Suspect
cc153fd00285fdea14bf22c56473e9eb
PE Executable
MD5: cc153fd00285fdea14bf22c56473e9eb
Size: 5.64 MB
application/x-dosexec
This sample is a 5.4 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 101 embedded or derived files. It matches 37 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 0b4ba2281e8aa8ce0047daf499459487db790a72fa2230d4d1291cddf5483807
- MD5
- cc153fd00285fdea14bf22c56473e9eb
- Verdict
- Inconclusive
- File type
- PE Executable · 5.4 MB
Cite this report: https://app.malva.re/sha256/0b4ba2281e8aa8ce0047daf499459487db790a72fa2230d4d1291cddf5483807
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
5.64 MB · 5,635,824 B
First seen
2026-10-21 17:45 · 7 days ago
Last seen
2026-10-21 17:45 · 7 days ago
Last analysis
2026-10-21 17:45 · 7 days ago
Hashes
MD5
cc153fd00285fdea14bf22c56473e9eb
Sha1
cf02016ef5374ebf9e8377a5f8ae6354f6636f89
Sha256
0b4ba2281e8aa8ce0047daf499459487db790a72fa2230d4d1291cddf5483807
Sha384
a48f1055b8c01739429db5a18f2ff00296d2d3e43509dbe40b9a8bbcc6c6484e29f461b9599053cab1eb70faf8c594e2
Sha512
4e9453033dd1d980d38b3ec6fc639d1120d6a22762092115265123cc5c01041575da11a17b07931493d500423d65b9db5ef8a169fc95d1ea6d0f6db3521b47d3
SSDeep
49152:FEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:KEs6efPNwJ4t1h0cG5FGJRPxow8O
TLSH
9446E111B3D995B9D47F063CD87A42699A74BC044712C7EF63D8BD2D2E32BC05A323A6
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12VC8 -> Microsoft Corporation
94 files
EXEcc153fd00285fdea14bf22c56473e9eb
Structure
P7B[Authenticode]_723b0803.p7b
BINResources
BINFILES
BINID:0000
EXEID:0
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
P7B[Authenticode]_77346ead.p7b
BIN.Net Resources
DLLScreenConnect.Properties.libwebp.x64.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLScreenConnect.Properties.libwebp.x86.dll
Structure
DLLScreenConnect.Properties.libz.x64.dll
Structure
DLLScreenConnect.Properties.libz.x86.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1036
DLLScreenConnect.Properties.libzstd.x64.dll
Structure
DLLScreenConnect.Properties.libzstd.x86.dll
Structure
OFFScreenConnect.ScreenConnect.ClientSetup.msi
BINRoot Entry
BIN䡀䆒䑲
BIN䡀䌏䈯
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䓞䕪䇤䠨
BIN䡀䕙䓲䕨䜷
BIN䈍䄩䏸䞷䄦䠥
DLLScreenConnect.Client.dll
DLLScreenConnect.ClientService.dll
DLLScreenConnect.Core.dll
DLLScreenConnect.Windows.dll
EXEScreenConnect.WindowsBackstageShell.exe
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
EXE䌋䄱䜵䀾䛬㪌
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
BIN䡀䈛㵪䆲䗤䕲
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀䓊㼳䄨䆵䠫
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䆒䑲㭾䉨䘤䗯䆒䑲
BIN䡀䈜䙵䆬㬨䑲䌩䠪
BIN䡀䈜䙵䆬㬨䑲䕷䏲
BIN䡀䈜䙵䆬㲨䖱䄷䏯
BIN䡀䄕䑸䋦䒌䇱䗬䒬䠱
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
EXE䌋䄱䜵㬾䖸䒷㪰䗦䒬㵱䅬䄵䜵
Structure
DLLScreenConnect.Windows.dll
BIN.Net Resources
DLLScreenConnect.Properties.libwebp.x64.dll
DLLScreenConnect.Properties.libwebp.x86.dll
DLLMicrosoft.Deployment.Compression.dll
DLLMicrosoft.Deployment.Compression.Cab.dll
BINCustomAction.config
BINOverlay_c9d28a1b.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
BINSummaryInformation
BINRT_MANIFEST
BINID:0001
BINID:1033
DLLScreenConnect.Client.dll
DLLScreenConnect.ClientService.dll
DLLScreenConnect.Core.dll
DLLScreenConnect.Windows.dll
DLLScreenConnect.WindowsAuthenticationPackage.dll
EXEScreenConnect.WindowsBackstageShell.exe
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
DLLScreenConnect.InstallerActions.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
DLLMicrosoft.Deployment.WindowsInstaller.dll
Structure
BIN.Net Resources
BINMicrosoft.Deployment.WindowsInstaller.Errors.resources
BINResources
BINRT_VERSION
BINID:0001
BINID:0
DLLMicrosoft.Deployment.WindowsInstaller.Package.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
DLLMicrosoft.Deployment.Compression.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
DLLMicrosoft.Deployment.Compression.Cab.dll
Structure
BIN.Net Resources
BINMicrosoft.Deployment.Compression.Cab.Errors.resources
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINCustomAction.config
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 15
STICH kept: 2secondary ignored: 13
bin
13Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>pe:exe>ole:doc>pe:dll>pe:dll>pe:dll
Shape
pe:exe>pe:rsrc>pe:exe>ole:doc>pe:dll>pe:dll>pe:dll
7 nodes
Path
pe:exe>pe:rsrc>pe:dll>pe:dll
Shape
pe:exe>pe:rsrc>pe:dll>pe:dll
4 nodes
| Name | Value |
|---|---|
| Info | Authenticode present at 0x546200 size 105712 bytes |
| Info | PDB Path: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb |
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential94 files
EXEcc153fd00285fdea14bf22c56473e9eb
Structure
P7B[Authenticode]_723b0803.p7b
BINResources
DLLScreenConnect.Client.dll
DLLScreenConnect.ClientService.dll
DLLScreenConnect.Core.dll
DLLScreenConnect.Windows.dll
DLLScreenConnect.WindowsAuthenticationPackage.dll
EXEScreenConnect.WindowsBackstageShell.exe
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
DLLScreenConnect.InstallerActions.dll
DLLMicrosoft.Deployment.WindowsInstaller.dll
DLLMicrosoft.Deployment.WindowsInstaller.Package.dll
DLLMicrosoft.Deployment.Compression.dll
DLLMicrosoft.Deployment.Compression.Cab.dll
BINCustomAction.config
No malware configuration was found at this point.
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
cc153fd00285fdea14bf22c56473e9eb › Resources › FILES › ID:0000 › ID:0 › .Net Resources › ScreenConnect.ScreenConnect.ClientSetup.msi › Root Entry › 䌋䄱䜵㬾䖸䒷㪰䗦䒬㵱䅬䄵䜵 › ScreenConnect.Windows.dll
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account