Taurus[.]exe | Triage

General

Target

Taurus.exe
Size

186KB
MD5

22bdcb6ba630cf12f0407097a4760133
SHA1

3919c4bb0f3c3719a1884badcd0c273172da81b3
SHA256

2e9e1231ca7d44646f69a2d21a4b11437bf584134075ba917278006af1d0394d
SHA512

00f83d5379579f66cdd6fbc7e18c8595a98f44a87e9797eaa5718860e8972cfd6d2900337262ffd2cb78fb15803287a4bb99c693ccd0e118a8f3fccbeec674c7
SSDEEP

3072:uAwAYtVnt1ToxUb2xliApxuBdJ/80MP4ps/5GdfmQY5DhkzX70+3NOxmYq7q:/Y1giUxc/u1EOQGDoVyq7q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Taurus.exe

Files

Taurus.exe
.exe windows:6 windows x86 arch:x86

7d20bc4be8458e0316ece18340daa770

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathW
GetFileAttributesW
LoadLibraryA
lstrcatW
DeleteFileW
GetProcAddress
WriteConsoleW
CloseHandle
CreateFileW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
RaiseException
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
HeapFree
HeapAlloc
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetFileType
SetStdHandle
GetStringTypeW
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
DecodePointer

user32

wsprintfW

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7d20bc4be8458e0316ece18340daa770

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 147KB - Virtual size: 147KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 3KB - Virtual size: 7KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 147KB - Virtual size: 147KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 3KB - Virtual size: 7KB

.reloc
Size: 5KB - Virtual size: 4KB