MALICIOUS — a76c1abd038973ddec464bc5c94af0bd6b7a9568c09193216eaad2c21e8d9c5a

MALICIOUS — a76c1abd038973ddec464bc5c94af0bd6b7a9568c09193216eaad2c21e8d9c5a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 6 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: a76c1abd038973ddec464bc5c94af0bd6b7a9568c09193216eaad2c21e8d9c5a
SHA-1: 75beaf430aa0bcdf77aa305cb0c789ee38d83582
MD5: fef4d32d71097aa2610316f5b78f7800
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 6144:StfDEsjPhczvZcweFm37cxzmRHUPD65Mb2x9TBmXvI20:SbQXAm3ggRUeMq9TYXvd0
TLSH: T10E47AD79871722A3EAF6E564DC455CEEA033B47DA876D04C5A03C82EB6F14B398F0161
Submitted as: a76c1abd038973ddec464bc5c94af0bd6b7a9568c09193216eaad2c21e8d9c5a
File type: pe · Size: 339624 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.JX
Emsisoft (Emergency Kit): Dropped:Generic.Malware.PWB!dld!Pk!.69063F94
Kaspersky (KVRT): Virus.Win32.Delf.62976

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.JX (rule Virus:Win32/Viking.JX) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Malware.PWB!dld!Pk!.69063F94 (rule Dropped:Generic.Malware.PWB!dld!Pk!.69063F94) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Delf.62976 (rule Virus.Win32.Delf.62976) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.lookde5.com/1.exe - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 98 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

59052 behavior events · 2 ATT&CK techniques · 101 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - 5e08832686227ccb1aa47c061614d975cd14498a83312b57ce61c87de7113098
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe - c514db8a7c1be4c842f891732398dd1bc5984dfc0e3c9faa0f1da24b092763dc
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe - 34651c3d06814a7af64e5ad89d8e340f542c7d1e118d567675af8ca7f6c62380
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w32.exe - 155c2b028c3876d74d7c9dd7f9b87191d27b716c541e100526601c704efff13f
C:\Program Files\Google\Chrome\Application\151.0.7922.174\elevation_service.exe - d8603ffd869640824373080d21eb2de379de1c60a99f56f20ef225f45bd331d6
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 6d3e0e30e9b715efc1a366eb3d8a430fb3822afcd602dbca495d2a79d2a039d9
C:\Program Files\LibreOffice\program\soffice_safe.exe - cb5b007abe8325b856d827d9a815169352bdaa8651c2a7635339e2b240385bad
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - b9a805dade90c063c6bd25fc1c4a51ce78c3ca707549b647e38237cf2333e192
C:\Program Files\Google\Chrome\Application\chrome.exe - 3246f2ece51643962b359a5fc1710c21608227dafefcc0c4d188eed0263e2c57
C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe - c5ea2b520db6c6c19abd906d368d2c5c21a73ce0e60d07b437011661d2c827ce
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\venvlauncher.exe - 5c492b65006934b1e1d359ae6bac8fc57a7aa69436f9cb06c40889d47d416818
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t64.exe - 70ef81c420eab8378a6ca6625f51ed5d697d071f18d09066468f5117346257c8
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe - 7a12b9a059f49ad899c7eaa23b8f8a4288fdd96b21b6f273dd2fd65ffe5f20cb
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t32.exe - a034bb1a5e3c1cfe8ef993945bb3fe86d9a91ea14694874720ec5cb0d3bc05d5

Embedded URLs

http://www.lookde5.com/1.exe
https://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.lookde5.com
cacerts.digicert.com
crl4.digicert.com
crl3.digicert.com
www.digicert.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

192.168.0.30
192.168.8.1
20.42.65.89
52.123.252.216
4.230.171.124
52.230.59.222
4.247.188.233
74.178.240.51
4.150.223.102
74.179.77.204
172.64.154.167
4.150.223.113
52.110.12.55
52.110.12.56
135.233.45.221
52.110.12.33
52.148.114.188
72.145.35.106
52.110.12.48

File paths

c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\jdk\objs\java_objs\java.pdb

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report