MALICIOUS — e1a1ee6050491a32a76b987d9af16f02d27d493611bdf971cf009f0796443b7e
MALICIOUS — e1a1ee6050491a32a76b987d9af16f02d27d493611bdf971cf009f0796443b7e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 5 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.
Identification
- SHA-256:
e1a1ee6050491a32a76b987d9af16f02d27d493611bdf971cf009f0796443b7e - SHA-1:
cef4a32a0541430fa61ea5cf4511ce4b2d107381 - MD5:
ed526fea8e2221917ddd676d5819ec13 - imphash:
31d1c48ee7d8e07a5706e963146db875 - ssdeep:
1536:c4q8Q1xZtffrbYsjPh5SFF4cxq/QacFWTfsyqfA8Uf:vKtfDEsjPhczEFfsySA - TLSH:
T100388D296B573B83EB76D22208927B5C0071F8B9753644895327867FB7FDC236A70218 - Submitted as: e1a1ee6050491a32a76b987d9af16f02d27d493611bdf971cf009f0796443b7e
- File type: pe · Size: 83624 bytes
- Verdict: malicious (100/100) · Family: Delf
Detections (5 of 56 engines)
- YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
- ClamAV (daily): Win.Trojan.Delf-1564
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Virus:Win32/Viking.JX
- Kaspersky (KVRT): Virus.Win32.Delf.62976
MITRE ATT&CK
YARA
- Windows_Injection_Api_Combo
Why this verdict
The malicious score of 100/100 is the fusion of 15 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule
Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95 - Process injection API combination (rule
Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90 - Microsoft Defender flagged Virus:Win32/Viking.JX (rule
Virus:Win32/Viking.JX) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Virus.Win32.Delf.62976 (rule
Virus.Win32.Delf.62976) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 1 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
- YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule
Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://www.lookde5.com/1.exe - static signal, weight 0.35, confidence 0.60
- 1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule
tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90 - communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Dropped 98 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
60082 behavior events · 2 ATT&CK techniques · 102 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- desktop-hsgcbep
- login.live.com
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe -
e9094c82c17113588b7c7ffc20267fd4c14fb23fe732a9a0f68004777dc5eb5a - C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe -
83931ad82010507b3233b25db98ba245b514bae8219838c5ae092f6999732aa8 - C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w64.exe -
f55f1886a98688caf4a2fb4b334399981530927a5ee47820bb95cc5fafaf10ba - C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe -
0f98402d5e404137e506d9664249681d201930bab2498526fba591e887fcb0c2 - C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe -
b2fd6f7ce980ae27b618e925f77c27015662659cbb363523b41c87017fdfd382 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 -
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - C:\Program Files\LibreOffice\program\soffice.exe -
94cdf18f914c0b52c10492ed2d8e3169e8e6fbb2da0ebf175327f4130dd03093 - C:\Program Files\LibreOffice\program\smath.exe -
bed54aeeeba75502b4c29550e7600dbc97b6ce7a14ecdab96693429ddf26d19a - C:\Program Files\7-Zip\7zG.exe -
a14e068652648713b10ea2f095ad386ac6e324961944c4d85658276889442117 - C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\python.exe -
c86a4a0595c2f36ae1be5bd6e57cec0c23de04996a9593175bb0d2ec0f00fd61 - C:\Program Files\LibreOffice\program\swriter.exe -
134d737cf1cf2ba9dcce7d9e566b177d27a556b0c34930e1fe1285174d3f4927 - C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\gui.exe -
22ee758e525d5bdbf0094280cd93b4edf997fcb70b63b61c4b022b7ab7e2abd0 - C:\Program Files\LibreOffice\program\unopkg.exe -
1cc78c2bb0abce9429d189c2f06f65697a7eb72fb4d3b260fb893a13bbdc127f - C:\Program Files\LibreOffice\program\minidump_upload.exe -
01a610f4ecb35d042a3cf056459e244dcb9bf783f1558df076aa3de2192a03c7 - C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\gui-arm64.exe -
c2bc5266bd05be84790b0350517ac0b1006414eb1e2b07323581537413ff816c
Embedded URLs
- http://www.lookde5.com/1.exe
- https://www.digicert.com/CPS0
- http://crl3.digicert.com/sha2-assured-cs-g1.crl05
- http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
- http://crl3.digicert.com/sha2-assured-ts.crl02
- http://crl4.digicert.com/sha2-assured-ts.crl0
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- www.lookde5.com
- cacerts.digicert.com
- crl4.digicert.com
- crl3.digicert.com
- www.digicert.com
Embedded IP addresses
- 192.168.0.30
- 192.168.8.1
- 52.182.143.212
- 52.123.252.203
- 4.230.171.124
- 20.247.185.124
- 20.42.179.192
- 74.179.77.164
- 20.42.73.27
- 20.165.94.63
- 135.233.95.144
- 135.233.45.222
- 52.110.12.42
- 52.110.12.45
- 13.89.179.12
- 20.42.65.91
- 85.210.193.152
- 52.148.114.188
- 72.153.5.60
- 52.110.12.52
File paths
- c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\jdk\objs\orbd_objs\orbd.pdb
More Delf samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report