PseudoSigner02BorlandDelphiDLLAnorganix

Hunt Hypothesis

This rule identifies potentially malicious DLLs that exploit Borland Delphi code structures and exhibit characteristics associated with the “Anorganix” family, often used to disguise malicious payloads through pseudo-signing or obfuscation. Proactively hunting for these artifacts in Azure Sentinel helps detect low-severity, fileless or memory-resident threats that may evade traditional signature-based detections and establish a foothold for lateral movement or privilege escalation.

YARA Rule

rule PseudoSigner02BorlandDelphiDLLAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy internal application (e.g., InventoryTracker.exe) is compiled using the Borland Delphi 7 compiler and linked against the anorganix.dll library for custom UI rendering. The DLL is signed with a pseudo-certificate or left unsigned to save on licensing costs, but it resides in the trusted C:\Program Files\InternalApps\ directory.

  • Filter/Exclusion: Exclude files located in C:\Program Files\ or C:\Program Files (x86)\ where the parent executable has a valid Authenticode signature from the internal corporate CA, and the DLL name matches anorganix.dll.

• Scenario: An IT administrator manually deploys a patched version of a third-party reporting tool (e.g., CrystalReportsViewer.dll) that was recompiled with Delphi to fix a memory leak. The patch process strips the original digital signature, and the file is temporarily staged in the C:\Temp\ or C:\Users\Public\ directory before being moved to the application folder.

  • Filter/Exclusion: Exclude files in C:\Temp\ or C:\Users\Public\ if the file age is less than 24 hours and the parent process is a known administrative tool (e.g., PowerShell.exe, cmd.exe, or msiexec.exe).

• Scenario: A developer is testing a new Delphi-based plugin for an internal IDE extension. The plugin (PluginCore.dll) is built in a local C:\Users\<dev>\Projects\ directory and uses anorganix.dll for data serialization. The developer runs the IDE directly from the source directory during debugging, causing the DLL to be loaded from a non-standard path.

  • Filter/Exclusion: Exclude files in C:\Users\*\Projects\ or `