MALICIOUS — 2f40027c47a16e319ef4c7912178a6ce22f650ce8c54218fa6f393595a35d164

MALICIOUS — 2f40027c47a16e319ef4c7912178a6ce22f650ce8c54218fa6f393595a35d164 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Delf family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 2f40027c47a16e319ef4c7912178a6ce22f650ce8c54218fa6f393595a35d164
• SHA-1: b11f4fe2b996337b2f85200badb0c97d909aac28
• MD5: d7d4f5ec1435008bf0bf7e5298a1bc8a
• imphash: 31d1c48ee7d8e07a5706e963146db875
• ssdeep: 3072:qKtfDwsjPThTYszDH2fesLBO6ZSETrhgbXX9llGZ0:BtfDwsjPThT5zL22A8X9SG
• TLSH: T1AB3E38CD515E1B41D637DA263801E2CF48A0B4E8DD7D76CD0B4A88BF6252D23EC7612A
• Submitted as: 2f40027c47a16e319ef4c7912178a6ce22f650ce8c54218fa6f393595a35d164
• File type: pe · Size: 140560 bytes
• Verdict: malicious (96/100) · Family: Delf

Detections (6 of 55 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• ClamAV (daily): Win.Trojan.Delf-1564
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Virus:Win32/Viking.MS
• Emsisoft (Emergency Kit): Trojan.Agent.FPMF
• Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

• T1057
• T1055

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
• http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T

Embedded domains

• crl.microsoft.com
• www.microsoft.com

Embedded IP addresses

• 192.168.0.30
• 192.168.8.1

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report