RunasCs[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RunasCs.exe
Size

50KB
MD5

ed04f33a60faa912c5406158e2d0a800
SHA1

c66f820b5d1e970fe5808f25940e375d88c17ca9
SHA256

29955ba1e2193047ee5f4561445f81e218ae4de1a295f8fd296ad536bf381f17
SHA512

334c29cd8e7fd08a17025780d92007328ded3c4f61d7b4013a7fee6669223238c0bb68e2eb8f327692c15e6a0f29d3e37588d340adf1eeafcf4bd7367bf2e0c9
SSDEEP

768:GBkpiKLp370FvefwZz2m9j/pcgrSA1ne+JboYATd5:BpN1a2fed9j/pcgrZ1JboYATr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RunasCs.exe

Files

RunasCs.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ