MALICIOUS — b04113c3c23ef6c5ede6dc68c48ad5b31a8fca4339583e0e5929b1027346fa2d

MALICIOUS — b04113c3c23ef6c5ede6dc68c48ad5b31a8fca4339583e0e5929b1027346fa2d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 6 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: b04113c3c23ef6c5ede6dc68c48ad5b31a8fca4339583e0e5929b1027346fa2d
SHA-1: eba2a09cbf043f01dd5a2708e5842538e61f03fb
MD5: cde03271b83bb1da6c87acacfa8e9db5
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 3072:vKtfDEsjPhczErpsgozqC4O/jHxo6l0PTBuJBQbRQ5WF:StfDEsjPhczMps5N/jHxn0l7xF
TLSH: T1CC408C6847276693F1B2CB259C50AA9D4032F57C607A588D634BD86FF3F8C7389B4218
Submitted as: b04113c3c23ef6c5ede6dc68c48ad5b31a8fca4339583e0e5929b1027346fa2d
File type: pe · Size: 167936 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.JX
Emsisoft (Emergency Kit): Dropped:Generic.Malware.PWB!dld!Pk!.69063F94
Kaspersky (KVRT): Virus.Win32.Delf.62976

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.JX (rule Virus:Win32/Viking.JX) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Malware.PWB!dld!Pk!.69063F94 (rule Dropped:Generic.Malware.PWB!dld!Pk!.69063F94) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Delf.62976 (rule Virus.Win32.Delf.62976) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.lookde5.com/1.exe - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 96 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

59593 behavior events · 1 ATT&CK techniques · 99 dropped files.

Dropped files

C:\Program Files\7-Zip\Uninstall.exe - b680e9dd86b50b071bd46fcb7ef0381ef86dafc0b6457a90bc3e66fc8acf6c95
C:\Program Files\LibreOffice\program\update_service.exe - a63adac74581ab35907900cbb9eb5ff392fe7a75704da68771d0f26ac96bb075
C:\Program Files\Google\Chrome\Application\151.0.7922.174\os_update_handler.exe - b8d3c1a418908720d15fa4edb4f0b70cd10fa6008de91c3ee1da8f1947ceefbc
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 5304e7f7cab27544d3e02936f9417e2271d7f32595c223a5082aafae421eeeec
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\LibreOffice\program\gengal.exe - 0af52248bc1fcf68810dd2f88d0ea7a63e4d1b98fdffd704ac63fc2867db7eb8
C:\Program Files\7-Zip\7z.exe - dff2ea4e399d5e8821c008f62ebf85933fd98ef071f5f82a8a06872e85e754ea
C:\Program Files\LibreOffice\program\quickstart.exe - d25587a3607aa3671aaaf9dedfde3165fc82f39a02889674ff4700fa666d3608
C:\Program Files\LibreOffice\program\twain32shim.exe - bf5e6925be37b91e68ca50f28cc58b0d63dce2c88e69bcba4e0d57591e4614e5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jwebserver.exe - 3b66b447d82bb819a428c779f068cd240b32355f1462cba2463deae90e733528
C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe - b0743977b70e2518ae301d6cf5f3e98ab4ff5d8995e8d3f3e25c96018364bfb3
C:\Program Files\LibreOffice\program\sbase.exe - 383e12d7107fe72b8a1a0adeb9e78c34df2ed66250ea21ad2f6a877b43606257
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w64.exe - 714d8fb14bcbcf4fbf0534cabc84552b4b8711491af774deb2006fb7932dfb42
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\gui.exe - 7c5d636f0e230feb403d0fa2f5924fdd6e49b7f59a6a31b834d8ee078844c9a7
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\cli-arm64.exe - 948366ae1c53d8fd71cb66be2e53a4494693ff38c48dcccdb405e6fd6548f6b0

Embedded URLs

http://www.lookde5.com/1.exe
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.lookde5.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

192.168.0.30
192.168.8.1
52.168.117.169
52.123.252.239
4.230.171.124
85.210.196.11
20.247.184.197
74.178.76.128
74.178.76.54
74.179.77.204
40.84.97.4
72.154.7.99
52.148.114.188
52.110.12.16
52.110.12.25

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report