Suspicious
Suspect

bbca9321b2dc05c0054be7cb60255874

Share on LinkedIn
Print
MS Office Document
MD5: bbca9321b2dc05c0054be7cb60255874
Size: 10.92 MB
application/vnd.ms-office

This sample is a 10.4 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 308 embedded or derived files. It matches 33 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
04fb2dd8642878ada1b52131a297187664a36d18d1efdf41597f3d189fc6a508
MD5
bbca9321b2dc05c0054be7cb60255874
Verdict
Inconclusive
File type
MS Office Document · 10.4 MB

Cite this report: https://app.malva.re/sha256/04fb2dd8642878ada1b52131a297187664a36d18d1efdf41597f3d189fc6a508

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
10.92 MB · 10,915,840 B
First seen
2026-10-24 07:30 · 4 days ago
Last seen
2026-10-24 07:30 · 4 days ago
Last analysis
2026-10-24 07:31 · 4 days ago
Hashes
MD5 bbca9321b2dc05c0054be7cb60255874 Sha1 1333b57986cd5cbd9df9a0dd91b2740550389580 Sha256 04fb2dd8642878ada1b52131a297187664a36d18d1efdf41597f3d189fc6a508 Sha384 f8ef9cb711cb108dfd1180d097473f5b017f2bf54499f390bca4e8e2448f1d1077ef6f7f2ec43b179dc7f2731bde2cad Sha512 ae3fe6bc689245e42fdd320ee3d6305921f10c2b768ac8ee40c99c441e56939c3e547a294898a45afde0bf095a462ac66fef90de9544e16368795f0e3c5ec152 SSDeep 196608:iXtv0AfJZCXtv0A4Xtv0APXtv0A3Xtv0A:8t9Zct6tjtzt TLSH A8B6232063EDD469F6F71A74FD3C81B8687A7C608966D05F13183A4D2A72DC19AB2373

309 files
OFFbbca9321b2dc05c0054be7cb60255874
DLLScreenConnect.ClientService.dll
DLLScreenConnect.Core.dll
DLLScreenConnect.Windows.dll
EXEScreenConnect.WindowsBackstageShell.exe
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.arm64.dll
DLLScreenConnect.WindowsCredentialProvider.dll
BINCustomAction.config
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 14 STICH kept: 2secondary ignored: 12
bin 11img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>pe:dll>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll>pe:dll
4 nodes
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙