Suspicious
Suspect

cecfbe8715a786a8bdd4f9a284ecbce6

Share on LinkedIn
Print
MS Office Document
MD5: cecfbe8715a786a8bdd4f9a284ecbce6
Size: 16.94 MB
application/vnd.ms-office

This sample is a 16.2 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 314 embedded or derived files. It matches 35 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
4fd59bfeee5019cf00a59a900449ec52794aaa4a32aa6f90a39a2c1d533ba4f2
MD5
cecfbe8715a786a8bdd4f9a284ecbce6
Verdict
Inconclusive
File type
MS Office Document · 16.2 MB

Cite this report: https://app.malva.re/sha256/4fd59bfeee5019cf00a59a900449ec52794aaa4a32aa6f90a39a2c1d533ba4f2

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
16.94 MB · 16,936,960 B
First seen
2026-11-01 11:46 · yesterday
Last seen
2026-11-01 11:46 · yesterday
Last analysis
2026-11-01 11:46 · yesterday
Hashes
MD5 cecfbe8715a786a8bdd4f9a284ecbce6 Sha1 ec5163d232d796bf7c4d4b75630d3c79a78d7af1 Sha256 4fd59bfeee5019cf00a59a900449ec52794aaa4a32aa6f90a39a2c1d533ba4f2 Sha384 9dde94f05f8373297780c89358310f60131aa45b623ec54aa610c50573260ed912909cd837bff49ea5b66e0209cc193a Sha512 9f6645d4820270096efd6161c29681c7845d2a295cd702709bb4996400ca03fdf71e1c367e354eba45171751b85b62139cf98de3777445aead528e74ca4c6869 SSDeep 393216:C6ohU+8bjJ8GQq9ySZ8Ey6ohU+8bjJ8P6ohU+8bjJ8A6ohU+8bjJ8:toh0bjX9ySZz9oh0bjroh0bjkoh0bj TLSH EC0733211BF8C855EAB30B75FA7B86B44637BC51A912D05F03A03E1D1972E819EA3377

313 files
OFFcecfbe8715a786a8bdd4f9a284ecbce6
DLLScreenConnect.WindowsInstaller.dll
DLLMicrosoft.Deployment.Compression.dll
DLLMicrosoft.Deployment.Compression.Cab.dll
BINCustomAction.config
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.arm64.dll
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
BINClient.en-US.resources
BINClient.resources
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 11 STICH kept: 2secondary ignored: 9
bin 8img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes
Path ole:doc>pe:dll
Shape ole:doc>pe:dll
2 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙