Suspicious
Suspect

9834742dbe0925528926a08adf09c9a7

Share on LinkedIn
Print
MS Office Document
MD5: 9834742dbe0925528926a08adf09c9a7
Size: 11.82 MB
application/vnd.ms-office

This sample is a 11.3 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 293 embedded or derived files. It matches 31 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
37ecde70c8ec686529bdba667d9836f4da9979728b52dee1f1a95c5b35aa9b6b
MD5
9834742dbe0925528926a08adf09c9a7
Verdict
Inconclusive
File type
MS Office Document · 11.3 MB

Cite this report: https://app.malva.re/sha256/37ecde70c8ec686529bdba667d9836f4da9979728b52dee1f1a95c5b35aa9b6b

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
11.82 MB · 11,821,056 B
First seen
2026-11-02 07:30 · 9 hours ago
Last seen
2026-11-02 07:30 · 9 hours ago
Last analysis
2026-11-02 07:30 · 9 hours ago
Hashes
MD5 9834742dbe0925528926a08adf09c9a7 Sha1 9161257d026e58ae6350081f618f0528d4835b4e Sha256 37ecde70c8ec686529bdba667d9836f4da9979728b52dee1f1a95c5b35aa9b6b Sha384 98c0c36b03490b8da6651c8b194f5be4cc835987e5d82b7a4128519dbb892172d470ebc88535a3374014a91d7b8a3605 Sha512 cff39cdd1cad253449e7e2b3e439d18fa40c86cd7de3739e0f44509466459c66dc546e72085a53b35fbbab10173b61c919c13b9692040715bdca5d95cdafdddc SSDeep 196608:IrnLYG3zDhukOtrnLYG3zCrnLYG3zTrnLYG3zfrnLYG3z5rnLYG3z:IbDDDgvtbDDCbDDTbDDfbDD5bDD TLSH 48C6232267F94918E1F36778ED3991F191367C50CF12C08FA6143C6E6879E9086A37BB

289 files
OFF9834742dbe0925528926a08adf09c9a7
DLLScreenConnect.Client.dll
DLLScreenConnect.ClientService.dll
DLLScreenConnect.Core.dll
DLLScreenConnect.InstallerActions.dll
DLLMicrosoft.Deployment.WindowsInstaller.dll
DLLMicrosoft.Deployment.WindowsInstaller.Package.dll
DLLMicrosoft.Deployment.Compression.dll
DLLMicrosoft.Deployment.Compression.Cab.dll
BINCustomAction.config
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 15 STICH kept: 3secondary ignored: 12
bin 11img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path ole:doc>bin>pe:dll>pe:dll
Shape ole:doc>bin>pe:dll>pe:dll
4 nodes
Path ole:doc>pe:dll>bin>pe:dll
Shape ole:doc>pe:dll>bin>pe:dll
4 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙