MS Office Document file analysis – 82425d057801

This sample is a 9.5 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 293 embedded or derived files. It matches 26 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: 82425d0578018a3b269c3a80bbbac8bb92d1312cafbdd290afda3af59c7a3a12
MD5: 392e6208ffc72344155c67ea8fcd7b25
Verdict: Inconclusive
File type: MS Office Document · 9.5 MB

Cite this report: https://app.malva.re/sha256/82425d0578018a3b269c3a80bbbac8bb92d1312cafbdd290afda3af59c7a3a12

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

Size

9.91 MB · 9,912,320 B

First seen

2026-10-27 11:45 · 2 days ago

Last seen

2026-10-27 11:45 · 2 days ago

Last analysis

2026-10-27 11:45 · 2 days ago

Hashes

MD5 392e6208ffc72344155c67ea8fcd7b25 Sha1 86fa586abdf6c674502b099feee9f377c67312ed Sha256 82425d0578018a3b269c3a80bbbac8bb92d1312cafbdd290afda3af59c7a3a12 Sha384 d9103560375108282c9473e37381f5949abc7d3cee4903e42f6c5840dbbd5a54acae8a89381ad44d0e152a593651e237 Sha512 5cc4a4952aed3779ba844e2e63be419bf0b87748d6571eacc0097d2b5d77be4d3cbcf0f836dcf498fe928473a446ed2c4455218023fa5527b0d6d0ae49184116 SSDeep 98304:0wJ4t1h0cG5FGJRPxow8OfwJ4t1h0cG5vwJ4t1h0cG5RwJ4t1h0cG5rwJ4t1h0cW:dWh0cGwOWh0cGCWh0cG4Wh0cGeWh0cG TLSH 9FA6232523FD801AE8F75A7DED3682F45972BE64CE22C11E9328BD0D2974D4096727B3

283 files

OFF392e6208ffc72344155c67ea8fcd7b25

BINRoot Entry

DLLScreenConnect.Client.dll

DLLScreenConnect.ClientService.dll

DLLScreenConnect.Core.dll

DLLScreenConnect.Windows.dll

DLLScreenConnect.WindowsAuthenticationPackage.dll

EXEScreenConnect.WindowsBackstageShell.exe

BINScreenConnect.WindowsBackstageShell.exe.config

EXEScreenConnect.WindowsClient.exe

DLLScreenConnect.WindowsCredentialProvider.dll

EXEScreenConnect.WindowsFileManager.exe

BINServiceExeWithoutService

BINapp.config

BINClient.en-US.resources

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 13 STICH kept: 2secondary ignored: 11

bin 10img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path ole:doc>pe:dll>pe:dll>pe:dll

Shape ole:doc>pe:dll>pe:dll>pe:dll

4 nodes

Path ole:doc>pe:dll>pe:dll

Shape ole:doc>pe:dll>pe:dll

3 nodes

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

392e6208ffc72344155c67ea8fcd7b25

Overview

Summary by MalvaGPT

Characteristics

File Structure

Artefacts1

392e6208ffc72344155c67ea8fcd7b25 (9.91 MB)

File Structure

Artefacts1