MALICIOUS — 3ad15fbcf174bc07567fb896fc3823c33c4d62a076da0b26da48119e40798f92

MALICIOUS — 3ad15fbcf174bc07567fb896fc3823c33c4d62a076da0b26da48119e40798f92 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 6 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 3ad15fbcf174bc07567fb896fc3823c33c4d62a076da0b26da48119e40798f92
SHA-1: b4372c6f19e1c3953fff69dae2868ab9a0fe8d2e
MD5: 7fee4d3b658a73943870478445bb9d6b
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitq1hGQadCL:qKtfDwsjPThTYszDH2fmGhA
TLSH: T126379E2A5B2B2B83EFB6D7220850B74D4462F979207A14885363D06F77FAC63997414C
Submitted as: 3ad15fbcf174bc07567fb896fc3823c33c4d62a076da0b26da48119e40798f92
File type: pe · Size: 74640 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 98 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

61939 behavior events · 2 ATT&CK techniques · 101 dropped files.

Dropped files

C:\Program Files\Google\Chrome\Application\151.0.7922.174\elevation_service.exe - 938787756bd711554c8ff4de3c2b697e3cdb2a86782908e2d6fbca625ef97671
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe - 651f56182246d1573e8f1827e5d5a9f3dc3a5adb4c77b57543ad3c20af13feb8
C:\Program Files\LibreOffice\program\minidump_upload.exe - bd2426ec776a8f08057ad01df3b0084ab450a4616fe9acce3db2640eed753d9c
C:\Program Files\7-Zip\7zG.exe - ef199d47025bbc92f3af13b675680cbf1be63e32a1a3cc1ffe69d07e44862fde
C:\Program Files\LibreOffice\program\senddoc.exe - 1992e99be4ea18254ca3587dc1d06ef3dc074eb0dd9a439b215a7535fafbd21d
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\klist.exe - 9986e706ccebb3b8ae33421912cc7bb8c6b80e9a38cbbf5c87222c1d310e3003
C:\Windows\Logo1_.exe - 0be2e4669913559dcec6624e3d499602c4729ec9b293c19ed4efbf7babbd0814
C:\Program Files\LibreOffice\program\update_service.exe - fc58975078f7b8577863b0febabb16d0e9f50b16bb0750a8837ae4bed6ce411b
C:\Sysmon64.exe - e8634d80681c1adce159da76df09a93d2a00c5d0f4781568d3da72035b1280c1
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t64-arm.exe - ce694a8715843b326463f7107bd79edb8c8a7ec77cc8d7feb8c46fde20eb548c
C:\Program Files\7-Zip\7zFM.exe - cea4a39d7de963900003e972b5696b2a61f6453cf3b750108c45a6bf3cc88f4e
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\gui-64.exe - 07aafb9d7bde67eb9f111bb11991e41186f66e36fb7b5fa3f1cbf2b1d498e1a4
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - 768a8994b056297d720671eacba8484af07c6c90df3c432cc0a4e34ea2ae8690
C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe - c9ac00fda790c7fa2769d2cfbd4f615870d865dfb0a9764672fd4ca1c72fe701
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\python.exe - 3e4965ca47749cf30ac28ce5a4f0d8097c4dd82a64a302d49ec809e8da1ff0e2

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://crl.verisign.com/tss-ca.crl0
https://www.verisign.com/rpa
https://www.verisign.com/cps0*
https://www.verisign.com/rpa0
http://logo.verisign.com/vslogo.gif0
http://crl.verisign.com/pca3.crl0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

schemas.microsoft.com
crl.verisign.com
www.verisign.com
logo.verisign.com
csc3-2009-2-crl.verisign.com
csc3-2009-2-aia.verisign.com

Embedded IP addresses

192.168.0.30
192.168.8.1
52.168.117.168
20.247.184.197
52.123.252.245
4.230.171.124
172.64.154.167
57.154.63.210
172.178.240.161
135.233.45.221
40.84.97.4
20.184.175.23
20.42.72.131
52.148.114.188
72.145.35.103
52.110.12.31

File paths

C:\jdk7_32P\jdk7\build\windows-i586\tmp\sun\launcher\servertool\obj\servertool.pdb

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report