MALICIOUS — 18de02028f39fc590585327b025cd9016be08e5fa92307420cf930a92fdd5adf

MALICIOUS — 18de02028f39fc590585327b025cd9016be08e5fa92307420cf930a92fdd5adf is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 18de02028f39fc590585327b025cd9016be08e5fa92307420cf930a92fdd5adf
SHA-1: 4405bd84e3d8d2cb77588fa9de523195cca56203
MD5: d072d74cf0dcef0df984e60c3234dd4f
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 3072:qKtfDwsjPThTYszDH2fGI1gQ/N4nK1CWeeudkIjVhHhTMjtbsoUvJm:BtfDwsjPThT5zL2+hc1zudfVh9M9soU
TLSH: T1943FC0E90B2A2A87D675D7111C807E9D80A2B5F510BE684CA313D43FA7EAC37967421C
Submitted as: 18de02028f39fc590585327b025cd9016be08e5fa92307420cf930a92fdd5adf
File type: pe · Size: 153600 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Dropped a malicious payload (GameThief): virDll.dll - dynamic signal, weight 0.62, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

59028 behavior events · 1 ATT&CK techniques · 100 dropped files.

Dropped files

C:\Program Files\7-Zip\7zFM.exe - a7e26a08f951110c830fa0e8464a99aadc64507116bcc5c3958b9527493f399f
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\pythonw.exe - e13da103cd9ff3bf58afe9b23c088e2665dadf3fb92bd0dedc8b7f443678a22b
C:\Users\analyst\AppData\Local\Temp\$$aE9B4.bat - 4ea9089964f75444e440b47c4a0b3f659bc53d63db5cf3cb47d53555fc5a2167
C:\Program Files\LibreOffice\program\quickstart.exe - 138677f015da0e32fdf351aa5e953a4f55e58a67c227c854e62cf5ad5420edf9
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\rmiregistry.exe - 808f72d02b95894dd0ea8c24ee8a10af92b89733e105131f73e2cecc36eadc02
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\7-Zip\Uninstall.exe - 1a9395523d7784ab5e0b7c283c7dc4d6598f0e70c5b1b7e93b0a685238460dbf
C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe - ed590aee546ee5c2ecb0079d373672a584e111fd65ecce10fc9873dd45205097
C:\Program Files\LibreOffice\program\soffice_safe.exe - 43ef55bd81c3059b862225f20dce17f9970d6fa42461bf17be861412c2c11783
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 5bfed07f87f43ca499114fb83092893fcc19719a16ad22169deb3064606b97e9
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - cb729c721da4b481ca38ea07f6e2b5df7e5ae0f5e2a79a144a5e829026141428
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t64-arm.exe - 2c8d211ccd8b7fdeaab89f86308f059fe639750aae5086285ebce74245b3419f
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\python.exe - 62c99d57e389d96eb72b1c02b6767ce9a446096efb43fde6a5007cfa2b57a1e3
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - fcf8ccbf3a9886aa83bc5948b025c849f5584507b814f5a5fb6b0970436e4fe6
C:\Windows\virDll.dll - c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

192.168.0.30
192.168.8.1
4.150.223.108
4.230.171.124
85.210.193.152
74.179.77.204
20.247.184.197
4.150.223.97
172.64.154.167
74.178.76.54
20.247.185.124
40.79.163.154
4.150.223.107
4.207.44.66
72.154.7.101
52.148.114.188
52.110.12.22
52.110.12.8

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report