MALICIOUS — 56c8edceb80f482e2fb52b56d5e3e1699449511a663b10abcfc00fd7082807d8

MALICIOUS — 56c8edceb80f482e2fb52b56d5e3e1699449511a663b10abcfc00fd7082807d8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 6 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 56c8edceb80f482e2fb52b56d5e3e1699449511a663b10abcfc00fd7082807d8
SHA-1: c87c19452e82f3aaee18a8900e9900867bedd1ed
MD5: dd962b622a7192af2c9b765e8ed71980
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 3072:vKtfDEsjPhczENpsgozqC4O/jHxo6l0PTBuJBQbRQ5WF:StfDEsjPhcz+ps5N/jHxn0l7xF
TLSH: T19F408C6847276693F1B2CB159C60AB9D4032F57C647A5889634BC86FF3F8C7389B4218
Submitted as: 56c8edceb80f482e2fb52b56d5e3e1699449511a663b10abcfc00fd7082807d8
File type: pe · Size: 167936 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.JX
Emsisoft (Emergency Kit): Dropped:Generic.Malware.PWB!dld!Pk!.69063F94
Kaspersky (KVRT): Virus.Win32.Delf.62976

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.JX (rule Virus:Win32/Viking.JX) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Malware.PWB!dld!Pk!.69063F94 (rule Dropped:Generic.Malware.PWB!dld!Pk!.69063F94) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Delf.62976 (rule Virus.Win32.Delf.62976) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.lookde5.com/1.exe - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 97 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

58876 behavior events · 1 ATT&CK techniques · 100 dropped files.

Dropped files

C:\Program Files\LibreOffice\program\senddoc.exe - fa3ec2904eba5cc41381d2c5c7f9c0455c19a07e06458aa4f098ab27fa99f0d0
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\gui-64.exe - 77171b700e9112dc863e404aeb6d6678ff727e5c31ab2d327654266a62525fbd
C:\Program Files\LibreOffice\program\python.exe - 87b332bc097637d383657a32a11b1b8b4148d0fcfd3ad2f3209309c67c0c9c37
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\python.exe - 2e7bf6028222b725105e6cfa3527c03055fe32f38a8611f8396c39ebc487e806
C:\Program Files\LibreOffice\program\unopkg.exe - 73344d301380b1ac1483434f1a2302001e1c0e0220c0847e46dcad7a2a268c8f
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\rmiregistry.exe - b845d0fe693f9a8c45277274069539b9d94283c6a2ff0d52a6ee37a5638ec5fb
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - 7c51b169be5805b153fe407ffda04aceae6faa2d09611c18220f95b11ff17fb7
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - 35db547b44ac6d1571b535c552ed73c5ca94fb4ec5cf9dd32b0330449ac2dafd
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - dff9d0658ccebf212b004222ffb8052942bc1e23d1c53f170b8c3cb99c69e336
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - e6d0c5c05f1eba227a2c87d03799686d98155439c4bf1dfda4a2855fda0c0049
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w64.exe - f7ed5264a75aa42885553a832d507c42af4846122b5526116511007feb5e890b
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - b2b23398571a3ac9370f2e22355f39ac945f36e0be64f1d4d2cc5212e188ae88
C:\Program Files\LibreOffice\program\spsupp_helper.exe - 90f4b345853f4403a6ff700a5d1b13f49b66d0a2679496d9c66f51d1f65b06c8
C:\Program Files\LibreOffice\program\updater.exe - 7d5131c60bba6126658b6661ed89495b820d60fd057744b4fcc03bfe5a0c13be

Embedded URLs

http://www.lookde5.com/1.exe
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.lookde5.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

192.168.0.30
192.168.8.1
13.69.116.109
4.230.171.124
20.42.179.192
20.165.94.63
74.178.240.51
51.105.71.137
52.230.60.54
40.79.163.154
52.110.12.3
52.110.12.42
20.184.175.23
20.42.73.27
92.223.78.30
52.148.114.188
172.215.188.232
72.145.35.101
52.110.12.49
52.110.12.33

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report