MALICIOUS — 5489313bb88b14a1ee358e81e5c7aac9c9f81c3ae1dbca6b0ac25ea27018a573

MALICIOUS — 5489313bb88b14a1ee358e81e5c7aac9c9f81c3ae1dbca6b0ac25ea27018a573 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 8 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 5489313bb88b14a1ee358e81e5c7aac9c9f81c3ae1dbca6b0ac25ea27018a573
SHA-1: 50e3e75bd629daebc3395ef760da1c9405922247
MD5: 520873db625132a60634205925f1c6bc
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 3072:vKtfDEsjPhczEzEwTYHZpz5GVEtzhdD/bcSx5G5JjMtxe/3rRJ0:StfDEsjPhczWJTyZpz5GyhdDMFWUP0
TLSH: T192426BEC521B3593D3BAD9B05D059E9C8822B4AD2174649D0F03C8BFB2E6C37A8F1159
Submitted as: 5489313bb88b14a1ee358e81e5c7aac9c9f81c3ae1dbca6b0ac25ea27018a573
File type: pe · Size: 213672 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (8 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win32/Viking.JX
Emsisoft (Emergency Kit): Dropped:Generic.Malware.PWB!dld!Pk!.69063F94
Kaspersky (KVRT): Virus.Win32.Delf.62976

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 18 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged Virus:Win32/Viking.JX (rule Virus:Win32/Viking.JX) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Malware.PWB!dld!Pk!.69063F94 (rule Dropped:Generic.Malware.PWB!dld!Pk!.69063F94) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Delf.62976 (rule Virus.Win32.Delf.62976) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.lookde5.com/1.exe - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 98 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

58559 behavior events · 2 ATT&CK techniques · 101 dropped files.

Dropped files

C:\Program Files\LibreOffice\program\mar.exe - 6d54e04f25d1e56356982059a929715ab33be533c02cc21bfdccc698cf58603e
C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe - aa63ddcc56828cea2df45ca15fcc9e429a55f9a71071f1a4c1719922d387fdbb
C:\Program Files\LibreOffice\program\uno.exe - bb75e900b889fb995d1fbbedd68e44fc88625043ec991b6d2157a1e03b92ed62
C:\Program Files\Google\Chrome\Application\151.0.7922.174\elevation_service.exe - 74ab401d6fdaca8b76d23e8de414db977cca4739fc31da6c901a71b9acae5f70
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t32.exe - 8726a5a7cbd31a00c1f508c7069a56dd6f732b96f0dffa2e39d186d5dfec8d5f
C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe - 6f9ce98d375ea87f99de588886c08d766ebf253a35632a8de26cc74833018a5e
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe - ffb05eb61971a36bdce06004ac145410b64e4d38111d97a06967831966550bd2
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - a623bfa49279820559e6b336b69297624d5615614b7b37b85e668d434d7b9f5b
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t64-arm.exe - 914b035be2d8d2061a9e7864351a6ae775b4f7ce5fd0f081543f438bace79a2d
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - c080d695281a862dbcbf2c1af86dd1b27fc2d6e1d2a094ffae518dfcd5b47baa
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jwebserver.exe - d7e06f77f352a50f86ecdbd33592045ae77cb7f969ab9c7db90a742c94e1bec0
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 273ae72f778f5ca0d8108728dcffe9e93fdfb0ec69febd3a08f640b3af113f26
C:\Program Files\7-Zip\Uninstall.exe - f7f52c549c22dcc7e8283aef28862b42ff9b8aa56b078cb178825a1d93bf5876
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 291474a8d910e241c58480b00023c1482a60a4eb73529c85bb34167cade37f32

Embedded URLs

http://www.lookde5.com/1.exe
http://java.com/inst-dl-redirect
https://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.lookde5.com
jnlp.tk
macosx.jnlpx.dock.name
mozilla.org
cacerts.digicert.com
crl4.digicert.com
crl3.digicert.com
www.digicert.com
java.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

192.168.0.30
192.168.8.1
104.46.162.231
4.230.171.124
172.215.188.232
20.247.184.197
85.210.193.152
135.233.95.144
135.232.92.97
20.184.175.8
74.179.77.204
135.233.45.221
57.155.104.224
40.79.167.9
92.223.78.30
72.154.7.101
52.148.114.188
52.110.12.44
52.110.12.25

File paths

c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\deploy\tmp\jp2launcher\obj64\jp2launcher.pdb

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report