Suspicious
Suspect

fe96a530e787dba1d7f54f56e29b4a13

Share on LinkedIn
Print
MS Office Document
MD5: fe96a530e787dba1d7f54f56e29b4a13
Size: 16.94 MB
application/vnd.ms-office

This sample is a 16.2 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 314 embedded or derived files. It matches 24 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
63c1057ce0510ec13d51209b71579079dabc120ea92e8125965005edbd7fc99c
MD5
fe96a530e787dba1d7f54f56e29b4a13
Verdict
Inconclusive
File type
MS Office Document · 16.2 MB

Cite this report: https://app.malva.re/sha256/63c1057ce0510ec13d51209b71579079dabc120ea92e8125965005edbd7fc99c

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
16.94 MB · 16,936,960 B
First seen
2026-10-25 01:30 · 2 days ago
Last seen
2026-10-25 01:30 · 2 days ago
Last analysis
2026-10-25 01:30 · 2 days ago
Hashes
MD5 fe96a530e787dba1d7f54f56e29b4a13 Sha1 4174b5c5cc6e5e1f6fdcdf12ff596c182ee55c4b Sha256 63c1057ce0510ec13d51209b71579079dabc120ea92e8125965005edbd7fc99c Sha384 68bbc48f33716364a5636636a9c96e7e73d8cf300bdd84c875288b7ef20b206153aa7338f8c410becfeee9b4a099ca08 Sha512 f9461ae336646120b3515a0cd5f7782c1042620aed8848448e7540647e84208f1578786444d2bb14ed2b18a6e0fcb524705dfbbb787e361558756b8515de8b9f SSDeep 393216:+6ohU+8bjJ8YQq9ySZ8Et6ohU+8bjJ8P6ohU+8bjJ8E6ohU+8bjJ8:5oh0bj19ySZzEoh0bjroh0bjYoh0bj TLSH 5D0733211BF8C855EAB30B75FA7B86B44637BC51A912D05F13A03E1D1932E819EA3377

312 files
OFFfe96a530e787dba1d7f54f56e29b4a13
DLLScreenConnect.WindowsInstaller.dll
DLLMicrosoft.Deployment.Compression.dll
DLLMicrosoft.Deployment.Compression.Cab.dll
BINCustomAction.config
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.arm64.dll
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
BINClient.en-US.resources
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 10 STICH kept: 2secondary ignored: 8
bin 7img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>pe:dll>pe:dll
Shape ole:doc>pe:dll>pe:dll
3 nodes
Path ole:doc>pe:dll
Shape ole:doc>pe:dll
2 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙