Malware

Win32:Delf-UFQ [Trj] malicious file

Malware Removal

The Win32:Delf-UFQ [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32:Delf-UFQ [Trj] virus can do?

  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Unconventionial language used in binary resources: Russian
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Network activity detected but not expressed in API logs

How to determine Win32:Delf-UFQ [Trj]?


File Info:

crc32: F7AD67EE
md5: 5d17a17aedd73ead9f6d49a1d31c0929
name: 5D17A17AEDD73EAD9F6D49A1D31C0929.mlw
sha1: 6f08eefedc5aeb393bdaaecdb486b4b0e2582131
sha256: 15cc525311f4e394141b11a542bd5917e2f68ad14c93586c4466883b7271b09e
sha512: 779ef703f46cc1e00d0ee835e134163fa4b034bb3d0c273b9fee626cd81bd77edd87069f4e684efaeed20e32c7b53fa94f3b633304324b6cab603c6ba2cdad90
ssdeep: 24576:E24gsa6Qb1kXGxFAAhQ2la6O/TMIHoX1sYBP1t:J4gsvQb1k28sg6OL7IlpP
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

LegalCopyright: Copyright 1984-2016 Adobe Systems Incorporated and its licensors. All rights reserved.
InternalName: Adobe Acrobat Reader DX
FileVersion: 10.7.20033.13733
ProductName: Adobe Acrobat Reader DX
ProductVersion: 10.7.20033.13733
FileDescription: Adobe Acrobat Reader DX
OriginalFilename: AcroRd32.exe
Translation: 0x0409 0x04e4

Win32:Delf-UFQ [Trj] also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Jacard.13238
FireEyeGeneric.mg.5d17a17aedd73ead
McAfeeGenericRXAA-FA!5D17A17AEDD7
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
AegisLabTrojan.Win32.Bcex.4!c
K7AntiVirusTrojan-Downloader ( 004e02ad1 )
BitDefenderGen:Variant.Jacard.13238
K7GWTrojan-Downloader ( 004e02ad1 )
Cybereasonmalicious.aedd73
CyrenW32/Rakhni.A.gen!Eldorado
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:Delf-UFQ [Trj]
KasperskyTrojan.Win32.Hesv.gag
NANO-AntivirusTrojan.Win32.Bcex.emigtb
TencentMalware.Win32.Gencirc.10b3a92b
Ad-AwareGen:Variant.Jacard.13238
SophosMal/Generic-S
F-SecureTrojan.TR/Downloader.Gen7
DrWebTrojan.DownLoader24.62972
ZillyaTrojan.Bcex.Win32.267
TrendMicroTROJ_ZUSY_GC060177.UVPM
McAfee-GW-EditionGenericRXBB-LA!D8431B963FB8
EmsisoftGen:Variant.Jacard.13238 (B)
SentinelOneStatic AI – Suspicious PE – Installer
JiangminTrojan.Bcex.ib
AviraTR/Downloader.Gen7
MAXmalware (ai score=87)
Antiy-AVLTrojan/Win32.Bcex
MicrosoftTrojan:Win32/Skeeyah.A!rfn
ArcabitTrojan.Jacard.D33B6
ZoneAlarmTrojan.Win32.Hesv.gag
GDataGen:Variant.Jacard.13238
CynetMalicious (score: 85)
AhnLab-V3Downloader/Win32.Delf.C1783347
VBA32TScope.Trojan.Delf
ALYacGen:Variant.Jacard.13238
MalwarebytesGeneric.Trojan.Malicious.DDS
PandaTrj/Genetic.gen
ESET-NOD32a variant of Win32/TrojanDownloader.Delf.BYK
TrendMicro-HouseCallTROJ_ZUSY_GC060177.UVPM
RisingDownloader.Gendwnurl!8.D8D6 (RDMK:cmRtazqylZNcKS3qY5NZbyPU7mr7)
YandexTrojan.GenAsa!B4SWzjBtgJ4
IkarusTrojan-Downloader.Win32.Rakhni
FortinetW32/Dloader.CDW!tr
BitDefenderThetaAI:Packer.E19542C118
AVGWin32:Delf-UFQ [Trj]
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_90% (D)
Qihoo-360Win32/Trojan.f18

How to remove Win32:Delf-UFQ [Trj]?

Win32:Delf-UFQ [Trj] removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment