MALICIOUS — e7cca11e4b82e570fcc60b9f721a3603616d1f56aa847b159aeecb1a929e2cd2

MALICIOUS — e7cca11e4b82e570fcc60b9f721a3603616d1f56aa847b159aeecb1a929e2cd2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e7cca11e4b82e570fcc60b9f721a3603616d1f56aa847b159aeecb1a929e2cd2
SHA-1: 1cd25fde816c772f018bea1507c4b2d37279ca3e
MD5: fa49668c7130b5763034d41dfa1cd533
imphash: 9973fdd4b86d866b3faa39fa66cf7e0a
ssdeep: 6144:8jMKITkBXkHhIi62CRnO1jrcBc6tFyna3:/IbWWvB3
TLSH: T1DD449D8882551616C1B7ED61A88DCC9CA013B0B8727986DFA223D77F9BF0533BC39465
Submitted as: e7cca11e4b82e570fcc60b9f721a3603616d1f56aa847b159aeecb1a929e2cd2
File type: pe · Size: 259345 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (6 of 56 engines)

ClamAV (daily): Win.Worm.Delf-6980489-0
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Worm:Win32/Xolxo.A
Emsisoft (Emergency Kit): Dropped:Generic.Malware.SNm.77E31C26
Kaspersky (KVRT): P2P-Worm.Win32.Delf.aj

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Worm.Delf-6980489-0 (rule Win.Worm.Delf-6980489-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Worm:Win32/Xolxo.A (rule Worm:Win32/Xolxo.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Malware.SNm.77E31C26 (rule Dropped:Generic.Malware.SNm.77E31C26) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged P2P-Worm.Win32.Delf.aj (rule P2P-Worm.Win32.Delf.aj) - engine signal, weight 0.55, confidence 0.85
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.gnu.org/software/coreutils/, http://translationproject.org/team/, http://gnu.org/licenses/gpl.html - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Dropped 48 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

37478 behavior events · 0 ATT&CK techniques · 50 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - 9dffa2c5afeda7f1dd1d267550a15f9cace099055e1275d73d1898281dcf9bed
C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe - 8eee198e49bbd0a52c738939f6bab50f92c1512503f05ae6cb6e11664f1c0dd0
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe - f6f3d7c4541376c1bf00c3d3af21bed6ebb970431877652a3f0d7952c341fd51
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe - 07c5932e26d8e14bfee54f76a44d7f0205f933b6e925c918d434c8140428286c
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe - 79671bf6759f645dfeb021e3fcece87abe20b7c6be7ee7bf9c362603056a23ee
C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe - a04e0ea1c74415a8da30c034843c2edb85d9575433c40be0d880fd4b072e5bf1
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe - 7ab807b2f85d1de86a4ddbdc9efffe045c74d75668f9e7428999e863a062507b
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - f54a9a59a7f07921c8210b5bd7b5308f1bfcf9debc24920568e9cffaf892a165
C:\Program Files\7-Zip\7z.exe - 479137b8809c2ccbea40d66e8b896f24d7378e919555d81997b17b6df86eae23
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - c82577476eb3c66d0e8e4e1c57c1cb88e453d988bd7cbc41abd5faa1449b30ca
C:\Program Files\Adobe\Acrobat DC\Acrobat\CPInstCU.exe - a8cef97e3c090986f88eb98782e69ef0b9f061d7e3a35007501010545863d6fa
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe - ac57673f2caf4d337e22c1bddee94aa35db245b1f4701356c73da34731ca1fa0

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://crl.verisign.com/tss-ca.crl0
http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
http://office.microsoft.com
https://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.gnu.org/software/coreutils/
http://translationproject.org/team/
http://gnu.org/licenses/gpl.html
http://www.gnu.org/gethelp/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.microsoft.com
www.microsoft.com
crl.verisign.com
office.microsoft.com
cacerts.digicert.com
crl4.digicert.com
crl3.digicert.com
www.digicert.com
www.gnu.org
translationproject.org
gnu.org
cygwin.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.97
52.123.252.195
4.230.171.124
20.42.179.192
135.233.95.144
135.232.92.97
4.150.223.112
52.230.59.222
104.18.33.89
92.223.78.30
4.150.223.100
52.148.114.188
72.145.35.109
52.110.12.30
52.110.12.51

Registry keys

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME\audio/x-aiff]
HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME\audio/aiff]
HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.aiff]
HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.aifc]
HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.aif]
HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME\video/quicktime]
HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.qt]
HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.mov]

File paths

C:\My
C:\WINNT\system32\actmovie.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\pchealth\helpctr\binaries\notiflag.exe
C:\WINDOWS\system32\login.cmd
C:\WINDOWS\system32\fastopen.exe
C:\Program
C:\WINDOWS\system32\msvbvm60.dll\3
c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\jdk\objs\kinit_objs\kinit.pdb
D:\workspace\_work\1\s\artifacts\obj\coreclr\Windows_NT.x64.Release\src\debug\createdump\Release\createdump.pdb
C:\cygwin64\bin\unlink.exe

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report