DOpusPro-13.25.rar
- SHA256 75a61ea449d59cb125caef19125fafe85c3e47f880f12245ecadf03dd8101ee2
Behavioral task
behavioral1
Sample
DOpusInstall-13.25.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
31 signatures
150 seconds
Behavioral task
behavioral2
Sample
DOpusInstall-13.25.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
30 signatures
150 seconds
Behavioral task
behavioral3
Sample
_dopus_patcher.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
_dopus_patcher.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target DOpusPro-13.25.rar
- Size 27.9MB
- Sample260925-kfb16scc46
- SHA256 75a61ea449d59cb125caef19125fafe85c3e47f880f12245ecadf03dd8101ee2
- MD5 c896465222ccc7f758ac8a490ec0be35
- SHA1 5d909f2ebf5002f12b342abbdc7fd6ac0006340b
- SHA512 c7170474a942b9faf24fdfba6060f5298ac8928d3c391bbc0eb8092676ffb7bbafcf75201969c8787c9ed7cc39cb2ef0d2bb2c5dc885b848adcf9b68415e9c92
- SSDEEP 786432:pu64vo5d/sECLdNLEfNI8m8gMSPeS1W4uBh3/r99:p/ZzopKfNI2SPes5uLb
- TLSH T11E57332285DC0DE1885F0D3320B9AC5DA4B9EE475BC067A68D71DD6E2471F938128EFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/_dopus_patcher.exe - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/DOpusInstall-13.25.exe innosetup
File Explorer
-
DOpusPro-13.25.rar.rar 27.9MB
-
Attention.txt3KB
-
DOpusInstall-13.25.exe.exe 28.1MB
-
_dopus_patcher.exe.exe 1010KB
-
readme.txt81B
Attention.txt
- SHA256 674dc14e05ddda613a97f8097fa4225b0001ec7b3a5b0403816b0b6872fcda71
- MD5 398a33d9c54d2c9c46d4b1cecccb88f4
- SHA1 71031d5114c6e561b72274a6e2213c2ba9aa9b18
- SHA512 fa0ca4a81723dd9d3a9b6baeb9b07dff9cd909a80f74a49a5079bf3e41d0b6fe6dc31ca2c672c449e2d50ac20c46fcb880d9a6a21a1c94470f1a2b2484662c0a
- TLSH T1D4612D127BEC1D12BAB63E51197DD0A0066B7DC65838CF991738304C85EEF749BA2B63
- MD5 SHA1 SHA512 TLSH
DOpusInstall-13.25.exe
- IMPHASH 88016fcdef7f227c62171d0afad9aae4
- SHA256 41fdf3c800f61aebdeec054ab3e43f176a1798cda23c2a953cfc8bff7e6c4975
- MD5 17b717e92cd74e4fa04655d3823d13b2
- SHA1 3e17fb7d718c0d493e1b8caed513d9a475d78842
- SHA512 e58b6ba26b9f96d8ab45f6ab7b5a584da379471cfb0cbec9b22851d669b22c1db843b512ac987b25521c6339bbdde867ed79052f176a13fc793033d1ab5ab366
- SSDEEP 786432:p0Rx8eTsp7EEbQnFzEK835B2gfhGjWzKND/thG6aRUfLyOmZ2:pY7sdEEbKmVfQSzo/K6a6Xmo
- TLSH T12E57333FB24B253DF56B4A763976E614A53B762068268C17A6E0C08CCF190B11E3F797
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Digest
47:6a:e1:9c:d5:f7:52:9f:b8:f8:6a:8d:29:c2:b0:c9:e2:2b:e3:ed:13:24:7e:5c:97:a9:e8:3b:a6:bc:03:1e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=GP Software (REDBROOK PTY. LTD.),O=GP Software (REDBROOK PTY. LTD.),L=Ashgrove,ST=Queensland,C=AU
Chains
Aug 21, 2026
CN=GP Software (REDBROOK PTY. LTD.),O=GP Software (REDBROOK PTY. LTD.),L=Ashgrove,ST=Queensland,C=AU
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2020 - Mar 18, 2045
Subject
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=GP Software (REDBROOK PTY. LTD.),O=GP Software (REDBROOK PTY. LTD.),L=Ashgrove,ST=Queensland,C=AU
Serial Number
07:49:e6:5b:22:25:31:89:f3:50:a9:3e
Issuer
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 9, 2026 - Jul 10, 2027
Subject
CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE
Serial Number
84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4
Issuer
CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 15, 2025 - Jan 10, 2037
Subject
CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE
Serial Number
83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f
Issuer
CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 16, 2025 - Jul 16, 2041
Subject
CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 9, 2020 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Dec 10, 2014 - Dec 10, 2034
Minor OS version
1
Major OS version
6
Entry point
728672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetACP
GetExitCodeProcess
CloseHandle
LocalFree
SizeofResource
VirtualProtect
QueryPerformanceFrequency
VirtualFree
GetFullPathNameW
GetProcessHeap
ExitProcess
HeapAlloc
GetCPInfoExW
CompareStringOrdinal
RtlUnwind
SetFilePointerEx
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
GetFileSizeEx
LoadLibraryA
ResetEvent
GetVolumeInformationW
GetVersion
GetDriveTypeW
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
LoadResource
SuspendThread
GetTickCount
GetStartupInfoW
GetFileAttributesW
GetCurrentDirectoryW
InitializeCriticalSection
GetSystemWindowsDirectoryW
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetCommandLineW
GetSystemInfo
GetTempPathW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
LCMapStringW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
SetEndOfFile
QueryPerformanceCounter
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale
comctl32
InitCommonControls
user32
CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW
oleaut32
SafeArrayPutElement
VariantInit
VariantClear
SysFreeString
SafeArrayAccessData
SysReAllocStringLen
SafeArrayCreate
SafeArrayGetElement
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetUBound
SafeArrayGetLBound
VariantChangeType
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyExW
OpenProcessToken
FreeSid
AllocateAndInitializeSid
EqualSid
RegQueryValueExW
GetTokenInformation
ConvertSidToStringSidW
RegCloseKey
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
702KB
Virtual Size
702KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
28KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
113B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
24B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
_dopus_patcher.exe
- IMPHASH 260f2e771f9c5ccdd021a1439d074057
- SHA256 d4a2c30bfd1aa426eaaa7d36d9cec05317a1dd87c464d35229d5f5cab8944142
- MD5 d3d18fb5041a85335c3faf3cd0b4f701
- SHA1 4481578ea52231865bff43aa09cccd6f6fdf84b4
- SHA512 660661f0e604e17a7e69de1e421a4a795864b010cde3f27eb73ddbd4c1e29ae0ee65d4cdcf919297f49ce22abc176e4f222e81af513800425103652464d3db26
- SSDEEP 24576:2Jr99uXUeo4EHOc9h0lhSMXlEkf+Oxh0lhSMXlE:2Z99Izo4EuB9Y0
- TLSH T13D25AE1673E540F8E0ABD1B8C9570A45EBB2781607519BCF07E4A7622F23BD26E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
175228
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
MoveFileExW
GetLastError
LocalFree
FormatMessageA
FormatMessageW
GetTempFileNameW
CloseHandle
GetCurrentProcess
OpenProcess
GetModuleFileNameW
GetConsoleProcessList
K32GetModuleFileNameExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateFileW
TerminateProcess
CreateProcessW
VirtualProtect
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
GetProcAddress
CopyFileW
SetEndOfFile
WriteConsoleW
HeapSize
Sleep
GetFileSize
DeleteFileW
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetFileInformationByHandle
AreFileApisANSI
DeviceIoControl
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
DuplicateHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
WaitForSingleObject
GetExitCodeProcess
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
CreatePipe
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlUnwind
user32
MessageBoxA
MessageBoxW
advapi32
OpenProcessToken
GetTokenInformation
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
Name
.text
Size
339KB
Virtual Size
339KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
640KB
Virtual Size
640KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=194, id=261, version=30795,
count=17, id=260, version=30795,
count=10, id=259, version=33731,
count=17, id=260, version=33731,
count=94, id=261, version=33731,
count=9, id=257, version=30795,
count=171, id=1, productName=Unmarked objects,
count=7, id=261, version=33811,
count=1, id=255, version=33811,
count=1, id=258, version=33811,
readme.txt
- SHA256 8e188bd43dfc1e5c2f5f743df30bc6d99ff1f973ade45f78fb15b906fe127128
- MD5 c00b70fd15d887161aa860dcafd6c47b
- SHA1 455a0d3814cbf37b35ae1313515239bda5abbc54
- SHA512 ec145115028b96783cceb19692396b671cc6cc72dd5ba4a0f855405e116221027dab8edfb5dbe7f8175f309551b36605de2cd3ea7b13704b21726e2c686383d1
- TLSH T196A0118A8AA0002A8002A388CAA3CCA0E030023C320238A8A0A8008A23888302B200AC
- MD5 SHA1 SHA512 TLSH