PseudoSigner01BorlandDelphi6070Anorganix

Hunt Hypothesis

This detection identifies potentially malicious executables compiled with Borland Delphi that exhibit anomalous code signing patterns characteristic of the Anorganix family, often used by adversaries to evade standard signature-based defenses. SOC teams should proactively hunt for these artifacts in Azure Sentinel to uncover stealthy threats that may bypass traditional security controls due to their use of legacy compiler signatures and pseudo-signing techniques.

YARA Rule

rule PseudoSigner01BorlandDelphi6070Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner01BorlandDelphi6070Anorganix detection rule, including suggested filters and exclusions:

• Legacy ERP Reporting Tools: Enterprise environments often utilize legacy Business Intelligence (BI) or ERP modules built on Borland Delphi 6.0/7.0 (e.g., older versions of SAP NetWeaver add-ons or custom Oracle Forms wrappers). These applications frequently execute scheduled batch reports that trigger the rule due to their embedded signing certificates matching the “Anorganix” profile.

  • Suggested Filter: Create a path-based exclusion for known legacy application directories, such as C:\Program Files\SAP\FrontEnd\bin or specific custom ERP folders, and exclude processes named ReportScheduler.exe or DataMartService.exe.

• Custom Internal Inventory Management Systems: Many manufacturing firms maintain in-house inventory tracking systems developed using Delphi 6.070. These systems often run automated nightly synchronization jobs that interact with the file system, generating artifacts that mimic the rule’s signature logic.

  • Suggested Filter: Implement a process hash exclusion for the specific executable InventorySync.exe located in C:\Apps\Internal\Inventory, ensuring the rule ignores its child processes during scheduled maintenance windows (e.g., 02:00–04:00 UTC).

• Third-Party Document Digitization Suites: External vendors providing document management solutions often deploy Delphi-based agents for scanning and indexing. These agents utilize the Anorganix signing infrastructure to validate scanned documents, which can trigger the rule when processing high volumes of PDFs or images.

  • Suggested Filter: Add an exclusion based on the publisher name “Anorganix Solutions” combined with a specific file extension filter (e.g., *.docx, *.pdf) within the document