MALICIOUS — 034e5e559f7f6d9678633229dfba6c75f68ac82f49e5998ba855a58d1f4182b6
MALICIOUS — 034e5e559f7f6d9678633229dfba6c75f68ac82f49e5998ba855a58d1f4182b6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Delf family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
034e5e559f7f6d9678633229dfba6c75f68ac82f49e5998ba855a58d1f4182b6 - SHA-1:
8c819648f2930f266e3fe51b55b61efb206627bc - MD5:
f283a8940475515188ffc9219f896b72 - imphash:
31d1c48ee7d8e07a5706e963146db875 - ssdeep:
1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzmVXC3adCA:qKtfDwsjPThTYsz+CK7 - TLSH:
T1E2378E395B1B6B97EF76C7620840B74E4062F579207A64882363D16FB7FAC13AA7014C - Submitted as: 034e5e559f7f6d9678633229dfba6c75f68ac82f49e5998ba855a58d1f4182b6
- File type: pe · Size: 74632 bytes
- Verdict: malicious (96/100) · Family: Delf
Detections (6 of 55 engines)
- YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
- ClamAV (daily): Win.Trojan.Delf-1564
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Virus:Win32/Viking.MS
- Emsisoft (Emergency Kit): Trojan.Agent.FPMF
- Kaspersky (KVRT): Virus.Win32.Lamer.xe
MITRE ATT&CK
YARA
- Windows_Injection_Api_Combo
Why this verdict
The malicious score of 96/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule
Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95 - Process injection API combination (rule
Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- http://crl.verisign.com/tss-ca.crl0
- https://www.verisign.com/rpa
- https://www.verisign.com/cps0*
- https://www.verisign.com/rpa0
- http://logo.verisign.com/vslogo.gif0
- http://crl.verisign.com/pca3.crl0
Embedded domains
- schemas.microsoft.com
- crl.verisign.com
- www.verisign.com
- logo.verisign.com
- csc3-2009-2-crl.verisign.com
- csc3-2009-2-aia.verisign.com
Embedded IP addresses
- 192.168.0.30
- 192.168.8.1
File paths
- C:\jdk7_32P\jdk7\build\windows-i586\tmp\sun\launcher\jinfo\obj\jinfo.pdb
More Delf samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report