teamviewerqs.exe

TeamViewer QS

TeamViewer

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from www.google.com and multiple other hosts.
Publisher:
TeamViewer  (signed and verified)

Product:
TeamViewer QS

Version:
9.0.31064.0

MD5:
14086f73a5610e927462ac57ee5a815a

SHA-1:
0035c17fe95a6ceadb8abb1a709349a4e49ffad1

SHA-256:
bdd887dbb4fa1d99d92f2e10cfb052504ab4b965d455a6a2d60b773b65bdd0ce

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/5/2024 8:28:39 PM UTC  (today)

File size:
5.5 MB (5,779,808 bytes)

Product version:
9.0.31064.0

Copyright:
TeamViewer

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
7/30/2014 11:00:00 AM

Valid to:
9/6/2017 10:59:59 AM

Subject:
CN=TeamViewer, O=TeamViewer, L=Goeppingen, S=Baden Wuerttemberg, C=DE

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
56729300C78306C4267CA44A10ADCD03

File PE Metadata
Compilation timestamp:
2/25/2012 6:19:59 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:fXsURBcvfgNfSPiJsuN23O81vaSlxJv08owMMK8gVBvc5URDDKgmWIrtM4PW:fPfSPylNa1vayxu8uMKbVBvcSvG7W

Entry address:
0x39E3

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 91, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 37, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 93, 40, 00, FF, 15, 84, 81, 40, 00, 68, 04, 93, 40, 00, 68, C0, AD, 46, 00, E8, 19, 27, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 07, 27, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
28 KB (28,672 bytes)

The file teamviewerqs.exe has been seen being distributed by the following 47 URLs.

https://www.google.com/url?hl=pl&q=http://mail.opteck.com/.../click?upn=tbBGHzoxdJj-2FFpAPHV8XGrZT1Q-2Ft-2FJoJQMeX4AqDw9XMsKney8Qm4rJbWzK2lvXaZAktX4JTlmzM40DyYyAF8A-3D-3D_3o4RJ6eAs8c0hNbKjW5YLslWoQJN8iYc7Hvav22KZ4fVNx1eycaoKY2r-2F9Xbp50KFe5P48cKWXxLbZpLOr4vGSomb-2FZOYiPWlPuT3297nHGG7n5Ao2Yo5rQ8-2BipENLL3AYtoT6Kv6wWf5dQWI0ixkqock7cyXI1wadk4Pg-2B6DpDbOUT-2BvjWIZuLhtmi5NJtdEy4tYqKZi9Ewrri7rHQsrPczaQ-2FPnvGfw2f-2FqDuCVYw-3D&source=gmail&ust=1480692484197000&usg=AFQjCNGKksK5cu1MdSskT-V61i5zQ8j5-A

http://em.mail.opteck.biz/.../click?upn=PCgR35VEhRrFs1hV0byMvHM9hTKoxM8CdkXNiYkSptZyW12teFrzv9aPLJ0cP91yGgb10siZwPR1DomzEL-2F2XA-3D-3D_ipjQJQ-2F0T6X-2BakjsNst2tRBS5MPjHwjZQj-2BHQTL5jK4xehpzxwvrld6mJ1qtankLH0zqad93u06LuUNcZ94pfLczSYShz9YWTpn-2F6KQutlhn6he1hM8IU5qX4J2lc4G6TRjekWZbQN1wh0LMKxdeNbve-2BXi-2BPKfeWHaCJsgquFLT7CeFYV2VeKAAixoIjCgggsb4OPqIoHtedk6if9Rxoaohnay-2Brjih457lgilkpdU-3D

https://www.google.com/url?hl=sl&q=http://mail.opteck.com/.../click?upn=tbBGHzoxdJj-2FFpAPHV8XGrZT1Q-2Ft-2FJoJQMeX4AqDw9XMsKney8Qm4rJbWzK2lvXaZAktX4JTlmzM40DyYyAF8A-3D-3D_ApoQu6Mx6eYo-2BWjxU9Ymh8Sbb758RPtlixQwtgk3I4dpqhyrffNxSXiE9MSeS8k3x7apFP1B4A6HhW6AJH-2BN-2FZXpCG6knRKApJBD2FRSaF0YECz-2BkFMLjc7e5ZYq-2FFrNMlxZNOAj-2BTHGNJfnIdDNHwuYsPrvh45-2FULHXfEcmrVsQ3-2BNQ8IIquRdczdFUvK7GUwPEfEJIaVpIiiegp1bCs1NJxzbuaSSJ-2BP0sKBQLsY8-3D&source=gmail&ust=1462983533191000&usg=AFQjCNGh2n82RrWFGlTATqac5YUfVq-Phg

http://l.facebook.com/l.php?u=http://media.opteck.biz/.../TeamViewerQS.exe&h=bAQHCprUD&s=1

http://em.mail.opteck.biz/.../click?upn=PCgR35VEhRrFs1hV0byMvHM9hTKoxM8CdkXNiYkSptZyW12teFrzv9aPLJ0cP91yGgb10siZwPR1DomzEL-2F2XA-3D-3D_c-2BbmVsD3MrNMp8UXQuZUtkCOyCnMzLW2xsBCsFPFDlQViY5awqbD35bLf-2FDCv5G37zbCVmXvKFdXiFSosQaaQnssLJbYn7a1MLYjdyW6jsNF0hni5-2FahNDAd1f6CIvQ2bNFYT9sv1S6tHcvT9AuMzNfUSi1-2FuLnWj3A0f1YzbaibY2mK9B-2BBzOIetQ-2FAaMKfDF2vO4s8hVKEAaVEDmhve3OY0huqGSEzdIMDq-2BpKry8-3D

http://mail.opteck.com/.../click?upn=tbBGHzoxdJj-2FFpAPHV8XGrZT1Q-2Ft-2FJoJQMeX4AqDw9XMsKney8Qm4rJbWzK2lvXaZAktX4JTlmzM40DyYyAF8A-3D-3D_EzLpuYPFHbv4IBV3-2B3xM8gKg1QLMjp9JJ-2BWr-2FW4Q3FkocPykr7-2BGIaeGlDXDjJzqK-2F0KZA7rskhQ7WvSycnjiZi86WFmyGBnVas4nbDxYmCnBcm6W7F5bOz4BSrsx7TY3OCxYBiGsY6RueENXz0UMJH-2Fce51akptdInBvCv7uyhE0rs-2BuNKXVTVHRB4kr-2FX0SV5GU31DS52D8LERfMMwQCsdmOATYNZYqXTyMMgepqU-3D

http://em.mail.opteck.biz/.../click?upn=PCgR35VEhRrFs1hV0byMvHM9hTKoxM8CdkXNiYkSptZyW12teFrzv9aPLJ0cP91yGgb10siZwPR1DomzEL-2F2XA-3D-3D_XFMbZIj3ob-2B23gh2zfJGbsMiVctTy28wOyBad8E6hloxjv-2B4vQdISq8PTUyFqqBKzgGyPi2cAxVoBb5jzu-2BIGV29H0KDd-2BYniNv9L7JtmJSPWQ65ktSxg8DMMKr0fvcYEv6HhWgeVYjg-2Fj1iw-2BmilJwVvAtzzKs-2FXvUD9UVmhd7sOr5VjNTTg9bjh-2FYM6imgVklIm9uPuuqWT2D59vw5oQ-3D-3D

https://mail.inbox.lv/link?csrf_token=4Zf_7It-CQg19JJbAW7aDyEPCskgd_jtj6ipHQTj9Fo&to=aHR0cDovL21haWwub3B0ZWNrLmNvbS93Zi9jbGljaz91cG49dGJCR0h6b3hkSmotMkZGcEFQSFY4WEdyWlQxUS0yRnQtMkZKb0pRTWVYNEFxRHc5WE1zS25leThRbTRySmJXeksybHZYYVpBa3RYNEpUbG16TTQwRHlZeUFGOEEtM0QtM0RfbjNpdlY4OERCcVNBRlpwaDFBcUk4NzlQNGE5SHhEWk5uRzRRYWY5YVZWTU1zb0RlbjFmSjJ2ak82TnAwY3hhb2Y5Z2lGY1hoRUU5VFhoOFJXTUh2SHNEVDNrbHM5VGYtMkZXdHBqcU9Fcmwxdi0yRnFxMlluYk52aEFRZU5qa2JHS1R0emZTMi0yRmFVT2E0dUI3TmZpeXVaeTFEcDJKaUpVZjA3czdBTzZIS1JnbVBFdURKWTQtMkZNQlVxNG5iU291ZjJJc1FiM1o4RFFmLTJCcEZUOENGODBwSzVpOFd2MDBMbUpveTJWcC0yRnpLSEZXSjhtZy0zRA==

https://www.google.com/url?hl=en&q=http://em.mail.opteck.biz/.../click?upn=PCgR35VEhRrFs1hV0byMvHM9hTKoxM8CdkXNiYkSptZyW12teFrzv9aPLJ0cP91yGgb10siZwPR1DomzEL-2F2XA-3D-3D_KaJ3w6ElH-2BIMEUzMjyek74ts1piNgURyNvWKmwk-2FoK7yYkatMcPld4PCbuUSRzMEo-2BWkDA4HfyseLcONW3-2Fia6uWjizyG6GsJt6T79JMQpB5McT3V9BV90FhMcMw7-2BJ0k1ecGeAOkW8JR5JOERqiXxVTb9W24mBZeFZzFYyhu05bPKMWR5sU2-2BLTW-2F0h8q95yQhQj-2BSnXkWcT-2Fsi3vz1BJk3sl-2FCSfwp1Ne51Q3FJjU-3D&source=gmail&ust=1468770098480000&usg=AFQjCNF3Qp_X0SM5PxcW0MyqllWM1CsVwg

http://mail.opteck.com/.../click?upn=tbBGHzoxdJj-2FFpAPHV8XGrZT1Q-2Ft-2FJoJQMeX4AqDw9XMsKney8Qm4rJbWzK2lvXaZAktX4JTlmzM40DyYyAF8A-3D-3D_Bgl0-2BmRTn5EH6-2BebuYeZlWZUKHgZU6AkypgJbMpSq4gFyUmIiw5WsFD9PTs-2Blac5T-2FEBgww2sprC1ATbq1DwYm5CvuoPGbuRiQRzk2VLw-2FXyI-2FGuGVsCpCuUwrcqkbyzdQh6sBkP-2F3BCa9pnLeSBFumlaXGeFRcRCYrGruhrJ9-2FIedclrTwCaCrxHlaqn9Q78nBOW3kUIrW6jc7adNSsw0RX3bxR2XdCH1JoP2ukFrk-3D

http://mail.opteck.com/.../click?upn=tbBGHzoxdJj-2FFpAPHV8XGrZT1Q-2Ft-2FJoJQMeX4AqDw9XMsKney8Qm4rJbWzK2lvXaZAktX4JTlmzM40DyYyAF8A-3D-3D_bUNGuDNO5tiLlwTgPhfNwRqF1OtGusVNWkk4ZWFEcstghwH6CqpkEQO2BsEjq0s0-2F3C1FwtMj4NUVRiC941AAv6W4-2FOVPjrsdMt-2BvY8Bc0GqcEEazcOgYbjCIPsjCJB-2BhYuRghw3Trqj8Tk3yYEvPEyKyifwXpq11rwhvBxPNmVW89VxCV3zTegul45NUgdwF-2F3HgQPpXmQqV3ym-2FRLFtDoJlPllJcSBDO8Gc76RFeo-3D

http://mandrillapp.com/track/click/.../media.opteck.biz?p=eyJzIjoidzAxci1BZ3dLaUN6YzQzelhHbllaS25fb1pnIiwidiI6MSwicCI6IntcInVcIjozMDI2MTU2NixcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvbWVkaWEub3B0ZWNrLmJpelxcXC90ZWFtdmlld2VyXFxcL1RlYW1WaWV3ZXJRUy5leGVcIixcImlkXCI6XCIyM2Q5YWU5NDUxMmQ0M2MwOTNjYjVjNmExZjI2NDhiM1wiLFwidXJsX2lkc1wiOltcImNhM2ZkN2ExYWZlY2Q0ZDk4Y2UwYzAxMDE3ZDA5OTUxMjFjY2QwYzZcIl19In0

http://pl.opteck.com/redirect?uri=http://media.opteck.com/.../TeamViewerQS.exe&type=teamviewer&value=win

http://em.mail.opteck.biz/.../click?upn=PCgR35VEhRrFs1hV0byMvHM9hTKoxM8CdkXNiYkSptZyW12teFrzv9aPLJ0cP91yGgb10siZwPR1DomzEL-2F2XA-3D-3D_XHsqouW42G-2BdczDwST-2FlFfeoLoWwT6qN-2BGGEXql1YxeUsa301ejjz04XNwhJ0KVSL9pGFP-2B1zyaClv5nMJnRTnCcyKdUTi6Kff0yBZucwzP5G7m0gO8H3D7rjAjg09Em6M0IuKNBwkKgOg84vSja9aDldFf8Qx1TNRZ-2B-2FTcxWz0c0du9RabjM-2BsynivUvDoz5i70pkqyIQ6e1pLEz554EA-3D-3D

https://www.google.com/url?hl=pl&q=http://mail.opteck.com/.../click?upn=tbBGHzoxdJj-2FFpAPHV8XGrZT1Q-2Ft-2FJoJQMeX4AqDw9XMsKney8Qm4rJbWzK2lvXaZAktX4JTlmzM40DyYyAF8A-3D-3D_S2vAUaZvWpT15MiTlWxLEndNOAfHRkqE8RaqI02IWIl7bce0-2FfRcBnD38ISmKg152x3CfWCf5-2FlXrc04KVx-2B19SBSe2VyAsLuenUUSuJrmnsACSRfcB6e4onsyPG4znb-2FKwaYMkPEhDtaaRROTh4VNit-2B4NAgddQ7kW5ow0jpuxKZ1nKSAf-2Fncx8LSETgfTv5aIgm0Wtgn11DxfKtmVignMUc5wKl00O-2B8zmBP548Ko-3D&source=gmail&ust=1480090453932000&usg=AFQjCNEkZsU786wYtIDE21nmVSCP4Qw1Gg

http://em.mail.opteck.biz/.../click?upn=PCgR35VEhRrFs1hV0byMvHM9hTKoxM8CdkXNiYkSptZyW12teFrzv9aPLJ0cP91yGgb10siZwPR1DomzEL-2F2XA-3D-3D_-2F7oGmliIMtw-2FaDtce50xu46WGMfxdfB-2BXaVRhjVlvE3BSXdVys7aOZ4skdeanFbgA-2BBqPNcaUzVPuQk4t2ukgo3etsjzCx8YUPExpYnrLFFULk-2FDGHQtE-2B6ISkEUijPbqBJ2XnSP5Qg8jh6BzptkZXOs8d96h5QzfMHVV1qG6ojDiDcdzDMvSBAGJudTnCRVXqH1z0leVWY1nPwjOmBtxjvFE3rWUKaolMyeEL9GZdU-3D

http://em.mail.opteck.biz/.../click?upn=PCgR35VEhRrFs1hV0byMvHM9hTKoxM8CdkXNiYkSptZyW12teFrzv9aPLJ0cP91yGgb10siZwPR1DomzEL-2F2XA-3D-3D_sTY15gFE1IXe8NUAVTxt-2Fp-2F9RRdeumX6Zb7B5dKPZ5BZbT-2Fsuzf8XjX82FC-2Bi3UE3-2Fsbm6puP9-2BTbCn99ezkp2t1GAV-2BZJzyceIHx8tAoIDxNZ2PqYeKyy3UKGuJYBRcDNEYagJo7c4-2FFaOrwcq1UAcBgsi-2BmhfWicnz-2BfMh3jZwosL6wpIHwyHlTvPgMiDPzI-2Fd1YsuWUx-2Bpe7n26NvOqB1aqtZ8Gq2VI1sjXVLLZA-3D

http://em.mail.opteck.biz/.../click?upn=PCgR35VEhRrFs1hV0byMvHM9hTKoxM8CdkXNiYkSptZyW12teFrzv9aPLJ0cP91yGgb10siZwPR1DomzEL-2F2XA-3D-3D_ICANHyPvz-2FU7xlfOsHQ1t6VMLZHTIARvDy-2BzIet-2BdbznHXy-2F5YT2lCG8Q-2BdliNG-2FOK-2BlyH9UwzgO-2BzeemncuYhxxN4sLhCMZqAlxA4ZarJbFnYprUVqATGvcAHQP7dsxU7h7hRf4Jxq7xhlbLjOztmMsCmN-2FeZE-2FPFwf2llb0ssyZVNQtxZIGYP0Rk3-2B46wek7B8o6u2iF7iWXJR3pnssw-3D-3D

http://em.mail.opteck.biz/.../click?upn=PCgR35VEhRrFs1hV0byMvHM9hTKoxM8CdkXNiYkSptZyW12teFrzv9aPLJ0cP91yGgb10siZwPR1DomzEL-2F2XA-3D-3D_LTQBCVmn24jxa8q1MIV5gR5HMx0EQ6CBryVub2fxyn9Lzb9IsbLBAEo-2FqFnlL4Cw2LRrV2wBuo5-2B23rD-2FXs-2Bkg1pwbXkr1tzia-2FNOa6bmeFDMYmflSyfZcJEV31DsVAXNdyLp0sWung5z5fi8lIWprKhstTJE7-2Fg-2BTj1Hlhnn3-2BuhXURpArr9pQK2bBlpiuGDB4nEHCwPAQ-2B03Ewua4KDw-3D-3D

http://mail.opteck.com/.../click?upn=tbBGHzoxdJj-2FFpAPHV8XGrZT1Q-2Ft-2FJoJQMeX4AqDw9XMsKney8Qm4rJbWzK2lvXaZAktX4JTlmzM40DyYyAF8A-3D-3D_MKWN3-2F02WeGFvvlrGKBFHI7G20JlwRKQw-2FC1GK6XrEh7V4i6IkIvenzst-2FuWybM2odEXj-2F-2F4rDjFChFpSdb0OzA6GZv4TOo3IwKwQ5MxYFEw2to26qc0RPkHSzHiJ18PqpFb4-2BCwcDfxtJd7RzA8Iorquwnr3-2FzSKYguTncVhrqbpF8d5K-2BO4WsDo8t35GlTN5xBTPgtUD6hPweI48CFOw-3D-3D

http://mail.opteck.com/.../click?upn=tbBGHzoxdJj-2FFpAPHV8XGrZT1Q-2Ft-2FJoJQMeX4AqDw9XMsKney8Qm4rJbWzK2lvXaZAktX4JTlmzM40DyYyAF8A-3D-3D_LE9RUgWf79MR6jXgHq0FRDPVwNhV3iR77SIEhfEFKQ2lBEPto-2BWhQ7hOXp8UmDiY-2BDa-2FsBIVRmkTJnTUsPAQCvo3IO-2BkYBZzI766TRJdzwH1woTqKpY6oQVXZrRdLf35SEKOhasl-2Bqpv3Pd7th-2BqOsJ4eeBl6sr5ba4QQDRIAI-2FuCx5FxqSEMnD-2FhKnzYOpJjoBk2Lw4p9tzr44ExpWb8Q-3D-3D

Latest 30 of 47 download URLs