MALICIOUS — 7de8f68891d0aba0cc155c4e1643ba05f40efa004c2006b72aa2444e4d3c7088

MALICIOUS — 7de8f68891d0aba0cc155c4e1643ba05f40efa004c2006b72aa2444e4d3c7088 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 8 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 7de8f68891d0aba0cc155c4e1643ba05f40efa004c2006b72aa2444e4d3c7088
SHA-1: 2242aabf3ef163877d096861a8ce84fa55cd75f5
MD5: dcba122ce5d542dfeab5500f2f263baa
imphash: 8b1fc5c989964e6fc1675250748f63dc
ssdeep: 98304:dzMcOe8hK+JLwJzMcOe8hK+JLw7xiiC6:r/+en/+eNix
TLSH: T1FE656BCE871E6713C2A2C62D6949558E14667CE4607F3F4C0CF6D17A48E2063AE6E07B
Submitted as: 7de8f68891d0aba0cc155c4e1643ba05f40efa004c2006b72aa2444e4d3c7088
File type: pe · Size: 5694163 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (8 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Delf-6750459-0
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Kaspersky (KVRT): HEUR:Trojan.Win32.Agentb.gen

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

ClamAV (daily) flagged Win.Malware.Delf-6750459-0 (rule Win.Malware.Delf-6750459-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Agentb.gen (rule HEUR:Trojan.Win32.Agentb.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
Embedded network infrastructure: http://fpdownload.macromedia.com/get/flashplayer/update/current/install/install_all_win_, http://fpdownload2.macromedia.com/pub/flashplayer/update/current/sau/11/install/, http://fpdownload2.macromedia.com/pub/flashplayer/update/current/aih/aih_sgn.z - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://go.microsoft.com/fwlink/?LinkId=131738
http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
https://www.verisign.com/rpa
https://www.verisign.com/cps0
http://csc3-2010-crl.verisign.com/CSC3-2010.crl0q
http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
https://www.verisign.com/cps0*
https://www.verisign.com/rpa0
http://logo.verisign.com/vslogo.gif04
http://crl.verisign.com/pca3-g5.crl04
http://fpdownload.macromedia.com/get/flashplayer/update/current/install/install_all_win_
http://fpdownload2.macromedia.com/pub/flashplayer/update/current/sau/11/install/
http://fpdownload2.macromedia.com/pub/flashplayer/update/current/aih/aih_sgn.z
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

go.microsoft.com
crl.microsoft.com
www.microsoft.com
www.memtest86.com
bzip.org
crl.thawte.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
www.verisign.com
csc3-2010-crl.verisign.com
csc3-2010-aia.verisign.com
logo.verisign.com
crl.verisign.com
fpdownload.macromedia.com
fpdownload2.macromedia.com

Embedded IP addresses

20.184.175.1
4.144.132.223
172.215.188.232
4.230.171.124
135.232.92.97
4.150.223.114
74.179.77.204
172.64.154.167
52.110.12.45
52.110.12.16
52.110.12.42
52.110.12.19
172.66.2.5

File paths

f:\dd\Tools\devdiv\finalpublickey.snk
p:\8Y
j:\\
C:\cuckoo_%d.ini

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report