Suspicious
Suspect

bdde68033423a9cff6470c1e3b1d6794

Share on LinkedIn
Print
MS Office Document
MD5: bdde68033423a9cff6470c1e3b1d6794
Size: 13.52 MB
application/vnd.ms-office

This sample is a 12.9 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 290 embedded or derived files. It matches 26 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
46b5e5360b677c411999085a3efadc20637254ffcdb190477dce690116dee907
MD5
bdde68033423a9cff6470c1e3b1d6794
Verdict
Inconclusive
File type
MS Office Document · 12.9 MB

Cite this report: https://app.malva.re/sha256/46b5e5360b677c411999085a3efadc20637254ffcdb190477dce690116dee907

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
13.52 MB · 13,516,800 B
First seen
2026-10-28 04:30 · yesterday
Last seen
2026-10-28 04:30 · yesterday
Last analysis
2026-10-28 04:31 · yesterday
Hashes
MD5 bdde68033423a9cff6470c1e3b1d6794 Sha1 0b74f08484ba8cba28aacdda2f88dd727ae9f6a2 Sha256 46b5e5360b677c411999085a3efadc20637254ffcdb190477dce690116dee907 Sha384 255bec9893c3ab8310e321a2748ca27bf646d2126c42b620818fdd348812b80e0e1bcd308646f6c54efda97fbeca5f83 Sha512 3626977473521327ca88b214ece389f6a1a31647fe887e14ccf33cfd1caffce651800b08b1037607e070f75933d1331b638f20f870218c6e6b1e5c3565744486 SSDeep 196608:MHxcp9ym3nltDUJVeHxcp9ym37Hxcp9ym3/Hxcp9ym3mHxcp9ym3uHxcp9ym38Hn:qGplp9GpFGpJGp0Gp8GpaGpA TLSH EAD623116BF8D368E0B22AF5E8776C61A5377F115D22D12E2224791F2C71A8089E377F

281 files
OFFbdde68033423a9cff6470c1e3b1d6794
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
BINCustomAction.config
BINapp.config
BINClient.en-US.resources
BINClient.Override.en-US.resources
BINClient.Override.resources
BINClient.resources
BINsystem.config
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 9 STICH kept: 2secondary ignored: 7
bin 6img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes
Path ole:doc>pe:dll
Shape ole:doc>pe:dll
2 nodes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙