Suspicious
Suspect

bb85d3b922d633b4cdb796ccef4ce75e

Share on LinkedIn
Print
MS Office Document
MD5: bb85d3b922d633b4cdb796ccef4ce75e
Size: 1.57 MB
application/vnd.ms-office

This sample is a 1.5 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 244 embedded or derived files. It matches 14 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
2c8a65f496dee16049bba7303ed0a0eda99adbbd844dadc790110adfd33731f4
MD5
bb85d3b922d633b4cdb796ccef4ce75e
Verdict
Inconclusive
File type
MS Office Document · 1.5 MB

Cite this report: https://app.malva.re/sha256/2c8a65f496dee16049bba7303ed0a0eda99adbbd844dadc790110adfd33731f4

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
1.57 MB · 1,568,768 B
First seen
2026-10-11 15:15 · 18 days ago
Last seen
2026-10-11 15:15 · 18 days ago
Last analysis
2026-10-11 15:16 · 18 days ago
Hashes
MD5 bb85d3b922d633b4cdb796ccef4ce75e Sha1 9456ed6bd770e23827470be9723e3717d4c1fdb6 Sha256 2c8a65f496dee16049bba7303ed0a0eda99adbbd844dadc790110adfd33731f4 Sha384 41af102485dd9df8f65ee6577d563db7b3f341849b1ff4c65976417e2b8ae716654e1bf96141f643597157553b4844a2 Sha512 3ed37327a5274d25c98a541a4243908866a5c94567e47c12439946f70f1c86c4c9a0f89f4cc899906dd01968c664b5d0a1ca292081936ee46fc19f04a4cb0f81 SSDeep 24576:QZPlmF0uwTKh56Z5vePu/DVeL1pVjeOCnUUGGu/aYmQurhwQUvU:qmh69eWbVypVCBgGu/aYmn1gU TLSH 8275012077F88439F6F62B31AE3A95609E3ABD241F71C15E8354391D0DB0A909BB6773

244 files
OFFbb85d3b922d633b4cdb796ccef4ce75e
DLLScreenConnect.Client.dll
DLLScreenConnect.ClientService.dll
DLLScreenConnect.Windows.dll
EXEScreenConnect.WindowsClient.exe
BINScreenConnect.WindowsClient.exe.config
BINServiceExeWithoutService
BINCustomAction.config
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 13 STICH kept: 3secondary ignored: 10
bin 9img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path ole:doc>bin>pe:dll>pe:dll
Shape ole:doc>bin>pe:dll>pe:dll
4 nodes
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙