MS Office Document file analysis – e8a4cf9b9b5a

This sample is a 9.5 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 299 embedded or derived files. It matches 33 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: e8a4cf9b9b5a81846e97e62eea7e1d15a156b886c258ed0a1174789a29b262d8
MD5: 1d52a25c753e5807182a9ea8be0a40fd
Verdict: Inconclusive
File type: MS Office Document · 9.5 MB

Cite this report: https://app.malva.re/sha256/e8a4cf9b9b5a81846e97e62eea7e1d15a156b886c258ed0a1174789a29b262d8

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

Size

9.96 MB · 9,961,472 B

First seen

2026-10-04 08:45 · 24 days ago

Last seen

2026-10-04 08:45 · 24 days ago

Last analysis

2026-10-04 15:02 · 24 days ago

Hashes

MD5 1d52a25c753e5807182a9ea8be0a40fd Sha1 aa091d7530669fad3f65f53d3059f6370f9b5f45 Sha256 e8a4cf9b9b5a81846e97e62eea7e1d15a156b886c258ed0a1174789a29b262d8 Sha384 3c0aebab3f4ef955b9d0e639828a1c8bd21f12b650147abb55a3752c5e7e35de1cc6d4d4386a8c7d08c1ef12eced7766 Sha512 5e0c34eda35fda4dea51c76f4dba7ad6df710b2e15e5ebe2369866b93d6e988211c96e8f822f00956761d749055d81df603c9c2dc6d85c994a2607e5dd9355bd SSDeep 196608:e/FZ0rbiu7ZgbUCs/FZ0rbiu7d/FZ0rbiu7P/FZ0rbiu7G/FZ0rbiu7:e/FZ0rbiuvCs/FZ0rbiu5/FZ0rbiuD/6 TLSH 87A6232223E8895CE27B0B39E83955F19875BC61EA26C41F6764BC2D5830F819B73773

288 files

OFF1d52a25c753e5807182a9ea8be0a40fd

BINRoot Entry

DLLScreenConnect.Client.dll

DLLScreenConnect.ClientService.dll

DLLScreenConnect.Core.dll

DLLScreenConnect.Windows.dll

DLLScreenConnect.WindowsAuthenticationPackage.dll

EXEScreenConnect.WindowsBackstageShell.exe

DLLScreenConnect.InstallerActions.dll

DLLMicrosoft.Deployment.WindowsInstaller.dll

DLLMicrosoft.Deployment.WindowsInstaller.Package.dll

DLLMicrosoft.Deployment.Compression.dll

DLLMicrosoft.Deployment.Compression.Cab.dll

BINCustomAction.config

BINScreenConnect.WindowsBackstageShell.exe.config

EXEScreenConnect.WindowsClient.exe

DLLScreenConnect.WindowsCredentialProvider.dll

EXEScreenConnect.WindowsFileManager.exe

BINServiceExeWithoutService

BINapp.config

BINClient.en-US.resources

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 11 STICH kept: 2secondary ignored: 9

bin 8img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path ole:doc>bin>pe:dll>pe:dll

Shape ole:doc>bin>pe:dll>pe:dll

4 nodes

Path ole:doc>pe:dll>pe:dll

Shape ole:doc>pe:dll>pe:dll

3 nodes

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

1d52a25c753e5807182a9ea8be0a40fd

Overview

Summary by MalvaGPT

Characteristics

File Structure

Artefacts1

1d52a25c753e5807182a9ea8be0a40fd (9.96 MB)

File Structure

Artefacts1