dopus[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dopus.exe
Size

14.9MB
MD5

0bd1c917d547388afa7993c1489c8197
SHA1

5dadb5abfd7ae5cd76f7182778e994a99bd8c6e3
SHA256

5433d7e6b9a7906112ede23fced023d1e2d363417cc8f1efeec6870c18552f24
SHA512

2d35a03ad317163581962955e1c1a70e98bc271742f5c7c032f67e16295869cd60782513517ee85f71b78b58d730692e9ab0ace6c075e0d80570f8b28411d2fc
SSDEEP

393216:iT1ieCkPLmBMHPS0ijmXfn8tTFZzqBYbV:iTWVaHKdjmv8RFZzPR

Score

1^/10

Malware Config

Signatures

Files

dopus.exe
.exe windows:6 windows x64 arch:x64

Code Sign

43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02/09/2011, 00:00

Not After

01/09/2014, 23:59

Subject

CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02/09/2011, 00:00

Not After

01/09/2014, 23:59

Subject

CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ff:6d:b7:a0:91:fc:bb:10:af:a2:af:27:e7:b3:b4:ab:c0:7f:4a:18:92:63:53:76:15:47:52:db:ad:39:6a:01
Signer

Actual PE Digest

ff:6d:b7:a0:91:fc:bb:10:af:a2:af:27:e7:b3:b4:ab:c0:7f:4a:18:92:63:53:76:15:47:52:db:ad:39:6a:01

Digest Algorithm

sha256

PE Digest Matches

true

dc:10:7f:33:94:e5:54:22:d4:f9:ae:30:fd:fc:16:63:24:52:f0:70
Signer

Actual PE Digest

dc:10:7f:33:94:e5:54:22:d4:f9:ae:30:fd:fc:16:63:24:52:f0:70

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Exports

Exports

AddDialogResizerCtl
AddEditSpinControl
AddFunctionFileChangeA
AddFunctionFileChangeW
AllocFileTypeGroupExtensions
AllocPatternMatch
AutoSizeListViewColumn
BumpFileNameA
BumpFileNameW
CalcCRC32
ChainDialogResizer
CheckGlobalFilter
CreateBusyIndicator
CreateButtonIcons
CreateDIBitmapWrapper
CreateDialogResizer
CreateLangDlgEx
CreateTextDataObject
DOLoadImage
DOpusChooseFontA
DOpusChooseFontW
DOpusColorPicker
DOpusPluginThumbnailRequestClose
DOpusPluginThumbnailRequestCreateBitmap
DOpusPluginThumbnailRequestStart
DialogGrowBaseSize
DlgAutoAssignAccelerators
DpiAwareAddIconsToImageList
DpiDivide
DpiScale
DrawBrainchildBookmark
DrawPictureFrameInDIB
DrawPictureFrameInDIBEx
DrawTextHighlight
DummyExeFunction1ToAvoidSymbolConfusion
DummyExeFunction2ToAvoidSymbolConfusion
FilterFunctionFileA
FilterFunctionFileExA
FilterFunctionFileExW
FilterFunctionFileW
FixVariousProblemsWithControls
FreeConfigSetting
FreeDialogResizer
FreeFileTypeGroupExtensions
GetArchiveCreationData
GetBrainchildColor
GetBrainchildSearchReplaceHistory
GetCompileDateAsSystemTime
GetConfigPathA
GetConfigPathW
GetConfigSetting
GetDIBitsWrapper
GetFileContentTypeToBuffer
GetFileTypeGroupBumpID
GetFunctionWildcardNameArgs
GetFunctionWindow
GetFunctionWindowEx
GetInlineProgressType
GetNamedColor
GetNamedFont
GetOpusErrorMessageA
GetOpusErrorMessageW
GetPluginElevator
GetProgramDirA
GetProgramDirW
GetSetWallpaperFile
GetString
GetThumbnailPrefs
GetWildNewNameA
GetWildNewNameW
HandleDialogResizerMsg
HashChunk
HashEnd
HashFree
HashInit
HideBusyIndicator
HideInlineProgress
InitListViewHandling
IsHighDpi
IsListerThread
IsMixedDpiSystem
IsOpusInDarkMode
IsOpusLight
IsPrefsThread
IsUSBInstall
IsVisualStyleActive
ListViewSizeFullColumn
LoadOrSaveConfigA
LoadOrSaveConfigW
LogDiagnostic
MakeInfoLink
MapWallpaperStyleNameToId
MeasureCustomPart
MouseWheelHelperAlloc
MouseWheelHelperCalcScroll
MouseWheelHelperCalcScrollHighRes
MouseWheelHelperFree
MouseWheelHelperReset
NumToStrBytesizeW
NumToStrDWordLongW
NumToStrDWordW
NumToStrDoubleW
NumToStrIntW
NumToStrTimeSecsW
OPENSSL_Applink
OpusCoFreeUnusedLibraries
OpusGetDateFormatW
OpusGetTimeFormatW
OpusRegCheckElevation
OpusRegCloseKey
OpusRegCreateKeyW
OpusRegDeleteKeyW
OpusRegDeleteValueW
OpusRegOpenKeyW
OpusRegQueryValueW
OpusRegSetValueW
PaintCustomPart
PaintNonClientScrollbarRect
PluginFixAllVistaCombos
PluginFixVistaCombo
PluginFixVistaComboHandleMeasureAndDraw
QueryPasswordPromptSuppression
RegisterNotification
RemoveBusyIndicator
SetBrainchildSearchReplaceHistory
SetControlLabelBold
SetDIBitsToDeviceWrapper
SetDIBitsWrapper
SetDialogResizerDirection
SetInlineProgressMarquee
SetInlineProgressText
SetInlineProgressValues
SetOpusWindowIcon
SetWallpaperImage
ShowBitmapExpandScroll
ShowBusyIndicator
ShowErrorDlgA
ShowErrorDlgW
ShowFunctionDeleteDlgA
ShowFunctionDeleteDlgW
ShowFunctionErrorDlgA
ShowFunctionErrorDlgW
ShowFunctionInitialDeleteDlgA
ShowFunctionInitialDeleteDlgW
ShowFunctionNewNameDlgA
ShowFunctionNewNameDlgW
ShowFunctionReplaceDlgA
ShowFunctionReplaceDlgW
ShowInlineProgress
ShowPluginHelp
ShowRequestDlgA
ShowRequestDlgW
ShowWarningIfProblemCausedByWindowBlinds
StretchDIBitsWrapper
TextOutHighlight
ThumbnailCacheControl
UnregisterNotification
UpdateBusyIndicator
UpdateFunctionProgressBar
XMLAddChildNodeA
XMLAddChildNodeW
XMLCreateFile
XMLDeleteAllChildNodes
XMLDeleteAllNodeAttributes
XMLDeleteChild
XMLDeleteNodeAttributeA
XMLDeleteNodeAttributeW
XMLEnumChildNodesA
XMLEnumChildNodesW
XMLFindChildNodeA
XMLFindChildNodeW
XMLFirstChildNode
XMLFreeFile
XMLGetNodeAttributeW
XMLGetNodeBinaryValue
XMLGetNodeBoolAttributeA
XMLGetNodeBoolAttributeW
XMLGetNodeBoolValue
XMLGetNodeDWORDAttributeA
XMLGetNodeDWORDAttributeW
XMLGetNodeDWORDLONGAttributeA
XMLGetNodeDWORDLONGAttributeW
XMLGetNodeDWORDLONGValue
XMLGetNodeDWORDValue
XMLGetNodeIntAttributeA
XMLGetNodeIntAttributeW
XMLGetNodeIntValue
XMLGetNodeLOGFONTValueA
XMLGetNodeLOGFONTValueExA
XMLGetNodeLOGFONTValueExW
XMLGetNodeLOGFONTValueW
XMLGetNodeNameA
XMLGetNodeNameW
XMLGetNodeValueA
XMLGetNodeValueW
XMLLoadData
XMLLoadFileA
XMLLoadFileW
XMLNextNode
XMLSaveData
XMLSaveFileA
XMLSaveFileW
XMLSetNodeAttributeA
XMLSetNodeAttributeW
XMLSetNodeBinaryValue
XMLSetNodeBoolAttributeA
XMLSetNodeBoolAttributeW
XMLSetNodeBoolValue
XMLSetNodeDWORDAttributeA
XMLSetNodeDWORDAttributeW
XMLSetNodeDWORDLONGAttributeA
XMLSetNodeDWORDLONGAttributeW
XMLSetNodeDWORDLONGValue
XMLSetNodeDWORDValue
XMLSetNodeIntAttributeA
XMLSetNodeIntAttributeW
XMLSetNodeIntValue
XMLSetNodeLOGFONTValueA
XMLSetNodeLOGFONTValueW
XMLSetNodeNameA
XMLSetNodeNameW
XMLSetNodeValueA
XMLSetNodeValueW

Sections

Size: - Virtual size: 23.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 8.8MB - Virtual size: 8.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

ff:6d:b7:a0:91:fc:bb:10:af:a2:af:27:e7:b3:b4:ab:c0:7f:4a:18:92:63:53:76:15:47:52:db:ad:39:6a:01Signer

dc:10:7f:33:94:e5:54:22:d4:f9:ae:30:fd:fc:16:63:24:52:f0:70Signer

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

Size: - Virtual size: 23.3MB

Size: 8.8MB - Virtual size: 8.8MB

.rsrc Size: 6.1MB - Virtual size: 6.1MB

43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

ff:6d:b7:a0:91:fc:bb:10:af:a2:af:27:e7:b3:b4:ab:c0:7f:4a:18:92:63:53:76:15:47:52:db:ad:39:6a:01
Signer

dc:10:7f:33:94:e5:54:22:d4:f9:ae:30:fd:fc:16:63:24:52:f0:70
Signer

.rsrc
Size: 6.1MB - Virtual size: 6.1MB