> Family · Overwolf TeamSpeak Helper — Signed MSVC C++ gaming-overlay plugin, benign baseline with Authenticode by Overwolf Ltd_

~/packetpursuit $ cat /intel/families/overwolf-teamspeak-helper.md

typeentityconfidencehighcreated2026-06-10updated2026-06-10pecompilersigningresearch-target

overwolf-teamspeak-helper

Overview

The Overwolf TeamSpeak Helper is a legitimate Windows x64 GUI plugin built by Overwolf Ltd that bridges the Overwolf gaming-overlay framework to the TeamSpeak 3 voice-chat client via the official teamspeak_control.dll SDK. It is distributed as part of the Overwolf client installer and is Authenticode-signed by DigiCert. Sample 2d2a251a was ingested into MalwareBazaar but static analysis confirms it is benign — a false positive likely triggered by filename-based heuristics or bundling with a malicious dropper.

Build Stack

  • Language / Toolchain: C++ via MSVC 10.0 (Visual Studio 2010), v100 platform toolset ^[raw/analyses/2d2a251a/rabin2-info.txt] ^[raw/analyses/2d2a251a/pefile.txt:55-56]
  • Arch: PE32+ x86-64, Windows GUI subsystem ^[raw/analyses/2d2a251a/file.txt]
  • Linker: Linker1000 (1×), Utc1600_C (153×), Utc1600_CPP (81×), Masm1000 (12×) ^[raw/analyses/2d2a251a/rabin2-info.txt]
  • PDB path: F:\src\overwolf-git\overwolf-client_dev\OverwolfTeamSpeakHelper\x64\Release\OverwolfTSHelper.pdb ^[raw/analyses/2d2a251a/rabin2-info.txt:13]
  • Signing: Authenticode via DigiCert SHA2 Assured ID Code Signing CA — CN=Overwolf Ltd, O=Overwolf Ltd, L=Ramat Gan ^[raw/analyses/2d2a251a/pefile.txt:222-224] ^[raw/analyses/2d2a251a/binwalk.txt]
  • Certificate validity: 2020-02-27 → 2023-03-03 (expired, valid at distribution time)
  • IAT: Small and focused: teamspeak_control.dll (18 imports), KERNEL32.dll (90 imports), USER32.dll (6 imports), ADVAPI32.dll (9 imports), ole32.dll (10 imports), OLEAUT32.dll (16 imports) ^[raw/analyses/2d2a251a/pefile.txt:311-500]
  • Resources: RT_VERSION, RT_MANIFEST (asInvoker), 4× RT_ICON ^[raw/analyses/2d2a251a/pefile.txt]
  • No overlay payload: The 7,000-byte overlay at 0x90A00 is entirely the Authenticode PKCS#7 signature block ^[raw/analyses/2d2a251a/binwalk.txt]

Capabilities

  • signed-authenticode-digicert
  • msvc-crt-heap-initialisation
  • com-apartment-initialisation
  • teamspeak3-sdk-bridge
  • gui-message-loop-dispatch
  • no-c2-iocs
  • no-persistence-apis
  • no-process-injection-apis

Deploy / TTPs

No ATT&CK mappings — this is benign software. For threat-hunting context, treat this binary as a benign baseline. Any sample masquerading as OverwolfTSHelper.exe but lacking the DigiCert signature, with extra imports (e.g., WinHttpConnect, RegSetValueExW, CreateRemoteThread), or with a different SHA-256 is suspicious.

Notable Analyses

  • /intel/analyses/2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d.html — Full static deep-dive confirming benign nature

Related

  • unclassified-pe32plus — contrast with actual malware that shares structural traits (TLS callbacks, minimal IAT) but lacks the Overwolf signature and TeamSpeak imports
  • version-info-masquerade — technique used by malware to fake legitimate version info; this sample has genuine version info