Suspicious
Suspect

71b6e922e2ea877fd4036912d24c5e08

Share on LinkedIn
Print
MS Office Document
MD5: 71b6e922e2ea877fd4036912d24c5e08
Size: 13.86 MB
application/vnd.ms-office

This sample is a 13.2 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 304 embedded or derived files. It matches 30 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
6981fe84e6587f94c2379b279634df6f378a3bc78c2b36cc510dace0eb2736d7
MD5
71b6e922e2ea877fd4036912d24c5e08
Verdict
Inconclusive
File type
MS Office Document · 13.2 MB

Cite this report: https://app.malva.re/sha256/6981fe84e6587f94c2379b279634df6f378a3bc78c2b36cc510dace0eb2736d7

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
13.86 MB · 13,856,768 B
First seen
2026-10-21 03:30 · 8 days ago
Last seen
2026-10-21 03:30 · 8 days ago
Last analysis
2026-10-21 03:36 · 8 days ago
Hashes
MD5 71b6e922e2ea877fd4036912d24c5e08 Sha1 c5109a1a5ada2a641c7ae5db8ae70bd05091a04b Sha256 6981fe84e6587f94c2379b279634df6f378a3bc78c2b36cc510dace0eb2736d7 Sha384 248254f32e777065caae3494b48b407455b36ba6347fbd5bc10fddbf48ec206e5a7f4849583355743f1caedacda74d3d Sha512 228ec437f807afe3f377deed8617dd368419866c4bd18dc4c9a50a383a6b9483e07c23c8330ee1ca751c256b94ccf40085204bbe2e9c748473ae20baa60abec4 SSDeep 196608:wHxcp9ym3nltDUJVnHxcp9ym37Hxcp9ym3/Hxcp9ym33Hxcp9ym3jqEHxcp9ym3F:eGplpcGpFGpJGphGpRGp9GpW TLSH B9D623116BF89278F1F22E39E876A0B1A5377D525E22D12E2324791E2C71EC0C963777

293 files
OFF71b6e922e2ea877fd4036912d24c5e08
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
BINCustomAction.config
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 14 STICH kept: 4secondary ignored: 10
bin 9img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path ole:doc>pe:dll>bin>pe:dll
Shape ole:doc>pe:dll>bin>pe:dll
4 nodes
Path ole:doc>pe:dll>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll>pe:dll
4 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙