teamviewer[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsis7z.dll
unpack003/$PLUGINSDIR/System.dll

resource
unpack004/x64/TVMonitor.sy_
unpack005/x86/TVMonitor.sy_

teamviewer.exe

IMPHASH 4ea4df5d94204fc550be1874e1b77ea7
SHA256 a7110efa88c0bf3b6b8afa34075b203efbe4f2e56323c3dfc7462c024a46b460
MD5 b65e9f2eef86ff6a2ada818ce4d5203a
SHA1 38a04b2b608efb6e0249056c9ca49de7147b9227
SHA512 7ba3a289169dc5faf80cdc252ec901b722b708225764f41397e692566f219b9e2dac38bc1b999a4cfa19460fd413b3e7ad6d925e0e50d5d282a7aba0574692ce
SSDEEP 393216:/3gPtAHpQPXZyO/Gvq1N1/XPnWo7m+PZhbDbeZJIXAWbsP9RVRiL1QpR9BTwEObr:/+iJwJPIQ1vff/PTbDOIw/P9zY1QzTc
TLSH
T1A44733E8E3E317DBF8325A71EB521238A5316DC468E45DA50BC8BB3C45752CE932AD1C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

34:27:97:02:73:a2:cd:95:ec:28:22:f8:d4:0b:71:20:43:3b:da:47:f4:98:be:28:62:49:03:87:2f:cc:05:83

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

Chains

Nov 14, 2022

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

Serial Number

04:cb:5b:11:6c:ee:82:84:0c:02:09:14:b1:a4:d0:4d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 17, 2021 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode WaitForSingleObject GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GetDiskFreeSpaceW lstrlenW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/InstallOptions.dll

IMPHASH 4b45b7e00344a87332fbd12653854d1a
SHA256 c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
MD5 033ee34c40e8fa85bf2739bcb2f3e186
SHA1 2ca942f35f77f37df3fc6097acac34f2e77341b7
SHA512 2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
SSDEEP 384:ErC43tPegZ3eBaRwCPOYY7nNYXCT/Yosa:EmTgZ3eBTCmrnNAh
TLSH
T1B1624D1137D558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile SetCurrentDirectoryW GetPrivateProfileStringW GetPrivateProfileIntW MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree GlobalAlloc WriteFile SetFilePointer

user32

LoadCursorW SetWindowRgn GetDlgCtrlID CloseClipboard DrawFocusRect OpenClipboard DrawTextW SetCursor LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW GetClientRect ShowWindow GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW CallWindowProcW PostMessageW MessageBoxW GetSysColor CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW GetWindowLongW EnableMenuItem PtInRect MapWindowPoints GetClipboardData

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectW

shell32

SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
TLSH
T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/TvGetVersion.dll

IMPHASH 11eacc375ae34c5bfca099d63719afcd
SHA256 c1ec07d1faf59ecdc0c8c1cd258b2feb6d41321471a8c1b10b00100c7106bd7e
MD5 b9e0c430596b2435971079edd15d3f0c
SHA1 fc214c6757e3539729e42f754c6b9768fd44a942
SHA512 93dc70fc6fcc4c0f4bc5fc5819446dc465360ef459a0be408bd07a78229f297da12d602b0667145d9716514e8f3da3582b1c4c0e3e9524e39c4a0c8fe7d4e25b
SSDEEP 3072:DZiMB8EvkPz8LbdT3nB9pRdySGnXmEegCtzIItsYUl3UH4K+tv:NiMB8hz8djnBTySKWjW3tEYtR
TLSH
T1F0244B1177E0C439F6F71A34ADF6C6604EB9BC726970D18FA790891A2E70B85DB24327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

29:e3:d0:0d:fc:9c:5e:46:cd:36:7c:db:25:23:df:7c:08:fb:09:35:e1:74:76:0f:40:bf:60:f7:4a:20:f9:e7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

Chains

Jan 20, 2022

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

Serial Number

04:cb:5b:11:6c:ee:82:84:0c:02:09:14:b1:a4:d0:4d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 17, 2021 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

5

Entry point

68408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

StrChrW StrRChrW

wtsapi32

WTSEnumerateProcessesW WTSFreeMemory

msi

ord205 ord45 ord16 ord70 ord141

psapi

GetProcessImageFileNameW

kernel32

lstrcpynA lstrlenA lstrcpyW lstrcpynW Sleep GetVersionExW LocalFree FreeLibrary LoadLibraryW CreateDirectoryW GetExitCodeProcess WaitForSingleObject CreateProcessW OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot TerminateProcess DeleteFileW GetWindowsDirectoryW GetTempPathW InterlockedDecrement WideCharToMultiByte GetFileAttributesW MultiByteToWideChar RtlUnwind FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExW HeapFree RaiseException HeapReAlloc MoveFileW EncodePointer DecodePointer GetCurrentThreadId GetCommandLineA IsProcessorFeaturePresent HeapAlloc TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement lstrcatW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetCPInfo lstrcmpiA GetOEMCP IsValidCodePage LCMapStringW GetFullPathNameW GetFileInformationByHandle PeekNamedPipe GetFileType GetCurrentDirectoryW FreeEnvironmentStringsW GetDriveTypeW ExitProcess DeleteCriticalSection HeapCreate HeapDestroy HeapSize SetHandleCount GetStdHandle GetStartupInfoW GetModuleFileNameA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime WriteFile GetModuleFileNameW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer GetStringTypeW GetUserDefaultLCID GetLocaleInfoW GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetEndOfFile GetProcessHeap InterlockedExchange GetTimeZoneInformation CompareStringW SetEnvironmentVariableW WriteConsoleW SetEnvironmentVariableA InterlockedCompareExchange InitializeCriticalSection CreateFileW GetFileSize GlobalAlloc ReadFile CloseHandle lstrcpyA GetACP lstrlenW GlobalFree GetLastError GetCurrentProcessId GetModuleHandleW GetProcAddress VerSetConditionMask VerifyVersionInfoW lstrcmpiW SetLastError GetEnvironmentStringsW

user32

SendMessageW PostMessageW GetSystemMetrics wsprintfW

gdi32

AddFontResourceExW RemoveFontResourceExW

winspool.drv

EnumPrintProcessorsW EnumPrinterDriversW

advapi32

RegEnumValueW RegQueryValueExW RegSetValueExW RegCloseKey RegEnumKeyExW RegDeleteKeyW GetUserNameW LookupAccountNameW ConvertSidToStringSidW RegOpenKeyExA RegQueryValueExA OpenProcessToken LookupPrivilegeValueW StartServiceW OpenSCManagerW OpenServiceW CloseServiceHandle QueryServiceStatus RegCreateKeyExW RegOpenKeyExW RegFlushKey ChangeServiceConfig2W RegDeleteValueW SetNamedSecurityInfoW GetNamedSecurityInfoW AdjustTokenPrivileges DeleteService ControlService

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CLSIDFromString CLSIDFromProgID CoCreateInstance OleRun

oleaut32

SysAllocString SysFreeString GetErrorInfo

$PLUGINSDIR/nsis7z.dll

IMPHASH 9c8bb65ecbb91da1f2ebb6ae7a714ed0
SHA256 66b2f36274ddfeef35b1d6ae6e5755f834446e5d78a719063347543793987161
MD5 87853c0f20f065793bdc707ece66190b
SHA1 738e11a9a565923ec75400a0cd4bce4db257b21d
SHA512 febfcd11795f4ef0ff3d25cbf1856be01e7f6423a9f16028c927988c04ab21de5f0b076d7f4ce9294aa7603c0db61ea5ffb888af2e9f7c6a6a11bcabfe9795a2
SSDEEP 3072:eBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRp:6xzJSAGEdYD5JcYl78Fs
TLSH
T110049D2337E0C175E21F0732DE56EB9122BAB6504E62C8873F990F5C4F726989E2D716
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

96225

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle SetFileAttributesW RemoveDirectoryW MoveFileW CreateDirectoryW GetLastError DeleteFileW GetFullPathNameW GetCurrentThreadId GetCurrentProcessId SetLastError CreateFileW SetFileTime FindClose FindFirstFileW GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile GetCurrentProcess GetSystemInfo GetProcAddress GetStdHandle EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects DeleteCriticalSection AreFileApisANSI VirtualFree VirtualAlloc GetVersionExW WaitForSingleObject SetEvent InitializeCriticalSection ResetEvent CreateEventW SetFileApisToOEM SetFileApisToANSI GlobalFree lstrcpyW lstrcpynW GlobalAlloc RaiseException VirtualQuery LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA WideCharToMultiByte MultiByteToWideChar GetTickCount HeapFree HeapAlloc HeapReAlloc ExitThread CreateThread GetCommandLineA GetVersionExA GetProcessHeap HeapDestroy HeapCreate GetModuleHandleA ExitProcess GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep HeapSize RtlUnwind GetConsoleCP GetConsoleMode FlushFileBuffers FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime LoadLibraryA GetCPInfo GetACP GetOEMCP IsValidCodePage SetStdHandle CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoA

user32

CharUpperW GetDlgItem FindWindowExW SetWindowTextW wsprintfW SendMessageW

oleaut32

VariantCopy VariantClear SysAllocString

$PLUGINSDIR/wincheck.ini

SHA256 0375c254f677b4b3c43fd6cc892816d5b2342ac699579c1fdd70d50dfe3771f7
MD5 04f98c8509a7ff5ce42f2d56e1cd010e
SHA1 0ed6c8707f1fcd7079b12d4d8b94da36650a3812
SHA512 3c9cc57d4b6b52687c5991d2190da86815f1c4a07baec40c733c8f23c369d83022246b2d31eccefce8aea0a7c597b5395b26d6151f77e7596eef59ecef06b8f8
TLSH
T1C1C012884101439D907071510C5A7751B7D027210B0A19E8F16618A3935D8E048AC68A
MD5 SHA1 SHA512 TLSH

$_6_/tvqsfiles.7z

SHA256 4ae0e21ff8da74c08acdb945dbbfb89ea5c1d10de607d08cfd26a8684adf2bdc
MD5 4b242959d1d7a015322596375d7e272d
SHA1 6bdf437ac12ca35bda6f1e8373f0a6a085ac6755
SHA512 8b65a2d7a50814517f828c78bd4bbc338ef8926c409703a4d752409ca0690c2fcb45bed1b150acd2823e2fd0ce0a166faf6f6377dcddb1f752d892e5e5916a8d
SSDEEP 393216:I8dzEWJHxpTXwSmTIJxcUwT98WgqbtIkXXNzvp6sJUfq6jNdHWfuZ3wsl2BVVd2+:IIjLTgtkxcU298n4tIgNmfq6dHzHl0dP
TLSH
T1743733B1876BBFABE6DD28FE4625CC494709F3A9B00D343A6B4C43D8452D36450F968B
MD5 SHA1 SHA512 SSDEEP TLSH

CopyrightQS.txt

SHA256 e009178ca5db7f64893a2b1cc34faa91ed290df9b3ed6b71caef83d728b8294e
MD5 1056072f17becb959bcd4610bddc72e9
SHA1 66331e92eed81e8026ae87b74cf6e5f1787008c1
SHA512 eab7b107986e7b096387c434b88fa4bbb443c6799106fdfbc33a1355f263bebf77eae89b6c691b92376e9aca297a0d2bf7e426f8c3cfe5bb794e3e2ae49f5dc2
SSDEEP 1536:qEHZXQw1AhC9U3aIwFDO4EyMwWwPyFEAjhvTxbTGcPXar7qIhAgkSERl5JNEe+1v:tHVQEuCSZyredvTx+EKrzhFkSi5ge+1v
TLSH
T1AB93F86F734A03731AE24381765AE4C9F21EA06D7F5B1A45342DE24C233B92DC6FB598
MD5 SHA1 SHA512 SSDEEP TLSH

TeamViewer.exe

IMPHASH c44bbd3d871f3f7ccd473084ba94fa73
SHA256 b0560a30237acc280572e13d73981ecf975cbc5042d02d1e21bd705fdcb06184
MD5 0a98e66fcab0b8cf930ada2fecf9b554
SHA1 38c707e4f18f3c212bbf6c0fab3aa5b611c7ed7e
SHA512 d2857efb54f11359985ad11211a58f87d9fc91b851c6ce92609360233f65f5e925db3a1421f165dfc896f92a7c4ac1b6242e733ea1b524a15c58b79eaab462d0
SSDEEP 1572864:AtGzntmPOzYu3fhaLXJCNy9p0jLD7pKxO9842KnzFqKjHFXWODC:AtGznt17RE
TLSH
T12DC77D2035856857F08603B15F6C5EFA916EBE160F7446C34290FDED28F16D32A36BAE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

c4:67:98:d1:80:20:9b:42:9e:90:be:15:15:47:0d:44:33:a9:61:a3:ce:85:2e:d3:f1:92:8f:07:23:e7:44:1b