MALICIOUS — cf67cc951050f7bc12c76db71b1d2945b0a81dfcfbba5c81a0f295adbde1a238

MALICIOUS — cf67cc951050f7bc12c76db71b1d2945b0a81dfcfbba5c81a0f295adbde1a238 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 5 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: cf67cc951050f7bc12c76db71b1d2945b0a81dfcfbba5c81a0f295adbde1a238
SHA-1: 82f9bcb8685e50f56367c2b77c8cdec86976e7d1
MD5: 9edbb2c74742e006c426c8ebc15cd491
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 1536:c4q8Q1xZtffrbYsjPh5SFF4cxq/QacFWDV9q94fBtaUf:vKtfDEsjPhczEVV9q9IB
TLSH: T1F7388C2A6B5A3B83EB72D3620852B75D0061F8B93435448D5323857FB7FDC236A6421C
Submitted as: cf67cc951050f7bc12c76db71b1d2945b0a81dfcfbba5c81a0f295adbde1a238
File type: pe · Size: 83624 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (5 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.JX
Kaspersky (KVRT): Virus.Win32.Delf.62976

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.JX (rule Virus:Win32/Viking.JX) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Delf.62976 (rule Virus.Win32.Delf.62976) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.lookde5.com/1.exe - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 94 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

59255 behavior events · 2 ATT&CK techniques · 97 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe - d37fc2fc8a765b6d8fc3242bdcd0fa674ac3e0db2631e595a5c3a2b34e916af9
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe - b191eda8fc1b011b5e7aff64834e250f5b349bf8f20f2dc5ee07d5d5c0d95149
C:\Program Files\LibreOffice\program\xpdfimport.exe - b1f3af1835434d5fd2d2043d9d9b8bd0da3822322345245447232e7add9fb9c8
C:\Program Files\LibreOffice\program\update_service.exe - 36cd800fa4ba39a93b08232f7a3085240d8c3d71e2c0909fb9cdcd8f124e19a3
C:\Users\analyst\AppData\Local\Temp\$$aE89A.bat - aae49431f6bee730b6256eae014bf20b5263ad7ded3fe4b409933753a7008639
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe - 85481c5f5abeeaaaea6f6849bc29bc70673a489f7977158de9079d924002b1d4
C:\Program Files\LibreOffice\program\smath.exe - 2c59f089ba77266bc23d7f47c74c62dac9bb2ee6f773141e4fceb634d4a3d28d
C:\Program Files\Google\Chrome\Application\151.0.7922.174\notification_helper.exe - cda1395bf62129b6b61465e167417081846113c63f530d2b427169f78335bf44
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w64.exe - c25eb23dd0a18b763d2a163596500345f5a277da1da1447926124d71d43e75e0
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\venvlauncher.exe - 7693035efdfcaa65d499fb737d8dff23db2de703e66be1636b8ac41d71a522ff
C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe - 7b9d2214402b8e7cd2e780e055e28f4c432ff49689fb37795d75a30935ec32b0
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\7-Zip\7zG.exe - e9551989a69d2df5e96ee4be002f225c2e501443a5c09a792af1340177384cd5
C:\Program Files\LibreOffice\program\opencltest.exe - 03f6fbf0f653808e98244b5854d2684280e89aaad379028223352c7a13ddbd6f
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe - c89fcd369f0d7c18290f6e4b00272da2cb0cdf074d55698896660b9a9fc63cd0

Embedded URLs

http://www.lookde5.com/1.exe
https://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.lookde5.com
cacerts.digicert.com
crl4.digicert.com
crl3.digicert.com
www.digicert.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

192.168.0.30
192.168.8.1
13.89.179.15
4.230.171.124
48.211.4.16
74.179.77.204
135.232.92.97
4.150.223.113
135.232.92.137
52.230.60.54
52.110.12.44
52.110.12.15
172.178.240.162
125.56.205.42
125.56.205.17
52.148.114.188
72.154.7.110
52.110.12.40
52.110.12.48

File paths

c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\jdk\objs\rmid_objs\rmid.pdb

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report