg9TuR1K8GaJ8kB/G
TLSH
T18612AF3A03212C64A4DFE0F635E54841FDAF057DF91E6A94C629E15A01DE60D3532969
MD5 SHA1 SHA512 SSDEEP TLSH

x64/TVMonitor.inf

SHA256 42f110315431a9f50a624539963cbd70b102e0c8335d27307dd0a5078e194c62
MD5 48d7a9a9dfbe1e37249f6c68858d8fa5
SHA1 bec7f73c3cc5ad3baa94aaca124a1565f79150f0
SHA512 accc22821d6f7863ea6d2fb0f41a0b61b3060255fd44964641c8fbc6ddfa0cefb216b16c481ee5df6c3f148a239f71ca8f53fcb375bd938c7934e1d68979222b
TLSH
T144317379014B553AE80372367D5B7742729A3002B0E58965B1ECC2D1BBAAD1C6B262FF
MD5 SHA1 SHA512 TLSH

x64/TVMonitor.sy_

IMPHASH f24b69173de020aa0ac1739d7b40e04c
SHA256 05d30728d7204aba2437259ecf929a94e6573f7621baf35d76eba26f5489a6cf
MD5 95314c3a08589471983c2c8173f23cda
SHA1 a84b8b7c7c08f4642655e2f1df9161b8d3b0b665
SHA512 200c9af5a7ac032bcbde1830001f2c7cf4e9dd02b964a6bbdf7fe5e4bd29cd152a4fbea3bac53defa9f321e0417af3d170900ab3de390fcfc1d411237d238c06
SSDEEP 384:PxWDUVvF0r2UHKZCmYFJulYJLWOtbeFV6jlV:k0vFGXH7XuAL/beFVmP
TLSH
T17F7208E707645466ECE78B36C5E6CAB36D71F1906F9281DF0025819A2D42BF43B3E21B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Chains

Nov 25, 2010

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Serial Number

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 16, 2008 - Feb 22, 2011

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

1

Major OS version

6

Entry point

24676

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

j:\teamviewer6.0\monitordriver\objfre_wlh_amd64\amd64\TVMonitor.pdb

Name

.text

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

204B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x64/tvmonitor.cat

SHA256 6a030521959eb55a163b0f81655b10014ed82c26089e5c3485284cde743b0bdc
MD5 fd3c85415503d2660d6314f2606ddc83
SHA1 cd941001cc9e3abccfe2130b65bd89b7ede75248
SHA512 f9ce70b52a6534743081ec84ab5428d0015246dc0c1b1087e6c3429c07388f6c72a487a720c87840867503554eeca3c8c5f9fe1323edb33ce7be2d7d63d341cd
SSDEEP 192:CZZSOt93yowJL/aMjGwP7QM3PXD+ebMdHFVZgjlRM1E7:oZSG3YJLWOtbeFV6jWK
TLSH
T1D9F1F8D7071528A1ECC58F61C1EAE86BAD72F3C66DC011AA1079C6E62E837F5374940F
MD5 SHA1 SHA512 SSDEEP TLSH

$_3_/tvqsfilesx86.7z

SHA256 fd3dbb9f3a16acda71bc4db401af2c0489e86bd10586c1cc2356cb7ae6e7ae8e
MD5 974957c87b309a843c3962ee86dcce68
SHA1 18cebe7a7b36b727529abc2c1a28b3bed9bb56cb
SHA512 3fbfa092a5e533576e99885460a0055162b01b23a4818aed9c512a22d1df851a9c478c6a21d100571d3b51a4232808cbc0db5e635904477ec62dddb7fa339be4
SSDEEP 192:9aq9K8uNmIVcoVBZ9GVcwjSiJoIzFvPMlcLQNIbilZUIh1+:9ax82csBZ9URJJdz6+/bdIh1+
TLSH
T17F02C02B2E6A0F6982B16235A1B768429BDC5E3C5F903914F0156AE40D9DE3370278CF
MD5 SHA1 SHA512 SSDEEP TLSH

x86/TVMonitor.inf

SHA256 681c9bb4dc92bdc1ed89cb7035732167f6644b6c8d8594504f4c990b922d0ce8
MD5 1d8a98accab73b031b74139d533f9aa8
SHA1 ada10e29677810f55f3115f84ed9c12db60193a2
SHA512 c8ebf1f562fd74dc3d96e797345e60af3fe98a6a43034828032ec48f38466de53dc69f3be61866ab8e72b59eba5c337a3d386d0422ceaa7da5384bf7ecd723e3
TLSH
T177317478044B953AF80372367D5B7742725A3002B0E59920B1ECC2D0AB6AD1C6B366FB
MD5 SHA1 SHA512 TLSH

x86/TVMonitor.sy_

IMPHASH bc06eb1dad5e8285411e580cdee99e10
SHA256 d933340af838d94f25c74f9d46a74de3b45f29b896afa49a03676bab8cd400cf
MD5 111a023266532c621ee69ae96e47081e
SHA1 4f1dde3508a85fa4beda1d8110e98db248be1af1
SHA512 bf6252a52ad61bafb8b86589b4436069d4bc277b91a89e90c4b237e3e49a7388bc8e1d5d29a1790f4505de2a52eb26e0bef112e946f7505f0641b3ebd5643354
SSDEEP 192:7hkFKqiEedsBgI/yowJL/aMjGwP7QM3PXD+ebMdHFVZgjlJMVc83:Vkcqod5CYJLWOtbeFV6jK
TLSH
T1CE52189B0B242871EDD68F70C4EEE6275C77B2905F94A08B107885D96DA2BF03B2570F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Chains

Nov 25, 2010

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Serial Number

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 16, 2008 - Feb 22, 2011

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

1

Major OS version

6

Entry point

4158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

j:\teamviewer6.0\monitordriver\objfre_wxp_x86\i386\TVMonitor.pdb

Name

.text

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

384B

Virtual Size

277B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

384B

Virtual Size

274B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/tvmonitor.cat

SHA256 b10381b690be440f5bfdaa808b015da07d32b96c2c8c100a5c17233fdb5c737b
MD5 afe26c6fa7584f7e0d9920f246372075
SHA1 16f5193b3b635c56f8bca5592caed8e2508f678c
SHA512 3426796d9ff4ab75f8dcbfed0f233ed1767643ec3f3b1127bc2719f41f6fe212493d77f705b6cde274749a787e2a3cf96f252857daf1cbc9ada7113214f4ec03
SSDEEP 192:mZL49NdOyowJL/aMjGwP7QM3PXD+ebMdHFVZgjlRM1aCGZnB:m9+OYJLWOtbeFV6jWaX1B
TLSH
T118F1E6D70B1524A1ECC58F61C1DEE86BAC72F3866DC451AA107686D62E83BF1375980F
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer

TeamViewer.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/TvGetVersion.dll

shlwapi

wtsapi32

msi

psapi

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

generic

$PLUGINSDIR/nsis7z.dll

kernel32

user32

oleaut32

generic

$PLUGINSDIR/wincheck.ini

$_3_/tvqsfiles.7z

TeamViewer.exe

PE Signature issue

kernel32

generic

TeamViewer_Desktop.exe

PE Signature issue

kernel32

generic

TeamViewer_Note.exe

PE Signature issue

kernel32

generic

TeamViewer_Resource_pl.dll

PE Signature issue

generic

TeamViewer_Service.exe

PE Signature issue

kernel32

generic

TeamViewer_StaticRes.dll

PE Signature issue

generic

tv_w32.dll

PE Signature issue

version

comctl32

kernel32

user32

gdi32

shell32

ole32