Suspicious
Suspect

ab0bf02ea344a3b6485fca3164a311b1

Share on LinkedIn
Print
MS Office Document
MD5: ab0bf02ea344a3b6485fca3164a311b1
Size: 1.57 MB
application/vnd.ms-office

This sample is a 1.5 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 244 embedded or derived files. It matches 14 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
31d0dd8afccc7929f68579bfbbba3e5359284eb34b9f955b8534f8f720fa7077
MD5
ab0bf02ea344a3b6485fca3164a311b1
Verdict
Inconclusive
File type
MS Office Document · 1.5 MB

Cite this report: https://app.malva.re/sha256/31d0dd8afccc7929f68579bfbbba3e5359284eb34b9f955b8534f8f720fa7077

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
1.57 MB · 1,568,768 B
First seen
2026-10-08 13:30 · 22 days ago
Last seen
2026-10-08 13:30 · 22 days ago
Last analysis
2026-10-08 13:31 · 22 days ago
Hashes
MD5 ab0bf02ea344a3b6485fca3164a311b1 Sha1 1a46a880260a583f5a8dbb8cee496f5f6df8b483 Sha256 31d0dd8afccc7929f68579bfbbba3e5359284eb34b9f955b8534f8f720fa7077 Sha384 068db75f33f36e554a7c9c1913cceccdd7f827324c109eb6321e566ae7cc8f34f775bfa1ef53fd00c259441185da12be Sha512 42b5c878cc4489e728e95217556b492dc64d2e9822961de7c3d17f2aac8575057f426092c347d9cab1c227c478f7634a227436ba660e36f1666934d2f5091a47 SSDeep 24576:VZPlmF0uwTKh56Z5vePu/DVeL1pVjeOZnUUGGu/aYmQurhwQUvb:pmh69eWbVypVCqgGu/aYmn1gb TLSH CA75012077F88439F6F62B31AE3A95609E3ABD241F71C15E8354391D0DB0A909BB6773

244 files
OFFab0bf02ea344a3b6485fca3164a311b1
DLLScreenConnect.Client.dll
DLLScreenConnect.ClientService.dll
DLLScreenConnect.Windows.dll
EXEScreenConnect.WindowsClient.exe
BINScreenConnect.WindowsClient.exe.config
BINServiceExeWithoutService
BINCustomAction.config
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 13 STICH kept: 3secondary ignored: 10
bin 9img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path ole:doc>bin>pe:dll>pe:dll
Shape ole:doc>bin>pe:dll>pe:dll
4 nodes
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙