Suspicious
Suspect

533fae03521fec7c976eb70e3a956e92

Share on LinkedIn
Print
MS Office Document
MD5: 533fae03521fec7c976eb70e3a956e92
Size: 9.96 MB
application/vnd.ms-office

This sample is a 9.5 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 302 embedded or derived files. It matches 29 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a3127cdddbc506fa2d71c058eec15514123e6aa8dc28e633c8bf5fdeeea8b003
MD5
533fae03521fec7c976eb70e3a956e92
Verdict
Inconclusive
File type
MS Office Document · 9.5 MB

Cite this report: https://app.malva.re/sha256/a3127cdddbc506fa2d71c058eec15514123e6aa8dc28e633c8bf5fdeeea8b003

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
9.96 MB · 9,957,376 B
First seen
2026-10-21 16:45 · 7 days ago
Last seen
2026-10-21 16:45 · 7 days ago
Last analysis
2026-10-21 22:05 · 7 days ago
Hashes
MD5 533fae03521fec7c976eb70e3a956e92 Sha1 84be4004a51ff1bf0d5a8b7dbb400128386e49a0 Sha256 a3127cdddbc506fa2d71c058eec15514123e6aa8dc28e633c8bf5fdeeea8b003 Sha384 06133658c3ead55028f9f3638f3b959cf4b0151ab1816dcdc707985fa2be968a9340c7b360492a8efb558959e783de0d Sha512 300b2e6533fdd1efe39d872f2570036ee2cfbee894acef89439c33fb853b18d316ee94d609ced0961e9ef8f06228fee379605cf64fa35a85e5e859f0c8631f0e SSDeep 196608:oHxcp9ym3nltDUJVCHxcp9ym3YHxcp9ym39Hxcp9ym3aHxcp9ym3:2Gplp1GpmGpvGpoGp TLSH 30A623116BF8D278F1F12A39D876A0B1A53A7D119E23D12E2324791E2C75EC0CA63777

293 files
OFF533fae03521fec7c976eb70e3a956e92
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
BINCustomAction.config
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 10 STICH kept: 2secondary ignored: 8
bin 7img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>bin>pe:dll
Shape ole:doc>bin>pe:dll
3 nodes
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙