overwolf-teamspeak-helper: 2d2a251a — Signed MSVC C++ PE32+ x64, benign application mis-tagged in MalwareBazaar

Executive Summary

This sample is the Overwolf TeamSpeak Helper (OverwolfTSHelper.exe), a legitimate signed Windows x64 application built by Overwolf Ltd in May 2018. Static analysis reveals a standard MSVC C++ PE32+ with Authenticode code-signing by DigiCert, a PDB path pointing to Overwolf's internal Git repository, and imports exclusively from teamspeak_control.dll — the official TeamSpeak client SDK. No malicious strings, no C2 infrastructure, no process injection APIs, and no anti-analysis tricks are present. The binary was likely ingested into MalwareBazaar via filename-based heuristics or bundling with a malicious dropper. This is a false positive and should be excluded from hunt rules. ^[file.txt] ^[rabin2-info.txt] ^[pefile.txt]

What It Is

How It Works

The binary is a legitimate Overwolf plugin that wraps the TeamSpeak 3 client control API. Its sole purpose is to expose TeamSpeak voice-chat functionality to the Overwolf overlay framework used by gamers.

1. Entry point (0x1400272b8) performs standard MSVC CRT initialisation: reads STARTUPINFOW, validates the PE header magic (MZ / 0x5A4D), initialises the default heap with HeapCreate + HeapSetInformation, then fetches the command line and passes control to the runtime initialiser fcn.14002c174. ^[r2:entry0]
2. CRT initialisation (fcn.14002c174) allocates the standard I/O buffers, sets up stdin/stdout/stderr handles, and walks the TLS callback array. ^[r2:fcn.14002c174]
3. COM initialisation (fcn.14000e5e0) calls CoInitialize(NULL) and falls back to Mscoree.dll loading if the COM apartment is already initialised (0x80010106). ^[r2:fcn.14000e5e0]
4. TeamSpeak bridge — once the CRT is up, the binary imports 18 functions from teamspeak_control.dll, all prefixed tscontrol_. These are the public async TeamSpeak 3 Client SDK APIs for server/channel/client queries and text-message dispatch. ^[pefile.txt:321-338]

No network code, no persistence, no injection, no obfuscation, and no payload staging are observed.

Decompiled Behavior

Entry point (entry0 @ 0x1400272b8):

• Pushes preserved registers, allocates 0xA0 bytes of stack shadow space.
• Calls GetStartupInfoW to read the process startup descriptor.
• Validates e_magic == 0x5A4D (DOS header sanity check — standard MSVC CRT code).
• Creates the default process heap (HeapCreate(0, 0x1000, 0)) and enables the Low-Fragmentation-Heap feature (HeapSetInformation with HeapCompatibilityInformation = 2). ^[r2:fcn.140027b00]
• Fetches command line via GetCommandLineW and stores it at 0x140089cc8.
• Continues into the C++ runtime initialiser. ^[r2:entry0]

Notable functions:

• fcn.140027b00 — heap creation + LFH enablement. Standard MSVC __crtInitializeHeap pattern. ^[r2:fcn.140027b00]
• fcn.14000e5e0 — COM apartment initialisation, loads Mscoree.dll on RPC_E_CHANGED_MODE. ^[r2:fcn.14000e5e0]
• fcn.14002c174 — I/O buffer allocation and TLS callback traversal. ^[r2:fcn.14002c174]

Control-flow patterns are entirely unremarkable: no flatting, no opaque predicates, no anti-debug checks beyond the single IsDebuggerPresent import (a common MSVC CRT artefact).

C2 Infrastructure

None. No hardcoded URLs, IPs, domains, mutex names, named pipes, or registry keys for C2 staging are present. The only network-adjacent artefacts are the DigiCert CRL/OCSP URLs embedded in the Authenticode signature block:

• http://crl3.digicert.com/sha2-assured-cs-g1.crl
• http://ocsp.digicert.com
• https://www.digicert.com/CPS

These are standard certificate-chain validation endpoints and are not attacker-controlled. ^[strings.txt] ^[binwalk.txt]

Interesting Tidbits

• PDB leak: The debug-path F:\src\overwolf-git\overwolf-client_dev\OverwolfTeamSpeakHelper\x64\Release\OverwolfTSHelper.pdb confirms an internal Overwolf build pipeline using Git and a standard x64\Release output directory. ^[rabin2-info.txt:13]
• Timestamp vs signing: The PE timestamp is 2018-05-17, but the certificate validity window is 2020-02-27 → 2023-03-03. The binary was likely re-signed (or dual-signed) after compilation, which is common for software that receives updated certificates post-build. ^[pefile.txt:44] ^[binwalk.txt]
• RT_MANIFEST: Contains a standard asInvoker execution-level manifest with no elevation or compatibility shims. ^[pefile.txt]
• RT_ICON: Four icon resources are present, consistent with a GUI application. ^[pefile.txt]
• No overlay payload: The 7,000-byte overlay at offset 0x90A00 is entirely occupied by the Authenticode signature block (PKCS#7 / CMS). No encrypted payload, no zlib stream, no shellcode. ^[binwalk.txt] ^[pefile.txt:222-224]
• Import table is small and focused: 5 DLLs total — teamspeak_control.dll, KERNEL32.dll, USER32.dll, ADVAPI32.dll, ole32.dll, OLEAUT32.dll. No WinInet, WS2_32, SHELL32, or CRYPT32. ^[pefile.txt:311-500]

How To Mess With It (Homelab Replication)

This is a legitimate binary, so the "replication" exercise is verifying the build fingerprint:

1. Toolchain: Visual Studio 2010 (MSVC 16.00 / cl.exe 16.00.xxxxx) with the v100 platform toolset.
2. Target: x64 Release, Windows GUI subsystem.
3. Linker flags: /SUBSYSTEM:WINDOWS /DYNAMICBASE /NXCOMPAT (produces DllCharacteristics: 0x8140).
4. Signing: Use signtool.exe with a DigiCert OV code-signing certificate.
5. Verification: Run rabin2 -I OverwolfTSHelper.exe and confirm:
   • signed: true
   • canary: true
   • nx: true
   • pic: true
   • baddr: 0x140000000
   • lang: c

What you'll learn: How a legitimate C++ GUI plugin's PE header looks when built with VS2010 and signed with a commercial CA. Use this as a baseline when hunting for malware that masquerades as gaming overlays.

Deployable Signatures

YARA rule — Overwolf TeamSpeak Helper baseline (for exclusion, not detection)

rule OverwolfTSHelper_BenignBaseline
{
    meta:
        description = "Benign baseline for Overwolf TeamSpeak Helper signed by Overwolf Ltd"
        author      = "PacketPursuit"
        date        = "2026-06-10"
        sha256      = "2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d"
        reference   = "/intel/analyses/2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d.html"
    strings:
        $pdb   = "OverwolfTSHelper.pdb" ascii wide
        $ver   = "Overwolf.TeamSpeakHelper" ascii wide
        $comp  = "Overwolf LTD" ascii wide
        $ts1   = "teamspeak_control.dll" ascii wide
        $ts2   = "tscontrol_connectToClient_async" ascii wide
        $ts3   = "tscontrol_requestSendServerTextMsg_async" ascii wide
        $dig1  = "DigiCert SHA2 Assured ID Code Signing CA" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        pe.is_pe and
        pe.is_64bit() and
        pe.timestamp == 0x5AFD65C4 and
        all of them
}

IOC list

Behavioral fingerprint statement

This binary is a standard MSVC C++ x64 GUI executable with a minimal IAT, no network APIs, no registry persistence APIs, and no process-injection APIs. It initialises COM, creates a default heap, and dispatches messages via GetMessageW/DispatchMessageW. Its only non-system DLL dependency is teamspeak_control.dll. Any execution trace matching this pattern but additionally loading ws2_32.dll, wininet.dll, or invoking CreateRemoteThread/VirtualAllocEx should be treated as a masquerade.

Detection Signatures

No ATT&CK mappings apply — this is benign software. For threat-hunting context:

• If this binary is seen alongside a malicious dropper, the dropper is the threat; this file is likely a bundled legitimate dependency.
• Hunt for filename mismatches: OverwolfTSHelper.exe with a different SHA-256, missing the DigiCert signature, or with extra imports (e.g., WinHttpConnect, RegSetValueExW) is a masquerade.

References

• Artifact ID: fbba8e22-171f-42b5-a1fb-af93fbb4aa50 ^[metadata.json]
• Source: MalwareBazaar / OpenCTI (ingested 2026-05-26) ^[triage.json]
• Overwolf Ltd: https://www.overwolf.com/ — legitimate gaming-overlay platform
• TeamSpeak SDK: https://www.teamspeak.com/ — official voice-chat client APIs
• Related wiki pages:
  • overwolf-teamspeak-helper — entity page for this application

Provenance

• file.txt — file command output
• pefile.txt — pefile 2023.x parsed PE headers, imports, sections, version info
• rabin2-info.txt — radare2 rabin2 -I binary summary
• strings.txt — strings -n 8 ASCII/Unicode extract
• binwalk.txt — binwalk signature scan (overlay = Authenticode signature block)
• exiftool.json — ExifTool PE metadata
• metadata.json — OpenCTI artifact metadata
• triage.json — triage-fast schema v1 output
• dynamic-analysis.md — CAPE skipped (no Windows guest available)
• radare2 decompilation — entry0 and sub-functions at level-2 analysis, 1841 functions recovered