MALICIOUS — ee6ed06897896ab87a9a84035fd7e7f2ff889afc7794017428fe1805dc09b8ea

MALICIOUS — ee6ed06897896ab87a9a84035fd7e7f2ff889afc7794017428fe1805dc09b8ea is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: ee6ed06897896ab87a9a84035fd7e7f2ff889afc7794017428fe1805dc09b8ea
SHA-1: 9cc18d378a4a118d866beb16a56a4d2b1449ec89
MD5: 7aa4e405baa975695dc19d5a3c14be3a
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 3072:qKtfDwsjPThTYszDH2fCD9u3NTcGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2N8:BtfDwsjPThT5zL2u9KN4ShcHUaN8
TLSH: T18F42F788161E0502E922EE19061A144F1548B7FD34A4EAF657233CFE72CA7677F290F9
Submitted as: ee6ed06897896ab87a9a84035fd7e7f2ff889afc7794017428fe1805dc09b8ea
File type: pe · Size: 204528 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Kaspersky (KVRT): Virus.Win32.Lamer.xe
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Dropped a malicious payload (GameThief): virDll.dll - dynamic signal, weight 0.62, confidence 0.90
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 2 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

53853 behavior events · 1 ATT&CK techniques · 103 dropped files.

Dropped files

C:\Windows\Logo1_.exe - e61ce16d98a1657c26546edf26a475b7c7d3f22da5392067287dc2dfc215ce04
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w64.exe - 0d2e71b0835ed6972d584524ca33d24034e1a8afdb33b4a598229ef7e1fc8a10
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe - 0476fb1556081f2a313d17e0701841e476b51e30c9b11b9bdae0fb8697252bbb
C:\Program Files\LibreOffice\program\smath.exe - 0f90e8fa1235ee965b109dadec3cb5e23fb9a564b86a536497bca09a919dd30b
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\gui.exe - 50d41c5ab6b6a75b3b9c5cdc1fdb30781001506b3b4cd98f032966e718dd6dff
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe - 61caeb38f4db6a54968f6c6e4c2fa52677848a3f9811e3ff2653d2d485fc7983
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe - e12622c640d49a3aee11d180db54ca4229cb716d865b29fa43226ee1da46adce
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\7-Zip\7z.exe - 3730a433037179a3be0dde3a45ac806b48d9ac359cdbb1fae3e7a8fccb4d7545
C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe - df26cbdb8a10ec022c82118ad1ac5d2aba5da4185426bda269c0bff874932f57
C:\Program Files\LibreOffice\program\scalc.exe - 58cdd1a0113752e84f9f48f3904f1809efb626a97bad97fd74ce5eef623d5d62
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - cb729c721da4b481ca38ea07f6e2b5df7e5ae0f5e2a79a144a5e829026141428
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\venvlauncher.exe - 281c5fe2503f323d388dad8400cfafb57de83fc3bbe0c7a802961e18dbafee8b
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t64-arm.exe - 5c9bca3dcd0aaa8341e2737f32fb90d2ff547005e90add16da1e391d8b1619ca
C:\Program Files\LibreOffice\program\sbase.exe - 3cb2a59ad6769d07b436d5ee4c4b85bc988257923f272b4c1136d78f8bfcb5dd

Embedded URLs

http://www.w3.org/2001/XMLSchema-instance
https://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://www.digicert.com/ssl-cps-repository.htm0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.w3.org
shim.app
cacerts.digicert.com
crl4.digicert.com
crl3.digicert.com
www.digicert.com

Embedded IP addresses

192.168.0.30
192.168.8.1
52.168.117.171
52.123.252.198
4.230.171.124
52.230.60.54
40.84.85.40
172.64.154.167
74.178.240.51
74.179.77.204
4.150.223.105
51.104.15.252
52.110.12.50
52.110.12.10
72.145.35.96
52.148.114.188
52.110.12.33
52.110.12.56

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report