Sign up free
Suspicious
Suspect

9abc5e7a0a7204554b691fa078b18803

Share on LinkedIn
Print
MS Office Document
MD5: 9abc5e7a0a7204554b691fa078b18803
Size: 13.41 MB
application/vnd.ms-office

This sample is a 12.8 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 295 embedded or derived files. It matches 32 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
239e08348e93521099925b54a985509ea438cdee05e0090e2403e0f895bbc9a2
MD5
9abc5e7a0a7204554b691fa078b18803
Verdict
Inconclusive
File type
MS Office Document · 12.8 MB

Cite this report: https://app.malva.re/sha256/239e08348e93521099925b54a985509ea438cdee05e0090e2403e0f895bbc9a2

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
13.41 MB · 13,406,208 B
First seen
2026-09-11 18:15 · one month ago
Last seen
2026-09-11 18:15 · one month ago
Last analysis
2026-09-11 18:15 · one month ago
Hashes
MD5 9abc5e7a0a7204554b691fa078b18803 Sha1 110aa26ae4073c13bb6e0192349932a60c49048e Sha256 239e08348e93521099925b54a985509ea438cdee05e0090e2403e0f895bbc9a2 Sha384 31eb5964958757f8f5f20ee2017d4bbbd418e2a8f0006d919a24fe0af3d7f20ba7f67a27e6eedc84873509006bed16ba Sha512 c0618523b1375ad0351949c29ee64f3e5d33555b923fe94a6d257f067ad0076cdd8a5416113a5a4e779c6cbbdf2b0161d9ba513ba1fef8b28cc0d828216fb7a7 SSDeep 196608:2Hxcp9ym3nltDUJVBHxcp9ym3NHxcp9ym33Hxcp9ym3gHxcp9ym3/Hxcp9ym3PHR:EGplpyGp/GphGpOGpJGpZGpa TLSH 72D623116BF89278F0F22A39E876A0B1A5377D515E22D12E2324791E2C75EC0C9B3777

291 files
OFF9abc5e7a0a7204554b691fa078b18803
DLLScreenConnect.Client.dll
DLLScreenConnect.ClientService.dll
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
BINCustomAction.config
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 13 STICH kept: 3secondary ignored: 10
bin 9img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path ole:doc>bin>pe:dll>pe:dll
Shape ole:doc>bin>pe:dll>pe:dll
4 nodes
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙