MALICIOUS — 1fe8b9165ffbd8955e81ba2585a8229da199a13cc7397fd41d7f86abdc3d4c31

MALICIOUS — 1fe8b9165ffbd8955e81ba2585a8229da199a13cc7397fd41d7f86abdc3d4c31 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 8 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 1fe8b9165ffbd8955e81ba2585a8229da199a13cc7397fd41d7f86abdc3d4c31
SHA-1: b4a0144ac7ec19c55e64cb2c9d56b541f5d7657b
MD5: 4c42f066ff7812648c0b2b783e71834e
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 49152:4gY07Y5AHqKZfAOVgXU1uhV23DO9cm0w9tFTNptyThj:xUQE+uh8DO9r2j
TLSH: T1BF5C6C5B01173422D1FADD00F421C4DD8467FE5494398E89D20FE92A89EDFBBA6D23A1
Submitted as: 1fe8b9165ffbd8955e81ba2585a8229da199a13cc7397fd41d7f86abdc3d4c31
File type: pe · Size: 2459248 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (8 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win32/Viking.JX
Kaspersky (KVRT): Virus.Win32.Delf.62976

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 19 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged Virus:Win32/Viking.JX (rule Virus:Win32/Viking.JX) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Delf.62976 (rule Virus.Win32.Delf.62976) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
Embedded network infrastructure: http://www.lookde5.com/1.exe, https://crashpad.chromium.org/, https://crashpad.chromium.org/bug/new - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 96 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

58682 behavior events · 2 ATT&CK techniques · 99 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - 91c98fddf8fb19401b2765ea2f8f2618f876d00ec20c60644d48d9a0a4d38e0c
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - 11dc9ba71f2b65f87ddf21ac37dd6acf9ad101b807de31327ad57b3fad211c3c
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w64-arm.exe - a9e45a6dd5ed9dfe18b704e8434e2ad1f8242c016cfc976f36b8950ba9b9fcd4
C:\Program Files\LibreOffice\program\senddoc.exe - 33cc073d03d2a2f544d5547e5fbe6683aaffad7ca8b3af4de91d9e61b8d5e51a
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - b78610997abfe46714024c4f69a29f41347efaf346699ac3967bd69f7945c83c
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\python.exe - 0db100c4ab4490f4853b46fec7f9a49e9ab25cfdf14439d2c83e6526bc930cd2
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\7-Zip\Uninstall.exe - 43feb342f13f902f2bf48119df3e2a3332ee8b92f883bc4432ec847349dfbc47
C:\Program Files\Adobe\Acrobat DC\Acrobat\OSSLLibs\AdobeFips.exe - 1ef42405c96fe22f0abdd565cfd28010b7d0abf30e202cfba0fb2bc576c73eaa
C:\Program Files\LibreOffice\program\sweb.exe - dc0692430830174276de330d7e61a5c04fcb026b3da5c5677c80898aff7f408d
C:\Program Files\7-Zip\7zFM.exe - e49a2a00cb6f284f1be6b990ecfa265de6d42e1bb172d349f307b036af9b5df2
C:\Program Files\LibreOffice\program\updater.exe - 528774085722f47fd592d170c02722f53872cd9db29da2dc9d4ec126c27ce16c
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\venvlauncher.exe - 96ddba23eb568f219a2dad125963ebc5f5aa939c52aad82ce741bee29a4ea92d
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe - 875c5aabc7afb966d71a9acdd59e7fbb2ac8de43520faaeef68cbfb447eb694c
C:\Program Files\LibreOffice\program\opencltest.exe - 65ef3e1d7e754360e04adccaae3c6bfd89a25314a8e42c297356e0d3665e2c7b

Embedded URLs

http://www.lookde5.com/1.exe
https://crashpad.chromium.org/
https://crashpad.chromium.org/bug/new
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
https://www.digicert.com/CPS0
http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.lookde5.com
openssl.org
pcscan.cc
crashpad.chromium.org
blink.net
arena.cc
thread.cc
common.cc
sequence.cc
pb.cc
crash.pb.cc
settings.cc
crl3.digicert.com
crl4.digicert.com
www.digicert.com
cacerts.digicert.com

Embedded IP addresses

192.168.0.30
192.168.8.1
20.42.72.131
4.230.171.124
172.215.188.232
52.230.60.54
172.215.188.225
135.232.92.97
135.233.95.144
20.184.175.18
172.64.154.167
20.42.65.94
52.253.84.76
135.233.45.222
72.154.7.112
52.148.114.188
52.110.12.10
52.110.12.14

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report