MALICIOUS — 3edef2f887340c99b8e6723b72d0f098724e15aa326e46f26681a43af512d867

MALICIOUS — 3edef2f887340c99b8e6723b72d0f098724e15aa326e46f26681a43af512d867 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 8 of 55 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 3edef2f887340c99b8e6723b72d0f098724e15aa326e46f26681a43af512d867
SHA-1: 42ddffbab33e4cab5fc3ae9f380e22866ce21c57
MD5: edaed903b2a3d755903b2fc56cbd0b7f
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 6144:StfDEsjPhczKbdUjgOo8IRCSV5ITivRuWJy07i413:SbN5UjNo8IdaOASW4R
TLSH: T1F0495C56C39A361FD7F2C90A0814C4BC8861B9ED20B5B1E65392CA5E60FAC33D45936F
Submitted as: 3edef2f887340c99b8e6723b72d0f098724e15aa326e46f26681a43af512d867
File type: pe · Size: 420656 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (8 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win32/Viking.JX
Emsisoft (Emergency Kit): Dropped:Generic.Malware.PWB!dld!Pk!.69063F94
Kaspersky (KVRT): Virus.Win32.Delf.62976

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.lookde5.com/1.exe - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 73 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

56221 behavior events · 2 ATT&CK techniques · 76 dropped files.

Dropped files

C:\Python310-32\Scripts\pip.exe - 75451a6ef4af9b4f43dd309e28c634fd9de5e4cc2eaeb5000b2dbaa6491ca290
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t32.exe - 8726a5a7cbd31a00c1f508c7069a56dd6f732b96f0dffa2e39d186d5dfec8d5f
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t64-arm.exe - 8d8815a34c3f0b97c43715c2e01f65c8955730c310627800129053c60a0baabf
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\LibreOffice\program\soffice_safe.exe - 23f0c307f9a2bd6703d24542285000202bc5296e72f294224ec2cdd0f3e6e38f
C:\Program Files\LibreOffice\program\smath.exe - 2b5645401a0d7d6d583ac432396455c0ece3fe6785e734ddd7af3e4970520f27
C:\Users\analyst\AppData\Local\Temp\$$a199D.bat - 4eb6226b4216ab29ad283b607d89e1847a8cdbadd4cb45d5cbadd4cd6199e62c
C:\Sysmon64.exe - 0bd45fbe25ea587cb76665132d9be100e91dfb1cc659c201eaf0b910dd404662
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 188ab04f65c26ff7131891f254480fd42d3ab2ba043cef046508ccc43cb22ddc
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\kinit.exe - 836509c0519a076cecd1911f25d0350a4e704100ae1231f4b969fc993e7bbdcd
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe - 8864212247ebabfab692ec6ee3e5bb6c93ab31340718056d63edf2aa42ff4d98
C:\Program Files\LibreOffice\program\senddoc.exe - 8c9ded90dc8a5f5dff511581f3f941a5be248fad7b869760c6fa30a0d2577450
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\gui-64.exe - d432e11ec397bb4ad3429a994c16fd671bac311b28c06491d34b8018af0215c6
C:\Program Files (x86)\Microsoft\Edge\Application\150.0.4078.105\cookie_exporter.exe - 71c3e943f863d77c00f67ba43242912b27306f6db9b4a5e768739942e1e01f3d
C:\Program Files (x86)\Microsoft\Edge\Application\150.0.4078.105\BHO\ie_to_edge_stub.exe - 2de544578f26b210e67f93dbf2fbc5f2515d68f26147d3e46148bc3979ff293d

Embedded URLs

http://www.lookde5.com/1.exe
http://schemas.microsoft.com/windows/2004/02/mit/task
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/windows0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787851900&P2=404&P3=2&P4=Y%2b%2fwOv007BKa4GditORtJFBYQta6%2froBfAMAWEvl%2fLpXgx%2fE7Ziey8g0HvVtyzwadz4%2frgFlfy9apxzl0mYnrA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787851980&P2=404&P3=2&P4=SisxtjMuWixLFd50nb5YCTQiT66OTno%2f19GZV98A9yrRnSPSAd948IOGidlzBJBbfHHK2qBI1u3HlTdyClYWdw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.lookde5.com
schemas.microsoft.com
www.microsoft.com
crl.microsoft.com
settings-win.data.microsoft.com

Embedded IP addresses

192.168.0.30
192.168.8.1
20.42.72.131
57.154.63.210
52.253.84.76
4.230.171.124
74.178.76.128
74.179.77.164
20.42.65.88
20.76.201.171
52.123.129.14
52.123.128.14
172.66.2.5
4.150.223.99
52.123.252.230
172.178.240.163
203.26.79.13
52.148.114.188
52.110.12.19
52.110.12.44
172.178.240.161
20.42.73.24
52.138.229.67
74.178.232.29
40.84.97.4

File paths

C:\Windows\system32\sc.exe

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report