Suspicious
Suspect

b5c04ae5e46d0a53b4c4d5ee24876fb5

Share on LinkedIn
Print
MS Office Document
MD5: b5c04ae5e46d0a53b4c4d5ee24876fb5
Size: 10.26 MB
application/vnd.ms-office

This sample is a 9.8 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 308 embedded or derived files. It matches 34 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
c94a8854e5fa811fc709b0d1e6212dfadee72259b5f95e63c41bb491c5e5d9a8
MD5
b5c04ae5e46d0a53b4c4d5ee24876fb5
Verdict
Inconclusive
File type
MS Office Document · 9.8 MB

Cite this report: https://app.malva.re/sha256/c94a8854e5fa811fc709b0d1e6212dfadee72259b5f95e63c41bb491c5e5d9a8

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
10.26 MB · 10,256,384 B
First seen
2026-10-31 00:15 · 2 days ago
Last seen
2026-10-31 00:15 · 2 days ago
Last analysis
2026-10-31 00:16 · 2 days ago
Hashes
MD5 b5c04ae5e46d0a53b4c4d5ee24876fb5 Sha1 4ea4a3a6e4a30f27d0d10f8bfd5bc2fdb5d5375e Sha256 c94a8854e5fa811fc709b0d1e6212dfadee72259b5f95e63c41bb491c5e5d9a8 Sha384 f37f1dff28c49fee2158221f911221055580e6ed952173dee2515d81f0cddacf4f830ae23ddfe2f142541669607e5fa7 Sha512 db879c1a3c0093e46d21b6dbcc2d63c6519e9f349b25450b23b212659a92bdbd02632dffbcb4feb3a16162756259a2e9d549f9128013f9362aee31d842d3a981 SSDeep 196608:6Frg904SOL2Y5V10Frg904SOLmFrg904SOLeFrg904SOL:6Fri04SOLJX10Fri04SOLmFri04SOLeg TLSH 48A6237262F8D125E2F34639FE7992E1583A7D51ED12C01F5B28381EA271E808A77377

307 files
OFFb5c04ae5e46d0a53b4c4d5ee24876fb5
BINCustomAction.config
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.arm64.dll
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
BINClient.en-US.resources
BINClient.resources
BINsystem.config
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 9 STICH kept: 2secondary ignored: 7
bin 6img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes
Path ole:doc>pe:dll
Shape ole:doc>pe:dll
2 nodes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙