Suspicious
Suspect

a6ea1af8ac52d4e7eabb26c1f1aa2eaa

Share on LinkedIn
Print
MS Office Document
MD5: a6ea1af8ac52d4e7eabb26c1f1aa2eaa
Size: 1.57 MB
application/vnd.ms-office

This sample is a 1.5 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 244 embedded or derived files. It matches 14 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
7e156776064bbc27cdf59cd6bd1f30298d7fc7b2d14ebf5dc2c39703065a6077
MD5
a6ea1af8ac52d4e7eabb26c1f1aa2eaa
Verdict
Inconclusive
File type
MS Office Document · 1.5 MB

Cite this report: https://app.malva.re/sha256/7e156776064bbc27cdf59cd6bd1f30298d7fc7b2d14ebf5dc2c39703065a6077

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
1.57 MB · 1,568,768 B
First seen
2026-10-11 15:15 · 18 days ago
Last seen
2026-10-11 15:15 · 18 days ago
Last analysis
2026-10-11 15:16 · 18 days ago
Hashes
MD5 a6ea1af8ac52d4e7eabb26c1f1aa2eaa Sha1 835c2ef8bc53d91fd1dc2bd743434800a27f61cf Sha256 7e156776064bbc27cdf59cd6bd1f30298d7fc7b2d14ebf5dc2c39703065a6077 Sha384 22ceef2e7a97aa0acff2e2413dd54e575024d2701fef98e5e1592771aba4627ff6d6c2e8b4d0e53b9c5e84a7fba9ddd8 Sha512 56aa23747126b7cad6f73801e27acba4a50f79a852832a8066a7174a08a9f9ed19e3cf030d6b59f2e83e7e4327f604b8aab1eff312265ac8ba2a68de171fb432 SSDeep 24576:+ZPlmF0uwTKh56Z5vePu/DVeL1pVjeOTnUUGGu/aYmQurhwQUvJ:Emh69eWbVypVCEgGu/aYmn1gJ TLSH 6475012077F88439F6F62B31AE3A95609E3ABD241F71C15E8354391D0DB0A909BB6773

244 files
OFFa6ea1af8ac52d4e7eabb26c1f1aa2eaa
DLLScreenConnect.Client.dll
DLLScreenConnect.ClientService.dll
DLLScreenConnect.Windows.dll
EXEScreenConnect.WindowsClient.exe
BINScreenConnect.WindowsClient.exe.config
BINServiceExeWithoutService
BINCustomAction.config
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 13 STICH kept: 3secondary ignored: 10
bin 9img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path ole:doc>bin>pe:dll>pe:dll
Shape ole:doc>bin>pe:dll>pe:dll
4 nodes
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙