Deep Malware Analysis of 85ef4716d28cc74cb0d0db2ca38ca2f8 | md5: 85ef4716d28cc74cb0d0db2ca38ca2f8 | Office Document | CAB:COMPRESSION:LZX | CAB:COMPRESSION:NONE | Executable | PE (Portable Executable) | PE File Layout | PDB Path | .Net | Managed .NET | SOS: 0.26 | SOS: 0.21 | SOS: 0.24 | SOS: 0.32 | SOS: 0.25 | SOS: 0.36 | SOS: 0.31 | SOS: 0.27 | SOS: 0.39

CAB:COMPRESSION:NONE

Root Entry

䡀䆒䑲

䡀䌏䈯

䡀䈖䌧䠤

䡀䌋䄱䜵

䌍䎶䞁䄦䠥

䌍䎶䞂䄦䠥

䡀㬿䏲䐸䖱

䡀㽿䅤䈯䠶

䡀䈏䗤䕸䠨

䡀䈛䌪䗶䜵

䡀䓞䕪䇤䠨

䡀䕙䓲䕨䜷

䈍䄩䏸䞷䄦䠥

CAB:COMPRESSION:NONE

䌋䄱䜵䀾䛬㪌

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:1033

RT_MANIFEST

ID:0002

ID:1033

䡀䈛㵪䆲䗤䕲

䡀䌍䈵䗦䕲䠼

䡀䒌䓰䑲䑨䠷

䡀䓊㼳䄨䆵䠫

䆒䑲㲾䒦䞱䆬䠲

䡀㼿䕷䑬㭪䗤䠤

䡀㼿䕷䑬㹪䒲䠯

䡀㿿䏤䇬䗤䒬䠱

䡀䘌䗶䐲䆊䌷䑲

䆒䑲㭾䉨䘤䗯䆒䑲

䡀䈜䙵䆬㬨䑲䌩䠪

䡀䈜䙵䆬㬨䑲䕷䏲

䡀䈜䙵䆬㲨䖱䄷䏯

䡀䄕䑸䋦䒌䇱䗬䒬䠱

䡀䇊䌰㾱㼒䔨䈸䆱䠨

䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶

䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨

䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦

䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨

䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦

䌋䄱䜵㬾䖸䒷㪰䗦䒬㵱䅬䄵䜵

Overlay_f2f6f30e.bin

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

ID:1033

RT_MANIFEST

ID:0002

ID:1033

DigitalSignature

SummaryInformation

MsiDigitalSignatureEx

ScreenConnect.ClientService.exe

[Authenticode]_b293afa4.p7b

Overlay_2cdeb081.bin

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.rsrc

.reloc

Resources

RT_ICON

ID:0001

ID:0

ID:0002

ID:0

ID:0003

ID:0

ID:0004

ID:0

ID:0-preview.png

RT_GROUP_CURSOR4

ID:0000

ID:0

RT_VERSION

ID:0001

ID:0

RT_MANIFEST

ID:0001

ID:1033

ScreenConnect.InstallerActions.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Microsoft.Deployment.WindowsInstaller.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

Microsoft.Deployment.WindowsInstaller.Errors.resources

Microsoft.Deployment.WindowsInstaller.Package.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

ScreenConnect.Core.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

[Authenticode]_605455a7.p7b

ScreenConnect.Windows.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

ScreenConnect.Properties.libwebp.x64.dll

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

_RDATA

.gxfg

.gehcont

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:1033

ScreenConnect.Properties.libwebp.x86.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

_RDATA

.rsrc

.reloc

ScreenConnect.Properties.libz.x64.dll

PE File Layout

Win 64 Exe

x64

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:1036

ScreenConnect.Properties.libz.x86.dll

PE File Layout

Win 32 Exe

x86

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.rsrc

.reloc

ScreenConnect.Properties.libzstd.x64.dll

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

.reloc

ScreenConnect.Properties.libzstd.x86.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.reloc

[Authenticode]_e19fb159.p7b

Microsoft.Deployment.Compression.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

Microsoft.Deployment.Compression.Cab.dll

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

Microsoft.Deployment.Compression.Cab.Errors.resources

CustomAction.config

ScreenConnect.Client.dll

[Authenticode]_f890e3b0.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

ScreenConnect.Properties.CommandChangeFolder.png

ScreenConnect.Properties.CommandChangeFolder.png-preview.png

ScreenConnect.Properties.CommandClearAnnotations.png

ScreenConnect.Properties.CommandClearAnnotations.png-preview.png

ScreenConnect.Properties.CommandClose.png

ScreenConnect.Properties.CommandClose.png-preview.png

ScreenConnect.Properties.CommandDisconnectParticipant.png

ScreenConnect.Properties.CommandDisconnectParticipant.png-preview.png

ScreenConnect.Properties.CommandDockControlPanel.png

ScreenConnect.Properties.CommandDockControlPanel.png-preview.png

ScreenConnect.Properties.CommandManageCredentialsPromptForStorage.png

ScreenConnect.Properties.CommandManageCredentialsPromptForStorage.png-preview.png

ScreenConnect.Properties.CommandManageCredentialsSendToScreen.png

ScreenConnect.Properties.CommandManageCredentialsSendToScreen.png-preview.png

ScreenConnect.Properties.CommandManageSharedToolbox.png

ScreenConnect.Properties.CommandManageSharedToolbox.png-preview.png

ScreenConnect.Properties.CommandMaximize.png

ScreenConnect.Properties.CommandMaximize.png-preview.png

ScreenConnect.Properties.CommandMinimize.png

ScreenConnect.Properties.CommandMinimize.png-preview.png

ScreenConnect.Properties.CommandMuteMicrophoneFalse.png

ScreenConnect.Properties.CommandMuteMicrophoneFalse.png-preview.png

ScreenConnect.Properties.CommandMuteMicrophoneTrue.png

ScreenConnect.Properties.CommandMuteMicrophoneTrue.png-preview.png

ScreenConnect.Properties.CommandMuteSpeakersFalse.png

ScreenConnect.Properties.CommandMuteSpeakersFalse.png-preview.png

ScreenConnect.Properties.CommandMuteSpeakersTrue.png

ScreenConnect.Properties.CommandMuteSpeakersTrue.png-preview.png

ScreenConnect.Properties.CommandOpenFolder.png

ScreenConnect.Properties.CommandOpenFolder.png-preview.png

ScreenConnect.Properties.CommandOpenMonitor.png

ScreenConnect.Properties.CommandOpenMonitor.png-preview.png

ScreenConnect.Properties.CommandPauseSharingMyDesktopFalse.png

ScreenConnect.Properties.CommandPauseSharingMyDesktopFalse.png-preview.png

ScreenConnect.Properties.CommandPauseSharingMyDesktopTrue.png

ScreenConnect.Properties.CommandPauseSharingMyDesktopTrue.png-preview.png

ScreenConnect.Properties.CommandRebootToNormalMode.png

ScreenConnect.Properties.CommandRebootToNormalMode.png-preview.png

ScreenConnect.Properties.CommandRebootToSafeMode.png

ScreenConnect.Properties.CommandRebootToSafeMode.png-preview.png

ScreenConnect.Properties.CommandReceiveFiles.png

ScreenConnect.Properties.CommandReceiveFiles.png-preview.png

ScreenConnect.Properties.CommandReceiveFolder.png

ScreenConnect.Properties.CommandReceiveFolder.png-preview.png

ScreenConnect.Properties.CommandRegenerateParticipantColor.png

ScreenConnect.Properties.CommandRegenerateParticipantColor.png-preview.png

ScreenConnect.Properties.CommandRequestParticipantShare.png

ScreenConnect.Properties.CommandRequestParticipantShare.png-preview.png

ScreenConnect.Properties.CommandReshareMyDesktop.png

ScreenConnect.Properties.CommandReshareMyDesktop.png-preview.png

ScreenConnect.Properties.CommandRestore.png

ScreenConnect.Properties.CommandRestore.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationModeAllDraw.png

ScreenConnect.Properties.CommandSelectAnnotationModeAllDraw.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationModeHostDraw.png

ScreenConnect.Properties.CommandSelectAnnotationModeHostDraw.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationModeInvisible.png

ScreenConnect.Properties.CommandSelectAnnotationModeInvisible.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationModeViewOnly.png

ScreenConnect.Properties.CommandSelectAnnotationModeViewOnly.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessMedium.png

ScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessMedium.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessThick.png

ScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessThick.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessThin.png

ScreenConnect.Properties.CommandSelectAnnotationStrokeThicknessThin.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationToolEllipse.png

ScreenConnect.Properties.CommandSelectAnnotationToolEllipse.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationToolLine.png

ScreenConnect.Properties.CommandSelectAnnotationToolLine.png-preview.png

ScreenConnect.Properties.CommandSelectAnnotationToolRectangle.png

ScreenConnect.Properties.CommandSelectAnnotationToolRectangle.png-preview.png

ScreenConnect.Properties.CommandSelectHelperHighlightToolCross.png

ScreenConnect.Properties.CommandSelectHelperHighlightToolCross.png-preview.png

ScreenConnect.Properties.CommandSelectHelperHighlightToolLasso.png

ScreenConnect.Properties.CommandSelectHelperHighlightToolLasso.png-preview.png

ScreenConnect.Properties.CommandSelectHelperHighlightToolNone.png

ScreenConnect.Properties.CommandSelectHelperHighlightToolNone.png-preview.png

ScreenConnect.Properties.CommandSelectQualityHigh.png

ScreenConnect.Properties.CommandSelectQualityHigh.png-preview.png

ScreenConnect.Properties.CommandSelectQualityLow.png

ScreenConnect.Properties.CommandSelectQualityLow.png-preview.png

ScreenConnect.Properties.CommandSelectQualityMedium.png

ScreenConnect.Properties.CommandSelectQualityMedium.png-preview.png

ScreenConnect.Properties.CommandSelectSharePrinterModeAll.png

ScreenConnect.Properties.CommandSelectSharePrinterModeAll.png-preview.png

ScreenConnect.Properties.CommandSelectSharePrinterModeDefaultOnly.png

ScreenConnect.Properties.CommandSelectSharePrinterModeDefaultOnly.png-preview.png

ScreenConnect.Properties.CommandSelectSharePrinterModeNone.png

ScreenConnect.Properties.CommandSelectSharePrinterModeNone.png-preview.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeAllMicrophones.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeAllMicrophones.png-preview.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeHostMicrophone.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeHostMicrophone.png-preview.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeSilent.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeSilent.png-preview.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeSpeakers.png

ScreenConnect.Properties.CommandSelectSoundCaptureModeSpeakers.png-preview.png

ScreenConnect.Properties.CommandSendClipboardKeystrokes.png

ScreenConnect.Properties.CommandSendClipboardKeystrokes.png-preview.png

ScreenConnect.Properties.CommandSendFiles.png

ScreenConnect.Properties.CommandSendFiles.png-preview.png

ScreenConnect.Properties.CommandSendFolder.png

ScreenConnect.Properties.CommandSendFolder.png-preview.png

ScreenConnect.Properties.CommandSendMessage.png

ScreenConnect.Properties.CommandSendMessage.png-preview.png

ScreenConnect.Properties.CommandSendSystemKeyCode.png

ScreenConnect.Properties.CommandSendSystemKeyCode.png-preview.png

ScreenConnect.Properties.CommandShareMyDesktop.png

ScreenConnect.Properties.CommandShareMyDesktop.png-preview.png

ScreenConnect.Properties.CommandSplitMonitors.png

ScreenConnect.Properties.CommandSplitMonitors.png-preview.png

ScreenConnect.Properties.CommandStopParticipantShare.png

ScreenConnect.Properties.CommandStopParticipantShare.png-preview.png

ScreenConnect.Properties.CommandTakeScreenshotToClipboard.png

ScreenConnect.Properties.CommandTakeScreenshotToClipboard.png-preview.png

ScreenConnect.Properties.CommandTakeScreenshotToFile.png

ScreenConnect.Properties.CommandTakeScreenshotToFile.png-preview.png

ScreenConnect.Properties.CommandUndockControlPanel.png

ScreenConnect.Properties.CommandUndockControlPanel.png-preview.png

ScreenConnect.Properties.CommandVideoRecord.png

ScreenConnect.Properties.CommandVideoRecord.png-preview.png

ScreenConnect.Properties.ControlPanelAnnotation.png

ScreenConnect.Properties.ControlPanelAnnotation.png-preview.png

ScreenConnect.Properties.ControlPanelEssentials.png

ScreenConnect.Properties.ControlPanelEssentials.png-preview.png

ScreenConnect.Properties.ControlPanelFileTransfer.png

ScreenConnect.Properties.ControlPanelFileTransfer.png-preview.png

ScreenConnect.Properties.ControlPanelHelper.png

ScreenConnect.Properties.ControlPanelHelper.png-preview.png

ScreenConnect.Properties.ControlPanelMessages.png

ScreenConnect.Properties.ControlPanelMessages.png-preview.png

ScreenConnect.Properties.ControlPanelParticipants.png

ScreenConnect.Properties.ControlPanelParticipants.png-preview.png

ScreenConnect.Properties.ControlPanelScreenCapture.png

ScreenConnect.Properties.ControlPanelScreenCapture.png-preview.png

ScreenConnect.Properties.ControlPanelShare.png

ScreenConnect.Properties.ControlPanelShare.png-preview.png

ScreenConnect.Properties.ControlPanelSound.png

ScreenConnect.Properties.ControlPanelSound.png-preview.png

ScreenConnect.Properties.ControlPanelStatus.png

ScreenConnect.Properties.ControlPanelStatus.png-preview.png

ScreenConnect.Properties.ControlPanelToolbox.png

ScreenConnect.Properties.ControlPanelToolbox.png-preview.png

ScreenConnect.Properties.ControlPanelView.png

ScreenConnect.Properties.ControlPanelView.png-preview.png

ScreenConnect.Properties.DropDownGlyph.png

ScreenConnect.Properties.DropDownGlyph.png-preview.png

ScreenConnect.Properties.FeedbackBannerLogo.png

ScreenConnect.Properties.FeedbackBannerLogo.png-preview.png

ScreenConnect.Properties.HostClientOptions.png

ScreenConnect.Properties.HostClientOptions.png-preview.png

ScreenConnect.Properties.NotificationOptionsIcon.png

ScreenConnect.Properties.NotificationOptionsIcon.png-preview.png

ScreenConnect.Properties.ParticipantAnnotating.png

ScreenConnect.Properties.ParticipantAnnotating.png-preview.png

ScreenConnect.Properties.ParticipantCapturing.png

ScreenConnect.Properties.ParticipantCapturing.png-preview.png

ScreenConnect.Properties.ParticipantGuest.png

ScreenConnect.Properties.ParticipantGuest.png-preview.png

ScreenConnect.Properties.ParticipantHost.png

ScreenConnect.Properties.ParticipantHost.png-preview.png

ScreenConnect.Properties.ParticipantMicrophone.png

ScreenConnect.Properties.ParticipantMicrophone.png-preview.png

ScreenConnect.Properties.ParticipantMicrophoneSending.png

ScreenConnect.Properties.ParticipantMicrophoneSending.png-preview.png

ScreenConnect.Properties.ParticipantRequesting.png

ScreenConnect.Properties.ParticipantRequesting.png-preview.png

ScreenConnect.Properties.ParticipantSendingInput.png

ScreenConnect.Properties.ParticipantSendingInput.png-preview.png

ScreenConnect.Properties.ParticipantSpeakers.png

ScreenConnect.Properties.ParticipantSpeakers.png-preview.png

ScreenConnect.Properties.ParticipantSpeakersSending.png

ScreenConnect.Properties.ParticipantSpeakersSending.png-preview.png

ScreenConnect.Properties.PlaceholderImageHeadlessGuest.png

ScreenConnect.Properties.PlaceholderImageHeadlessGuest.png-preview.png

ScreenConnect.Properties.Resolutions.png

ScreenConnect.Properties.Resolutions.png-preview.png

ScreenConnect.Properties.SelectedSign.png

ScreenConnect.Properties.SelectedSign.png-preview.png

ScreenConnect.Properties.ShareGlyph.png

ScreenConnect.Properties.ShareGlyph.png-preview.png

ScreenConnect.Properties.ShareMask.png

ScreenConnect.Properties.ShareMask.png-preview.png

ScreenConnect.Properties.StatusGlyphBlankMonitor.png

ScreenConnect.Properties.StatusGlyphBlankMonitor.png-preview.png

ScreenConnect.Properties.StatusGlyphGuestAndHostConnected.png

ScreenConnect.Properties.StatusGlyphGuestAndHostConnected.png-preview.png

ScreenConnect.Properties.StatusGlyphGuestNotConnected.png

ScreenConnect.Properties.StatusGlyphGuestNotConnected.png-preview.png

ScreenConnect.Properties.StatusGlyphMask.png

ScreenConnect.Properties.StatusGlyphMask.png-preview.png

ScreenConnect.Properties.ToolTip.png

ScreenConnect.Properties.ToolTip.png-preview.png

ScreenConnect.Properties.Lasso.cur

ScreenConnect.ClientService.dll

[Authenticode]_c8a91709.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

ScreenConnect.WindowsAuthenticationPackage.dll

[Authenticode]_5a461ecd.p7b

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

_RDATA

.rsrc

.reloc

Resources

RT_MANIFEST

ID:0002

ID:1033

ScreenConnect.WindowsBackstageShell.exe

[Authenticode]_5a8536a3.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

RT_MANIFEST

ID:0001

ID:0

ScreenConnect.WindowsBackstageShell.exe.config

ScreenConnect.WindowsClient.exe

ScreenConnect.WindowsCredentialProvider.arm64.dll

ScreenConnect.WindowsCredentialProvider.dll

ScreenConnect.WindowsFileManager.exe

ServiceExeWithoutService

app.config

Client.en-US.resources

Client.Override.en-US.resources

Client.resources