MALICIOUS — 43f28f54eb87aa1144cce73d87e28c3eac1d59d43318ea6e1c351fc74ba5c859

MALICIOUS — 43f28f54eb87aa1144cce73d87e28c3eac1d59d43318ea6e1c351fc74ba5c859 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 6 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 43f28f54eb87aa1144cce73d87e28c3eac1d59d43318ea6e1c351fc74ba5c859
SHA-1: 33c76b40e7b3b74d6627c9a914ba03667ab3869b
MD5: f10cfb7c523fb903c15bf7233988fcc5
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 1536:p4q8Q1xZtffrb8sjPFNhTYsFFrz+V9q94fBtaUf:qKtfDwsjPThTYszOV9q9IB
TLSH: T176387B295B7A2F87EB72C6221851B74E4061F5B82475008D6323826FB7FAC337A7011B
Submitted as: 43f28f54eb87aa1144cce73d87e28c3eac1d59d43318ea6e1c351fc74ba5c859
File type: pe · Size: 80552 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 97 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

61340 behavior events · 2 ATT&CK techniques · 100 dropped files.

Dropped files

C:\Program Files\LibreOffice\program\gpgme-w32spawn.exe - 5682f9eff2fc8fd59a1b56c7ebe0aa4a67d1725a5b3fd7f61befa0636f15c367
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - 299b614faf7339fb9a37ee08ead71bd0317125b3416681bf1be5318d40e30e33
C:\Program Files\LibreOffice\program\uno.exe - 26183592a4d2e0ad51537746cb605d8bf75ebd14f506ade0999a4a0e3a3b01c1
C:\Program Files\LibreOffice\program\update_service.exe - d3d6c7351605e8db946d3d458131f7b5310653c8ab098f05bf6a7c564a584e5c
C:\Program Files\LibreOffice\program\sbase.exe - 4ff775c0fb3b6c1503aa959d481309f4977d4a9974db69165ee5d2be67a52cd0
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe - 32e4a3a453d166d58c475ab2147dfff3c3b6afcc7471365e6917e0645e336fb8
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Windows\Logo1_.exe - 5d4df6f557d7e293af24e33efec5f30537dae38f7335f92c53283203273775d4
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\python.exe - b4e68ce8c45ccd8e5021c1bdb198ba8d8828b15b2033c471055c69e3a2b47566
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t32.exe - 49579465b2c416aa4fb6811de276a45310fd46e13c1963b5a3b3fa01eec92fc9
C:\Program Files\LibreOffice\program\odbcconfig.exe - df674d8bf3181bd7fb2f8d7fd1614f544c04d1ff95c665275a80a7cd2dae726a
C:\Users\analyst\AppData\Local\Temp\$$aCE7B.bat - 7a6ff37e9c41b86044809384004e0c94690a234d35e5b04e8b84053e55853342
C:\Program Files\LibreOffice\program\minidump_upload.exe - 3cf7b43d6e645858324a4f79b93269d9ba4674dc5c7a9f390d942f69f4ecf7f9
C:\Program Files\LibreOffice\program\spsupp_helper.exe - 03482a3cb367cd7b9edeac6380ca07bfc8ae2f62bcc7b75d57d0299ad0baf351
C:\Program Files\LibreOffice\program\swriter.exe - 0586c322b2446ea4268adce6ff181066f674a64938262b27e82a302dfc3b858e

Embedded URLs

https://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

cacerts.digicert.com
crl4.digicert.com
crl3.digicert.com
www.digicert.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

192.168.0.30
192.168.8.1
20.247.185.124
104.208.16.94
4.230.171.124
172.64.154.167
172.66.2.5
135.233.45.222
57.154.63.210
57.155.104.224
52.148.114.188
52.110.12.47
72.154.7.99
52.110.12.26

File paths

c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\jdk\objs\rmid_objs\rmid.pdb

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report