Suspicious
Suspect

a0c874bf5ab6955aa08bfc23a0da5b18

Share on LinkedIn
Print
MS Office Document
MD5: a0c874bf5ab6955aa08bfc23a0da5b18
Size: 13.51 MB
application/vnd.ms-office

This sample is a 12.9 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 300 embedded or derived files. It matches 28 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
c064f815d1d28b34a06032ae614ecc4743101573b47ac14dcacf90e1dc61ca8c
MD5
a0c874bf5ab6955aa08bfc23a0da5b18
Verdict
Inconclusive
File type
MS Office Document · 12.9 MB

Cite this report: https://app.malva.re/sha256/c064f815d1d28b34a06032ae614ecc4743101573b47ac14dcacf90e1dc61ca8c

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
13.51 MB · 13,508,608 B
First seen
2026-10-30 00:45 · 3 days ago
Last seen
2026-10-30 00:45 · 3 days ago
Last analysis
2026-10-30 00:45 · 3 days ago
Hashes
MD5 a0c874bf5ab6955aa08bfc23a0da5b18 Sha1 4ed3c216d20498cbd2e03249eb2eaf3713feb00a Sha256 c064f815d1d28b34a06032ae614ecc4743101573b47ac14dcacf90e1dc61ca8c Sha384 130ac7b4dcd939d1212b2c4f2b2b1dc3a03d3ea49e4bd944ff31353e8e9090f3ec3502830f6713962aab7ddfbe219318 Sha512 2270d6610e349fd881e8da2cad6f4a7496b06e67d387a47ac091758910eac8becaf494fb2854d8fb48fa14fcd8c8eca1d20eb69826be67dcd44e95ec6db6d802 SSDeep 196608:AHxcp9ym3nltDUJV6Hxcp9ym3dHxcp9ym3DHxcp9ym3BHxcp9ym3QHxcp9ym30Hk:uGplp9GpPGptGpzGp+GpSGp TLSH 68D623116BF89278F0F26A39E87AA071A5377D115E22D12E2324791E2C75EC0C9B3777

292 files
OFFa0c874bf5ab6955aa08bfc23a0da5b18
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
DLLScreenConnect.InstallerActions.dll
DLLMicrosoft.Deployment.WindowsInstaller.dll
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 13 STICH kept: 1secondary ignored: 12
bin 11img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙