MALICIOUS — 48724945d19df93be99ee36fa558472f08bd346fb1afd5ce8ace0ab8407f9c04

MALICIOUS — 48724945d19df93be99ee36fa558472f08bd346fb1afd5ce8ace0ab8407f9c04 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 6 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 48724945d19df93be99ee36fa558472f08bd346fb1afd5ce8ace0ab8407f9c04
SHA-1: 4033f7ffa8c21d2e69237825ef94c93d8a60a183
MD5: efcfe9a11198d6459fd066a6c0e3f48f
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 3072:qKtfDwsjPThTYszDH2fBhjk83e3z1aajSNxm26rX6hZTY0Tt1pDAqsb9QSsNPTb:BtfDwsjPThT5zL2573yrX+ZTY0TtbIe
TLSH: T1FC406BA91C0EFAC1FB3482047C646E0DD439E5D97024589CF2D6A20E77EAD33A8D8576
Submitted as: 48724945d19df93be99ee36fa558472f08bd346fb1afd5ce8ace0ab8407f9c04
File type: pe · Size: 171520 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Dropped a malicious payload (GameThief): virDll.dll - dynamic signal, weight 0.62, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

57436 behavior events · 2 ATT&CK techniques · 101 dropped files.

Dropped files

C:\Program Files\Google\Chrome\Application\151.0.7922.174\Installer\setup.exe - 27ee274b4e58112d063d042410051e6ccf383a09f57da1f49fc6adfd842a5701
C:\Program Files\7-Zip\7zFM.exe - 9b358067ab12a71d8778bda213128b34263df6b9b047414ea4ca1940dcf7ecbc
C:\Program Files\Google\Chrome\Application\151.0.7922.174\notification_helper.exe - c4b6d533b394978a718d57e208fdd24ec75976e2f0dd2f991b7e52b9d8ed53d4
C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe - aa7468bde0928cd6e9e9eb26331d9b7a6c8586fd4349f120c9808ec191a597b1
C:\Users\analyst\AppData\Local\Temp\$$aDA91.bat - ff4a73a9659f8519360d64cf09b7a3e890493738f835045e9fa0a14e3be2f2e5
C:\Program Files\Adobe\Acrobat DC\Acrobat\CPInstCU.exe - e6aa6d7edf4786cf62a3862c65a655c675d0e6eca45d45f1a90f07840f1f84b2
C:\Program Files\LibreOffice\program\unoinfo.exe - 713186d5235d593c7ff30cefc3469373f37f1372aa435084da133e3834f711be
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe - 77ec2f8446ca7d966c6050412305994393954441c1a2f53db5431e0333857324
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe - 9849d42051e1f8182765c6f74aba2297bd65f85804fb6888d9c17eae61c0f2ae
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Windows\Logo1_.exe - 68c43fa04d7118b8c77592464d59dfc37bf29e12c2e0c2fb3a0c59c40e6f71d0
C:\Program Files\7-Zip\Uninstall.exe - 1d0bccd575eb128bd2018ef492e14166e88e9ee25ac1b1cbae58d06fa6c3fd49
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - cb729c721da4b481ca38ea07f6e2b5df7e5ae0f5e2a79a144a5e829026141428
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - ec42bccfec7cd11e6c298efe3c6f57ff15d7d28763225d418fc4062f4cb7c97b
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - b5d7583d3045f662e687005f2257ef0eb2c4e2ca2a341c6fff40e870eeba2f1d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

wntmsci12.pro
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

192.168.0.30
192.168.8.1
4.150.223.97
52.123.252.234
4.230.171.124
40.84.85.40
172.64.154.167
20.165.94.54
20.165.94.63
52.182.143.212
20.184.175.9
4.144.132.223
162.159.142.9
135.233.45.223
172.215.188.232
4.150.223.102
4.150.223.113
52.110.12.51
52.148.114.188
72.145.35.99
52.110.12.33

File paths

C:\Source\openoffice\main\cpputools\wntmsci12.pro\bin\uno.pdb
L:\:`:d:h:l:p:t:x:
T:\:d:l:t:

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report