Suspicious
Suspect

8bf02f70e1a6603c5cd2edfba87c1d0a

Share on LinkedIn
Print
MS Office Document
MD5: 8bf02f70e1a6603c5cd2edfba87c1d0a
Size: 1.57 MB
application/vnd.ms-office

This sample is a 1.5 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 244 embedded or derived files. It matches 14 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
6c055aa2fc1e9f7a6a5507a288d9a1a21b3dcd8ec81df84e1df5f6e6e7a35d8d
MD5
8bf02f70e1a6603c5cd2edfba87c1d0a
Verdict
Inconclusive
File type
MS Office Document · 1.5 MB

Cite this report: https://app.malva.re/sha256/6c055aa2fc1e9f7a6a5507a288d9a1a21b3dcd8ec81df84e1df5f6e6e7a35d8d

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
1.57 MB · 1,568,768 B
First seen
2026-10-11 15:15 · 17 days ago
Last seen
2026-10-11 15:15 · 17 days ago
Last analysis
2026-10-11 15:16 · 17 days ago
Hashes
MD5 8bf02f70e1a6603c5cd2edfba87c1d0a Sha1 0f2aef8059f982743d28468d6d878f9cc1b49116 Sha256 6c055aa2fc1e9f7a6a5507a288d9a1a21b3dcd8ec81df84e1df5f6e6e7a35d8d Sha384 3db13456da11fac98ccb1ae641c09e14d6b03521fa0990a38295e56c57fd4e5db4fd0759ce2d6b05310d2843386e1250 Sha512 537347ddac469e23a3d9f525b9a11f99be69a96e055aba7fad6c8674e8d53e0fd7a979a8f48068c4bb4d92720f296814a49e6ae3038c0a2aa2736e182fec3782 SSDeep 24576:kZPlmF0uwTKh56Z5vePu/DVeL1pVjeOLnUUGGu/aYmQurhwQUvm:Omh69eWbVypVCcgGu/aYmn1gm TLSH F975012077F88439F6F62B31AE3A95609E3ABD241F71C15E8354351D0DB0A909BB6773

244 files
OFF8bf02f70e1a6603c5cd2edfba87c1d0a
DLLScreenConnect.Client.dll
DLLScreenConnect.ClientService.dll
DLLScreenConnect.Windows.dll
EXEScreenConnect.WindowsClient.exe
BINScreenConnect.WindowsClient.exe.config
BINServiceExeWithoutService
BINCustomAction.config
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 14 STICH kept: 3secondary ignored: 11
bin 10img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path ole:doc>bin>pe:dll>pe:dll
Shape ole:doc>bin>pe:dll>pe:dll
4 nodes
Path ole:doc>pe:dll>bin>pe:dll
Shape ole:doc>pe:dll>bin>pe:dll
4 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙