Trojan.Dropper.Delf.BB
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 12,376 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 130 |
| First Seen: | March 31, 2022 |
| Last Seen: | February 23, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.Dropper.Delf.BB |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
6be65aa051f15547a7f2912f298eaeac
SHA1:
27decf69dbec54a34f09e0781070c79ac7301abd
SHA256:
E8E643EED43C1F1AFBFBB6DF851547F04A6A0172307BAD4A18104ECD56D76FAE
File Size:
556.03 KB, 556032 bytes
|
|
MD5:
0c385e28901f1f1b3a81e25f242d94a2
SHA1:
b2fa5160d9bff2550c8fb563db687263cd93c8b1
SHA256:
3682A934D60D6B54226493839F71FEC8D35672B380BBEA0876BF7ACA2ADA3A3E
File Size:
343.04 KB, 343040 bytes
|
|
MD5:
425e2bc8591752d493e033df85887247
SHA1:
8f021d58f59aff1217f4cb96c8df5aba89c0f12f
SHA256:
EFE13BDFC7C638E9CA78374D4555F3D896E71A55BEDDF28E504AA6D45CEACC2E
File Size:
469.50 KB, 469504 bytes
|
|
MD5:
573b4481659d3ca7c6874f0552d49801
SHA1:
bc7480741f8568f444c4b9cda61c740bae28e927
SHA256:
F09183F15B7423DE4BB3DB46220A41C61267B460F56637CFF04131F3C19BD28B
File Size:
809.47 KB, 809472 bytes
|
|
MD5:
e3867b8064eeb7c347b5139048f61ffd
SHA1:
f05b96994b3e91f251e62f69d22d046fcc77146b
SHA256:
45444BA5497D41A4BB254415E3F135E9125F56570379A57F704998DC3F23E006
File Size:
261.63 KB, 261632 bytes
|
Show More
|
MD5:
9a2fe49066cedd18ca51e262a08f2446
SHA1:
92c2e120826f425873334bc07ca2aa8cb0b92b1a
SHA256:
3DC5447AF9FEFC9B55F423D2BEC8F270F92A5B3002FC0ED6D4840F3A1F4F3BA1
File Size:
440.83 KB, 440832 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File has TLS information
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
File Traits
- 2+ executable sections
- HighEntropy
- No Version Info
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 708 |
|---|---|
| Potentially Malicious Blocks: | 188 |
| Whitelisted Blocks: | 492 |
| Unknown Blocks: | 28 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
0
0
0
x
x
x
x
x
0
0
0
0
x
x
0
x
0
?
x
?
0
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
0
x
x
0
x
0
x
x
x
x
x
x
0
x
x
0
x
x
x
x
x
x
x
x
x
0
x
x
x
x
?
x
?
x
x
0
?
0
?
x
x
x
x
?
x
x
x
x
x
x
x
x
0
x
x
x
x
0
x
x
x
x
x
x
x
x
x
0
x
x
?
x
x
?
x
x
?
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
0
0
x
0
x
0
0
0
0
0
0
0
x
x
x
x
x
x
x
x
x
0
0
0
x
x
x
0
x
0
0
x
?
x
?
?
?
?
?
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
?
0
x
x
x
x
?
x
x
x
x
x
0
x
x
x
x
x
0
x
x
x
x
0
x
?
x
x
x
x
?
x
x
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
?
?
?
?
0
0
0
?
0
?
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Dropper.Delf.BB
- HackKMS.LE
