Suspicious
Suspect

1c6793b664b47d0553a917ae0f76927a

Share on LinkedIn
Print
MS Office Document
MD5: 1c6793b664b47d0553a917ae0f76927a
Size: 10.24 MB
application/vnd.ms-office

This sample is a 9.8 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 320 embedded or derived files. It matches 37 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a10db4873ff6bc159a9dabc549d7b88687cb253ee9f40d0c304f5a600cde9208
MD5
1c6793b664b47d0553a917ae0f76927a
Verdict
Inconclusive
File type
MS Office Document · 9.8 MB

Cite this report: https://app.malva.re/sha256/a10db4873ff6bc159a9dabc549d7b88687cb253ee9f40d0c304f5a600cde9208

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
10.24 MB · 10,244,096 B
First seen
2026-10-31 12:30 · 2 days ago
Last seen
2026-10-31 12:30 · 2 days ago
Last analysis
2026-10-31 12:30 · 2 days ago
Hashes
MD5 1c6793b664b47d0553a917ae0f76927a Sha1 c384bad84bda0f61af7aa14748ddfc7ef5f8e4ec Sha256 a10db4873ff6bc159a9dabc549d7b88687cb253ee9f40d0c304f5a600cde9208 Sha384 0add29d301f5d45f17da258a63361e45a5b32d899f54cf633853b5be5d2971eb927fc7008a705e2dd2f78ca0efbe54b0 Sha512 92aa294e2d3d8df5a5d77a638be377471508074d24767166f10249675cd623436ae7b4814180e4e86b0f61f0c83edfb88d43635a93a3cd6b17e6d8011972ad73 SSDeep 98304:pMn1Giy8E1PqhVG6ztZNK9aNGmMn1Giy8E1PqhAMn1Giy8E1PqhpMn1Giy8E1Pqh:4ZWitz3I96AZWijZWi4ZWi TLSH 05A6232123FAC168F1B61B35D93965B56936BD12DA22C04F1364BE6E3C31F949A72333

317 files
OFF1c6793b664b47d0553a917ae0f76927a
BINCustomAction.config
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.arm64.dll
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
BINClient.en-US.resources
BINClient.resources
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 10 STICH kept: 2secondary ignored: 8
bin 7img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes
Path ole:doc>pe:dll
Shape ole:doc>pe:dll
2 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙