MALICIOUS — b22bcd51e9951cdd5053fc32c70584bc7c157b09547a10715ac0d321f9aca561

MALICIOUS — b22bcd51e9951cdd5053fc32c70584bc7c157b09547a10715ac0d321f9aca561 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: b22bcd51e9951cdd5053fc32c70584bc7c157b09547a10715ac0d321f9aca561
SHA-1: 08943df60e6ae5d6fea0e2dc77d760ffffa0a131
MD5: 058f3d514e0d453f51bd82c8f4e53def
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 3072:qKtfDwsjPThTYszDH2f08evwyCSwo1Vves1OFlDBt:BtfDwsjPThT5zL2vevwpDo1Vves1OFl3
TLSH: T13E3C8D68662A3A96DB36C77B1C41BB5E5073B475207E088C135BC07F7BEAC13959206C
Submitted as: b22bcd51e9951cdd5053fc32c70584bc7c157b09547a10715ac0d321f9aca561
File type: pe · Size: 115088 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (7 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Dropped a malicious payload (GameThief): virDll.dll - dynamic signal, weight 0.62, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 7.0.0.147 - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

61134 behavior events · 2 ATT&CK techniques · 101 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - 8b802fa1df12a79b799964fe00bf3e0d2876c577005168343f8c6ba7c905bf6b
C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe - 49238ef157476facb340c9b765ff7315b9c1a9c26a19083c0348670e111ccc55
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 9ea4d460c1c28636103a9aebbc185f8cebc6b7502a2bba1e6da740c8e5165409
C:\Program Files\LibreOffice\program\soffice.exe - 85cf0a5f1b56e9eccdd838177bbcf5ab6e2bd562ab66c73a45bb86ac9b0a1159
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w64.exe - ae35f24329b2322947e2d8252feec03b5364e5d3baebbff5eeab20956a909b8d
C:\Program Files\LibreOffice\program\senddoc.exe - 4af4fddbcc236b3a5bc9babc7c7c14adf8b56fa30d7722f06d3b6d4e6f429ec4
C:\Program Files\LibreOffice\program\regview.exe - ee0d4c536d5d375de09959e90b304ce6690841af0bb25e2368900f782b31cd97
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t32.exe - a304018e1c6fa0b19da13641114035b5a2bcb61537d1f6650d0b76a856b559a5
C:\Windows\Logo1_.exe - 0e8487a3ddcdea601419fadb494ee91582c97d3b43de012e779b4778367237fd
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe - 7642daca21e2b2f023731dabbb54884a36821c5a38504c02f0941b5e15031cce
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\gui-arm64.exe - a0012eb051b764d72cd0615957db1a9dabb09ce813b3a36886a152ec0fd43993
C:\Program Files\LibreOffice\program\quickstart.exe - b1a8bdbc03968119f0418d99746c19900771514fa37dc7b2343abebff5463fcc
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - cb729c721da4b481ca38ea07f6e2b5df7e5ae0f5e2a79a144a5e829026141428
C:\Program Files\LibreOffice\program\swriter.exe - bdd91ec44111677956c74794880c7c460732116cbc9384c4a9f5ff0554a25b1b

Embedded URLs

http://crl.verisign.com/tss-ca.crl0
https://www.verisign.com/rpa
https://www.verisign.com/cps0*
https://www.verisign.com/rpa0
http://logo.verisign.com/vslogo.gif0
http://crl.verisign.com/pca3.crl0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.verisign.com
www.verisign.com
logo.verisign.com
csc3-2009-2-crl.verisign.com
csc3-2009-2-aia.verisign.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

192.168.0.30
192.168.8.1
7.0.0.147
20.184.175.19
52.230.59.222
4.230.171.124
104.18.33.89
172.66.2.5
135.233.45.221
85.210.193.152
57.155.104.224
4.247.188.233
4.150.223.102
52.148.114.188
92.223.78.30
52.110.12.16
52.110.12.25
72.153.5.137

Registry keys

HKEY_CLASSES_ROOT\JNLPFile

File paths

C:\jdk7_32P\jdk7\build\windows-i586\tmp\ssvagent\obj\ssvagent.pdb

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report