Suspicious
Suspect

dc8a934f4f41871768641ab0a519ba48

Share on LinkedIn
Print
MS Office Document
MD5: dc8a934f4f41871768641ab0a519ba48
Size: 1.57 MB
application/vnd.ms-office

This sample is a 1.5 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 244 embedded or derived files. It matches 14 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
d0ee8d45f788c00f47d3c448d323cadcb4c5747b763f0cb0c8f85a4036818775
MD5
dc8a934f4f41871768641ab0a519ba48
Verdict
Inconclusive
File type
MS Office Document · 1.5 MB

Cite this report: https://app.malva.re/sha256/d0ee8d45f788c00f47d3c448d323cadcb4c5747b763f0cb0c8f85a4036818775

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
1.57 MB · 1,568,768 B
First seen
2026-10-12 18:30 · 13 days ago
Last seen
2026-10-12 18:30 · 13 days ago
Last analysis
2026-10-12 18:30 · 13 days ago
Hashes
MD5 dc8a934f4f41871768641ab0a519ba48 Sha1 3f505134af294d467f8e12e3e589ef32f609364d Sha256 d0ee8d45f788c00f47d3c448d323cadcb4c5747b763f0cb0c8f85a4036818775 Sha384 9e8c4c35db27880027437e78f4dbae07b6ecb37318e70da8911a763561aba067cbabd3867bb6eb40ac94661fb2af129e Sha512 73ca71f79ccf7d8a8a20b8328c28debe87cb7bd3611348dca5f13cc61f7740d360fa119fc0e925d17cbc0efa7ebbae8e202b50cedbae3e99f7657db19e4c629b SSDeep 24576:pZPlmF0uwTKh56Z5vePu/DVeL1pVjeOLnUUGGu/aYmQurhwQUvr:dmh69eWbVypVCYgGu/aYmn1gr TLSH BF75012077F88439F6F62B31AE3A95609E3ABD241F71C15E8354391D0DB0A909BB6773

244 files
OFFdc8a934f4f41871768641ab0a519ba48
DLLScreenConnect.Client.dll
DLLScreenConnect.ClientService.dll
DLLScreenConnect.Windows.dll
EXEScreenConnect.WindowsClient.exe
BINScreenConnect.WindowsClient.exe.config
BINServiceExeWithoutService
BINCustomAction.config
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 13 STICH kept: 3secondary ignored: 10
bin 9img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path ole:doc>bin>pe:dll>pe:dll
Shape ole:doc>bin>pe:dll>pe:dll
4 nodes
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙