Suspicious
Suspect

abbe67cbc539897332b6b01406851c6a

Share on LinkedIn
Print
MS Office Document
MD5: abbe67cbc539897332b6b01406851c6a
Size: 12.47 MB
application/vnd.ms-office

This sample is a 11.9 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 309 embedded or derived files. It matches 34 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
9ef81e34ee62f322dd442e598ab73b8e0bff360e39117257778ddab6282c5b63
MD5
abbe67cbc539897332b6b01406851c6a
Verdict
Inconclusive
File type
MS Office Document · 11.9 MB

Cite this report: https://app.malva.re/sha256/9ef81e34ee62f322dd442e598ab73b8e0bff360e39117257778ddab6282c5b63

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
12.47 MB · 12,472,320 B
First seen
2026-10-31 00:15 · 2 days ago
Last seen
2026-10-31 00:15 · 2 days ago
Last analysis
2026-10-31 00:16 · 2 days ago
Hashes
MD5 abbe67cbc539897332b6b01406851c6a Sha1 0509b51816ba79414b8dbdb15e45512084ee32c3 Sha256 9ef81e34ee62f322dd442e598ab73b8e0bff360e39117257778ddab6282c5b63 Sha384 e1a6ad94bdc36576fba90d71eaad6a69af6dc73e9bcfb208cb87b7fb077719093e5e9fb69e55277def0a661db6b56411 Sha512 04f5936834f21b7eb66abc51b9aa2a83aec1c9c663f6a9d269457013708dfece99964d61c8813cb0cc4879c6969d785d18dde0715f551db9b01b1ca866662d5f SSDeep 196608:xFrg904SOL/Y5V1RFrg904SOL3Frg904SOLpFrg904SOL4Frg904SOL:xFri04SOLAX1RFri04SOL3Fri04SOLpO TLSH E9C6237262F8D125F6F34A35FE7982E158367D91ED12C01F5B28381E9271A80CA763B7

308 files
OFFabbe67cbc539897332b6b01406851c6a
BINCustomAction.config
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.arm64.dll
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
BINClient.en-US.resources
BINClient.Override.en-US.resources
BINClient.resources
BINsystem.config
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 9 STICH kept: 2secondary ignored: 7
bin 6img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes
Path ole:doc>pe:dll
Shape ole:doc>pe:dll
2 nodes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙