Suspicious
Suspect

1d52a25c753e5807182a9ea8be0a40fd

MS Office Document
MD5: 1d52a25c753e5807182a9ea8be0a40fd
Size: 9.96 MB
application/vnd.ms-office

This sample is a 9.5 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 299 embedded or derived files. It matches 33 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
e8a4cf9b9b5a81846e97e62eea7e1d15a156b886c258ed0a1174789a29b262d8
MD5
1d52a25c753e5807182a9ea8be0a40fd
Verdict
Inconclusive
File type
MS Office Document · 9.5 MB

Cite this report: https://app.malva.re/sha256/e8a4cf9b9b5a81846e97e62eea7e1d15a156b886c258ed0a1174789a29b262d8

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
9.96 MB · 9,961,472 B
First seen
2026-10-04 08:45 · 24 days ago
Last seen
2026-10-04 08:45 · 24 days ago
Last analysis
2026-10-04 15:02 · 24 days ago
Hashes
MD5 1d52a25c753e5807182a9ea8be0a40fd Sha1 aa091d7530669fad3f65f53d3059f6370f9b5f45 Sha256 e8a4cf9b9b5a81846e97e62eea7e1d15a156b886c258ed0a1174789a29b262d8 Sha384 3c0aebab3f4ef955b9d0e639828a1c8bd21f12b650147abb55a3752c5e7e35de1cc6d4d4386a8c7d08c1ef12eced7766 Sha512 5e0c34eda35fda4dea51c76f4dba7ad6df710b2e15e5ebe2369866b93d6e988211c96e8f822f00956761d749055d81df603c9c2dc6d85c994a2607e5dd9355bd SSDeep 196608:e/FZ0rbiu7ZgbUCs/FZ0rbiu7d/FZ0rbiu7P/FZ0rbiu7G/FZ0rbiu7:e/FZ0rbiuvCs/FZ0rbiu5/FZ0rbiuD/6 TLSH 87A6232223E8895CE27B0B39E83955F19875BC61EA26C41F6764BC2D5830F819B73773

288 files
OFF1d52a25c753e5807182a9ea8be0a40fd
BINRoot Entry
BIN䡀䆒䑲
BIN䡀䌏䈯
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䓞䕪䇤䠨
BIN䡀䕙䓲䕨䜷
BIN䈍䄩䏸䞷䄦䠥
DLLScreenConnect.Windows.dll
P7B[Authenticode]_29ef9868.p7b
BIN.Net Resources
DLLScreenConnect.Properties.libzstd.x86.dll
BINClient.resources
BINsystem.config
EXE䌋䄱䜵䀾䛬㪌
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
BIN䡀䈛㵪䆲䗤䕲
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀䓊㼳䄨䆵䠫
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䆒䑲㭾䉨䘤䗯䆒䑲
BIN䡀䈜䙵䆬㬨䑲䌩䠪
BIN䡀䈜䙵䆬㬨䑲䕷䏲
BIN䡀䈜䙵䆬㲨䖱䄷䏯
BIN䡀䄕䑸䋦䒌䇱䗬䒬䠱
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
EXE䌋䄱䜵㬾䖸䒷㪰䗦䒬㵱䅬䄵䜵
Structure
BINOverlay_422e3285.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
BINDigitalSignature
BINSummaryInformation
BINMsiDigitalSignatureEx
DLLScreenConnect.Client.dll
Structure
P7B[Authenticode]_fd1a1952.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
IMGScreenConnect.Properties.CommandChangeFolder.png
IMGScreenConnect.Properties.CommandChangeFolder.png-preview.png
IMGScreenConnect.Properties.CommandClearAnnotations.png
IMGScreenConnect.Properties.CommandClearAnnotations.png-preview.png
IMGScreenConnect.Properties.CommandClose.png
IMGScreenConnect.Properties.CommandClose.png-preview.png
IMGScreenConnect.Properties.CommandDisconnectParticipant.png
IMGScreenConnect.Properties.CommandDisconnectParticipant.png-preview.png
IMGScreenConnect.Properties.CommandDockControlPanel.png
IMGScreenConnect.Properties.CommandDockControlPanel.png-preview.png
IMGScreenConnect.Properties.CommandManageCredentialsPromptForStorage.png
IMGScreenConnect.Properties.CommandManageCredentialsPromptForStorage.png-preview.png
IMGScreenConnect.Properties.CommandManageCredentialsSendToScreen.png
IMGScreenConnect.Properties.CommandManageCredentialsSendToScreen.png-preview.png
IMGScreenConnect.Properties.CommandManageSharedToolbox.png
IMGScreenConnect.Properties.CommandManageSharedToolbox.png-preview.png
IMGScreenConnect.Properties.CommandMaximize.png
IMGScreenConnect.Properties.CommandMaximize.png-preview.png
IMGScreenConnect.Properties.CommandMinimize.png
IMGScreenConnect.Properties.CommandMinimize.png-preview.png
IMGScreenConnect.Properties.CommandMuteMicrophoneFalse.png
IMGScreenConnect.Properties.CommandMuteMicrophoneFalse.png-preview.png
IMGScreenConnect.Properties.CommandMuteMicrophoneTrue.png
IMGScreenConnect.Properties.CommandMuteMicrophoneTrue.png-preview.png
IMGScreenConnect.Properties.CommandMuteSpeakersFalse.png
IMGScreenConnect.Properties.CommandMuteSpeakersFalse.png-preview.png
IMGScreenConnect.Properties.CommandMuteSpeakersTrue.png
IMGScreenConnect.Properties.CommandMuteSpeakersTrue.png-preview.png
IMGScreenConnect.Properties.CommandOpenFolder.png
IMGScreenConnect.Properties.CommandOpenFolder.png-preview.png
IMGScreenConnect.Properties.CommandOpenMonitor.png
IMGScreenConnect.Properties.CommandOpenMonitor.png-preview.png
IMGScreenConnect.Properties.CommandPauseSharingMyDesktopFalse.png
IMGScreenConnect.Properties.CommandPauseSharingMyDesktopFalse.png-preview.png
IMGScreenConnect.Properties.CommandPauseSharingMyDesktopTrue.png
IMGScreenConnect.Properties.CommandPauseSharingMyDesktopTrue.png-preview.png
IMGScreenConnect.Properties.CommandRebootToNormalMode.png
IMGScreenConnect.Properties.CommandRebootToNormalMode.png-preview.png
IMGScreenConnect.Properties.CommandRebootToSafeMode.png
IMGScreenConnect.Properties.CommandRebootToSafeMode.png-preview.png
IMGScreenConnect.Properties.CommandReceiveFiles.png
IMGScreenConnect.Properties.CommandReceiveFiles.png-preview.png
IMGScreenConnect.Properties.CommandReceiveFolder.png
IMGScreenConnect.Properties.CommandReceiveFolder.png-preview.png
IMGScreenConnect.Properties.CommandRegenerateParticipantColor.png
IMGScreenConnect.Properties.CommandRegenerateParticipantColor.png-preview.png
IMGScreenConnect.Properties.CommandRequestParticipantShare.png
IMGScreenConnect.Properties.CommandRequestParticipantShare.png-preview.png
IMGScreenConnect.Properties.CommandReshareMyDesktop.png
IMGScreenConnect.Properties.CommandReshareMyDesktop.png-preview.png
IMGScreenConnect.Properties.CommandRestore.png
IMGScreenConnect.Properties.CommandRestore.png-preview.png
IMGScreenConnect.Properties.CommandSelectAnnotationModeAllDraw.png
IMGScreenConnect.Properties.CommandSelectAnnotationModeAllDraw.png-preview.png
IMGScreenConnect.Properties.CommandSelectAnnotationModeHostDraw.png
IMGScreenConnect.Properties.CommandSelectAnnotationModeHostDraw.png-preview.png
IMGScreenConnect.Properties.CommandSelectAnnotationModeInvisible.png
IMGScreenConnect.Properties.CommandSelectAnnotationModeInvisible.png-preview.png
IMGScreenConnect.Properties.CommandSelectAnnotationModeViewOnly.png
IMGScreenConnect.Properties.CommandSelectAnnotationModeViewOnly.png-preview.png
IMGScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessMedium.png
IMGScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessMedium.png-preview.png
IMGScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessThick.png
IMGScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessThick.png-preview.png
IMGScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessThin.png
IMGScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessThin.png-preview.png
IMGScreenConnect.Properties.CommandSelectAnnotationToolEllipse.png
IMGScreenConnect.Properties.CommandSelectAnnotationToolEllipse.png-preview.png
IMGScreenConnect.Properties.CommandSelectAnnotationToolLine.png
IMGScreenConnect.Properties.CommandSelectAnnotationToolLine.png-preview.png
IMGScreenConnect.Properties.CommandSelectAnnotationToolRectangle.png
IMGScreenConnect.Properties.CommandSelectAnnotationToolRectangle.png-preview.png
IMGScreenConnect.Properties.CommandSelectHelperHighlightToolCross.png
IMGScreenConnect.Properties.CommandSelectHelperHighlightToolCross.png-preview.png
IMGScreenConnect.Properties.CommandSelectHelperHighlightToolLasso.png
IMGScreenConnect.Properties.CommandSelectHelperHighlightToolLasso.png-preview.png
IMGScreenConnect.Properties.CommandSelectHelperHighlightToolNone.png
IMGScreenConnect.Properties.CommandSelectHelperHighlightToolNone.png-preview.png
IMGScreenConnect.Properties.CommandSelectQualityHigh.png
IMGScreenConnect.Properties.CommandSelectQualityHigh.png-preview.png
IMGScreenConnect.Properties.CommandSelectQualityLow.png
IMGScreenConnect.Properties.CommandSelectQualityLow.png-preview.png
IMGScreenConnect.Properties.CommandSelectQualityMedium.png
IMGScreenConnect.Properties.CommandSelectQualityMedium.png-preview.png
IMGScreenConnect.Properties.CommandSelectSharePrinterModeAll.png
IMGScreenConnect.Properties.CommandSelectSharePrinterModeAll.png-preview.png
IMGScreenConnect.Properties.CommandSelectSharePrinterModeDefaultOnly.png
IMGScreenConnect.Properties.CommandSelectSharePrinterModeDefaultOnly.png-preview.png
IMGScreenConnect.Properties.CommandSelectSharePrinterModeNone.png
IMGScreenConnect.Properties.CommandSelectSharePrinterModeNone.png-preview.png
IMGScreenConnect.Properties.CommandSelectSoundCaptureModeAllMicrophones.png
IMGScreenConnect.Properties.CommandSelectSoundCaptureModeAllMicrophones.png-preview.png
IMGScreenConnect.Properties.CommandSelectSoundCaptureModeHostMicrophone.png
IMGScreenConnect.Properties.CommandSelectSoundCaptureModeHostMicrophone.png-preview.png
IMGScreenConnect.Properties.CommandSelectSoundCaptureModeSilent.png
IMGScreenConnect.Properties.CommandSelectSoundCaptureModeSilent.png-preview.png
IMGScreenConnect.Properties.CommandSelectSoundCaptureModeSpeakers.png
IMGScreenConnect.Properties.CommandSelectSoundCaptureModeSpeakers.png-preview.png
IMGScreenConnect.Properties.CommandSendClipboardKeystrokes.png
IMGScreenConnect.Properties.CommandSendClipboardKeystrokes.png-preview.png
IMGScreenConnect.Properties.CommandSendFiles.png
IMGScreenConnect.Properties.CommandSendFiles.png-preview.png
IMGScreenConnect.Properties.CommandSendFolder.png
IMGScreenConnect.Properties.CommandSendFolder.png-preview.png
IMGScreenConnect.Properties.CommandSendMessage.png
IMGScreenConnect.Properties.CommandSendMessage.png-preview.png
IMGScreenConnect.Properties.CommandSendSystemKeyCode.png
IMGScreenConnect.Properties.CommandSendSystemKeyCode.png-preview.png
IMGScreenConnect.Properties.CommandShareMyDesktop.png
IMGScreenConnect.Properties.CommandShareMyDesktop.png-preview.png
IMGScreenConnect.Properties.CommandSplitMonitors.png
IMGScreenConnect.Properties.CommandSplitMonitors.png-preview.png
IMGScreenConnect.Properties.CommandStopParticipantShare.png
IMGScreenConnect.Properties.CommandStopParticipantShare.png-preview.png
IMGScreenConnect.Properties.CommandTakeScreenshotToClipboard.png
IMGScreenConnect.Properties.CommandTakeScreenshotToClipboard.png-preview.png
IMGScreenConnect.Properties.CommandTakeScreenshotToFile.png
IMGScreenConnect.Properties.CommandTakeScreenshotToFile.png-preview.png
IMGScreenConnect.Properties.CommandUndockControlPanel.png
IMGScreenConnect.Properties.CommandUndockControlPanel.png-preview.png
IMGScreenConnect.Properties.CommandVideoRecord.png
IMGScreenConnect.Properties.CommandVideoRecord.png-preview.png
IMGScreenConnect.Properties.ControlPanelAnnotation.png
IMGScreenConnect.Properties.ControlPanelAnnotation.png-preview.png
IMGScreenConnect.Properties.ControlPanelEssentials.png
IMGScreenConnect.Properties.ControlPanelEssentials.png-preview.png
IMGScreenConnect.Properties.ControlPanelFileTransfer.png
IMGScreenConnect.Properties.ControlPanelFileTransfer.png-preview.png
IMGScreenConnect.Properties.ControlPanelHelper.png
IMGScreenConnect.Properties.ControlPanelHelper.png-preview.png
IMGScreenConnect.Properties.ControlPanelMessages.png
IMGScreenConnect.Properties.ControlPanelMessages.png-preview.png
IMGScreenConnect.Properties.ControlPanelParticipants.png
IMGScreenConnect.Properties.ControlPanelParticipants.png-preview.png
IMGScreenConnect.Properties.ControlPanelScreenCapture.png
IMGScreenConnect.Properties.ControlPanelScreenCapture.png-preview.png
IMGScreenConnect.Properties.ControlPanelShare.png
IMGScreenConnect.Properties.ControlPanelShare.png-preview.png
IMGScreenConnect.Properties.ControlPanelSound.png
IMGScreenConnect.Properties.ControlPanelSound.png-preview.png
IMGScreenConnect.Properties.ControlPanelStatus.png
IMGScreenConnect.Properties.ControlPanelStatus.png-preview.png
IMGScreenConnect.Properties.ControlPanelToolbox.png
IMGScreenConnect.Properties.ControlPanelToolbox.png-preview.png
IMGScreenConnect.Properties.ControlPanelView.png
IMGScreenConnect.Properties.ControlPanelView.png-preview.png
IMGScreenConnect.Properties.DropDownGlyph.png
IMGScreenConnect.Properties.DropDownGlyph.png-preview.png
IMGScreenConnect.Properties.FeedbackBannerLogo.png
IMGScreenConnect.Properties.FeedbackBannerLogo.png-preview.png
IMGScreenConnect.Properties.HostClientOptions.png
IMGScreenConnect.Properties.HostClientOptions.png-preview.png
IMGScreenConnect.Properties.NotificationOptionsIcon.png
IMGScreenConnect.Properties.NotificationOptionsIcon.png-preview.png
IMGScreenConnect.Properties.ParticipantAnnotating.png
IMGScreenConnect.Properties.ParticipantAnnotating.png-preview.png
IMGScreenConnect.Properties.ParticipantCapturing.png
IMGScreenConnect.Properties.ParticipantCapturing.png-preview.png
IMGScreenConnect.Properties.ParticipantGuest.png
IMGScreenConnect.Properties.ParticipantGuest.png-preview.png
IMGScreenConnect.Properties.ParticipantHost.png
IMGScreenConnect.Properties.ParticipantHost.png-preview.png
IMGScreenConnect.Properties.ParticipantMicrophone.png
IMGScreenConnect.Properties.ParticipantMicrophone.png-preview.png
IMGScreenConnect.Properties.ParticipantMicrophoneSending.png
IMGScreenConnect.Properties.ParticipantMicrophoneSending.png-preview.png
IMGScreenConnect.Properties.ParticipantRequesting.png
IMGScreenConnect.Properties.ParticipantRequesting.png-preview.png
IMGScreenConnect.Properties.ParticipantSendingInput.png
IMGScreenConnect.Properties.ParticipantSendingInput.png-preview.png
IMGScreenConnect.Properties.ParticipantSpeakers.png
IMGScreenConnect.Properties.ParticipantSpeakers.png-preview.png
IMGScreenConnect.Properties.ParticipantSpeakersSending.png
IMGScreenConnect.Properties.ParticipantSpeakersSending.png-preview.png
IMGScreenConnect.Properties.PlaceholderImageHeadlessGuest.png
IMGScreenConnect.Properties.PlaceholderImageHeadlessGuest.png-preview.png
IMGScreenConnect.Properties.Resolutions.png
IMGScreenConnect.Properties.Resolutions.png-preview.png
IMGScreenConnect.Properties.SelectedSign.png
IMGScreenConnect.Properties.SelectedSign.png-preview.png
IMGScreenConnect.Properties.ShareGlyph.png
IMGScreenConnect.Properties.ShareGlyph.png-preview.png
IMGScreenConnect.Properties.ShareMask.png
IMGScreenConnect.Properties.ShareMask.png-preview.png
IMGScreenConnect.Properties.StatusGlyphBlankMonitor.png
IMGScreenConnect.Properties.StatusGlyphBlankMonitor.png-preview.png
IMGScreenConnect.Properties.StatusGlyphGuestAndHostConnected.png
IMGScreenConnect.Properties.StatusGlyphGuestAndHostConnected.png-preview.png
IMGScreenConnect.Properties.StatusGlyphGuestNotConnected.png
IMGScreenConnect.Properties.StatusGlyphGuestNotConnected.png-preview.png
IMGScreenConnect.Properties.StatusGlyphMask.png
IMGScreenConnect.Properties.StatusGlyphMask.png-preview.png
IMGScreenConnect.Properties.ToolTip.png
IMGScreenConnect.Properties.ToolTip.png-preview.png
CURScreenConnect.Properties.Lasso.cur
DLLScreenConnect.ClientService.dll
Structure
P7B[Authenticode]_4517e96c.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
DLLScreenConnect.Core.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
P7B[Authenticode]_8815766f.p7b
DLLScreenConnect.Windows.dll
Structure
BIN.Net Resources
DLLScreenConnect.Properties.libwebp.x64.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLScreenConnect.Properties.libwebp.x86.dll
Structure
DLLScreenConnect.Properties.libz.x64.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1036
DLLScreenConnect.Properties.libz.x86.dll
Structure
DLLScreenConnect.Properties.libzstd.x64.dll
Structure
DLLScreenConnect.Properties.libzstd.x86.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
P7B[Authenticode]_52a01c94.p7b
DLLScreenConnect.WindowsAuthenticationPackage.dll
Structure
P7B[Authenticode]_5a461ecd.p7b
BINResources
BINRT_MANIFEST
BINID:0002
BINID:1033
EXEScreenConnect.WindowsBackstageShell.exe
Structure
P7B[Authenticode]_b4593728.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
DLLScreenConnect.InstallerActions.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
DLLMicrosoft.Deployment.WindowsInstaller.dll
Structure
BIN.Net Resources
BINMicrosoft.Deployment.WindowsInstaller.Errors.resources
BINResources
BINRT_VERSION
BINID:0001
BINID:0
DLLMicrosoft.Deployment.WindowsInstaller.Package.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
DLLMicrosoft.Deployment.Compression.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
DLLMicrosoft.Deployment.Compression.Cab.dll
Structure
BIN.Net Resources
BINMicrosoft.Deployment.Compression.Cab.Errors.resources
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINCustomAction.config
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
BINapp.config
BINClient.en-US.resources
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 11 STICH kept: 2secondary ignored: 9
bin 8img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>bin>pe:dll>pe:dll
Shape ole:doc>bin>pe:dll>pe:dll
4 nodes
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

288 files
OFF1d52a25c753e5807182a9ea8be0a40fd
BINCustomAction.config
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
BINapp.config
BINClient.en-US.resources
No malware configuration was found at this point.

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
1d52a25c753e5807182a9ea8be0a40fd › Root Entry › 䈍䄩䏸䞷䄦䠥 › ScreenConnect.Windows.dll
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙