Suspicious
Suspect

6a7fdfa1818951d5351f0fa21a686d67

Share on LinkedIn
Print
MS Office Document
MD5: 6a7fdfa1818951d5351f0fa21a686d67
Size: 10.24 MB
application/vnd.ms-office

This sample is a 9.8 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 320 embedded or derived files. It matches 36 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
bda6ac25a5c53bcfe69bbc6b097ac79681a83c80c7de5a5cfa75c1fd4b043ce9
MD5
6a7fdfa1818951d5351f0fa21a686d67
Verdict
Inconclusive
File type
MS Office Document · 9.8 MB

Cite this report: https://app.malva.re/sha256/bda6ac25a5c53bcfe69bbc6b097ac79681a83c80c7de5a5cfa75c1fd4b043ce9

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
10.24 MB · 10,244,096 B
First seen
2026-10-30 00:30 · 3 days ago
Last seen
2026-10-30 00:30 · 3 days ago
Last analysis
2026-10-30 00:30 · 3 days ago
Hashes
MD5 6a7fdfa1818951d5351f0fa21a686d67 Sha1 26960f0c92edd507b2843858aa26dccaa022ed5c Sha256 bda6ac25a5c53bcfe69bbc6b097ac79681a83c80c7de5a5cfa75c1fd4b043ce9 Sha384 03c7ff0f8c0af3db781540e97e21e7c33439474950ed4efff3d1f546ab5f39ad61c6772d420ee4f67b42d784f5b44528 Sha512 b1e58c2b4a2fdb4979e852948fdb4cfbea1f46b5b775e68c894638c387cdb7c9b98a8a878d66543fa100bee03005f860ee96bf2fe93f13bb121878bbbb877a38 SSDeep 98304:cMn1Giy8E1PqhPG6ztZNK9aNGPMn1Giy8E1PqhAMn1Giy8E1PqhjMn1Giy8E1Pqh:vZWiDz3I967ZWijZWiCZWi TLSH 99A6232123FAC168F1B61B35D93965B56936BD12DA22C04F1364BE6E3C31F949A72333

319 files
OFF6a7fdfa1818951d5351f0fa21a686d67
BINCustomAction.config
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.arm64.dll
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
BINClient.en-US.resources
BINClient.resources
BINsystem.config
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 10 STICH kept: 1secondary ignored: 9
bin 8img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙