MALICIOUS — 4747225404488963ae617a0c01d2917d8322977ba87695263634f6cf474b38f2

MALICIOUS — 4747225404488963ae617a0c01d2917d8322977ba87695263634f6cf474b38f2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 4747225404488963ae617a0c01d2917d8322977ba87695263634f6cf474b38f2
SHA-1: e8a9347cd57774c5cd3d2a5724baab3d5baa9327
MD5: 2558e6877dd1c153a6d3d54470e57d82
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 3072:vKtfDEsjPhczEacPJ5GSLcwurwLIvfHYTokK:StfDEsjPhczMPJRzurjgT
TLSH: T17C417C65471A6B86DBB2C72318917B0E5073B8BE60BE298C1253C43FB7F5C639460168
Submitted as: 4747225404488963ae617a0c01d2917d8322977ba87695263634f6cf474b38f2
File type: pe · Size: 184320 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.JX
Emsisoft (Emergency Kit): Dropped:Generic.Malware.PWB!dld!Pk!.69063F94
Kaspersky (KVRT): Virus.Win32.Delf.62976

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.JX (rule Virus:Win32/Viking.JX) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Malware.PWB!dld!Pk!.69063F94 (rule Dropped:Generic.Malware.PWB!dld!Pk!.69063F94) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Delf.62976 (rule Virus.Win32.Delf.62976) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 3 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.lookde5.com/1.exe - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 98 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

14001 behavior events · 0 ATT&CK techniques · 101 dropped files.

Dropped files

C:\Program Files\LibreOffice\program\regview.exe - 06001cfa38f05ba059b0b7f15acf6b3ebc744428b38c99295a488a285e6caf1e
C:\Program Files\Google\Chrome\Application\151.0.7922.175\chrome_pwa_launcher.exe - eea1fa1964cda62f757aded623935e6a3b893c3a212f0fd236d9c50ebe1c9f62
C:\Program Files\LibreOffice\program\minidump_upload.exe - 19d974bbd7b73587936a39c2508bb15e4919716fa84bfe7218fb7e6a138bcc66
C:\Program Files\LibreOffice\program\senddoc.exe - c56f34f638dfc383bc5b9bfea0a0644af17ac39f61d0aaeb03aa3ccb3f9e4e25
C:\Program Files\LibreOffice\program\soffice.exe - 199807a8aa1f355bda0e2e16f9f5134b0256c12915d1704f2ae0bba6e684bd58
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\LibreOffice\program\soffice_safe.exe - 10fd365c268c1a7f6137e9bee2a5a3ef9b15003bcea3ba3662f78bda49d17782
C:\Program Files\Adobe\Acrobat DC\Acrobat\OSSLLibs\AdobeFips.exe - 84d4142e0c44b6d5fd12e3ba494ba160e678815bfab3ae41522837d89a3797ec
C:\Program Files\LibreOffice\program\quickstart.exe - 6e3301a5b47787dcacf88f3790cc5344c350068072aaa852f07c77be436c7afa
C:\Program Files\LibreOffice\program\uno.exe - 7136604a871d76746a54d75aec6cfca3f79782bd2546e3a04292d0aae8fceab2
C:\Program Files\LibreOffice\program\python.exe - 94acc57fd926dc6e218fd88ac18d2e00babfa880af7e05c580851c641a8cb221
C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe - 956e56c1ea71af1237cd0b625c8675acef51b795e72aa4053a86ef087ab8f054
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe - 254144376cf155158d653c8fd512e91753d5836488e4e174c7ee5acf604323d6
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe - 55dd2371c8c566cb9ea817434001dcfc0a740a08b6fec8d6e528d22aa9907ccf
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\cli.exe - ed69cfb11a858d7a7de4b3e02e1b8d96abf5424512ef743d35cdaf9bf3ea8942

Embedded URLs

http://www.lookde5.com/1.exe
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.lookde5.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

192.168.0.30
192.168.8.1
4.150.223.112
4.155.95.136
52.123.252.236
40.84.97.4
4.230.171.124
4.155.89.87
74.178.76.54
4.150.223.102
74.178.76.128
172.64.154.167
172.66.2.5
34.104.35.123
4.209.250.170
51.116.253.169
20.42.65.85
203.26.79.13
4.150.223.105
51.132.193.105
52.148.114.188
85.210.193.152
20.184.175.16
51.116.253.168
172.172.255.217

File paths

C:\Users\Vinay\Projects\simple_launcher\Release\CLISimpleLauncher.pdb
c:\python27\python.exe

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report