MALICIOUS — fa8eda9fd609bf23a2b895146f33405c03bebd6a715726355bf696fb79dd3a6b
MALICIOUS — fa8eda9fd609bf23a2b895146f33405c03bebd6a715726355bf696fb79dd3a6b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.
Identification
- SHA-256:
fa8eda9fd609bf23a2b895146f33405c03bebd6a715726355bf696fb79dd3a6b - SHA-1:
10f19c620c5f0f784c8a6ebe4e29f30168e223be - MD5:
d3432b983cb4d82f63f694cb19f688e9 - imphash:
31d1c48ee7d8e07a5706e963146db875 - ssdeep:
12288:B5hVFxRb/onabLDVBJf7XIY1A3wBhvBJ/+2I:B5hVFP7onabLDVBJTXf1vBhvn/+2I - TLSH:
T1F24ACF9A455B3262E2B6EA24AC505DDD8C73F0BC7071F44D5A03C8AF71E2633E9B2149 - Submitted as: fa8eda9fd609bf23a2b895146f33405c03bebd6a715726355bf696fb79dd3a6b
- File type: pe · Size: 453848 bytes
- Verdict: malicious (100/100) · Family: Delf
Detections (7 of 56 engines)
- YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
- ClamAV (daily): Win.Trojan.Delf-1564
- YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Virus:Win32/Viking.MS
- Emsisoft (Emergency Kit): Trojan.Agent.FPMF
- Kaspersky (KVRT): Virus.Win32.Lamer.xe
MITRE ATT&CK
YARA
- Windows_Injection_Api_Combo
Why this verdict
The malicious score of 100/100 is the fusion of 16 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule
Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95 - Process injection API combination (rule
Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90 - Dropped a malicious payload (GameThief): virDll.dll - dynamic signal, weight 0.62, confidence 0.90
- Microsoft Defender flagged Virus:Win32/Viking.MS (rule
Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule
Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule
Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule
DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
- YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule
Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://secure.comodo.net/CPS0C, https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0 - static signal, weight 0.35, confidence 0.60
- 1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule
tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
59888 behavior events · 2 ATT&CK techniques · 103 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- www.bing.com
- assets.msn.com
- th.bing.com
- fe3cr.delivery.mp.microsoft.com
- settings-win.data.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe -
745201a675e8f91a4f62bb5ab94ed32fc35200da132b4b0b1721b871e0334630 - C:\Program Files\LibreOffice\program\spsupp_helper.exe -
73e045412d46ef3df7987d454cfe2af712436453d83d36631163d38d2302aa8b - C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe -
d4c95610d1498487352454c088d472aeb864ac768755dabbb2f696f42d19fcd1 - C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\python.exe -
24ce9e7f5f984cb71e4f36929a3f1800a14a3b5b4e036a844e16ceb1db7865dc - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jwebserver.exe -
afa47a08cd9a0b9b7de83ce9f9299145b7fd39b3fb8202d1545366c3d2182593 - C:\Program Files\Google\Chrome\Application\151.0.7922.174\os_update_handler.exe -
0cbc100506764ae2fc9ddb306100704b45afff1ecd5c1752f1324783f35ee636 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 -
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - C:\Program Files\LibreOffice\program\minidump_upload.exe -
54bc66816035f4d3736c2f538cbda68b25c247a1ed1d50cdf793175527dfa059 - C:\Program Files\LibreOffice\program\sweb.exe -
b705752e98d32c75d999b174519bf3a8781573d5b6a8d29f1e07d5520c4a2748 - C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe -
1b06f29ab561810f37eed89a8d612b99ce870214ead79fe3f4a03a5a1da23f00 - C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\venvlauncher.exe -
187a51558239f64137c04b8b3889d5b6a8262e02204cef57f01ddc451994eebb - C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe -
0ce0998acbb24a0720b8e2168f7d3b90748dfeda1dbadc973f9c2a75860106b6 - C:\Program Files\LibreOffice\program\soffice_safe.exe -
157887933598c50699848162998ec18f339289a9777712a533e50d3f4a590746 - C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe -
cb729c721da4b481ca38ea07f6e2b5df7e5ae0f5e2a79a144a5e829026141428 - C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe -
0681ad76ead3b8db31e833dcbc4d530cf692ecbdd8ac9712f8e545eb1328817e
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- http://crl.thawte.com/ThawteTimestampingCA.crl0
- http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
- http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
- https://secure.comodo.net/CPS0C
- http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
- http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$
- https://d.symcb.com/rpa0
- http://s.symcb.com/universal-root.crl0
- https://d.symcb.com/rpa0@
- http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
- http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- schemas.microsoft.com
- crl.thawte.com
- ts-aia.ws.symantec.com
- ts-crl.ws.symantec.com
- secure.comodo.net
- crl.comodoca.com
- crt.comodoca.com
- d.symcb.com
- s.symcb.com
Embedded IP addresses
- 192.168.0.30
- 192.168.8.1
- 52.110.12.50
- 20.50.201.206
- 4.155.90.37
- 52.123.252.212
- 4.230.171.124
- 74.178.240.51
- 4.247.188.224
- 172.64.154.167
- 74.179.77.204
- 20.42.72.131
- 52.168.117.168
- 172.66.2.5
- 135.233.45.221
- 172.64.149.23
- 52.148.114.188
- 72.154.7.112
- 52.110.12.26
- 52.110.12.40
File paths
- D:\Projects\WinRAR\uninstall\build\uninstall64\Release\uninstall.pdb
More Delf samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report