PseudoSigner01BorlandDelphi30Anorganix

Hunt Hypothesis

This rule identifies executable files signed with a pseudo-signature associated with Borland Delphi 3.0, a technique often used by threat actors to bypass security controls or blend in with legitimate software. Proactively hunting for these artifacts helps the SOC team detect low-severity, potentially obfuscated malware that may be leveraging outdated or fraudulent code signing to establish a foothold in the environment.

YARA Rule

rule PseudoSigner01BorlandDelphi30Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 90 90 90 90 68 [4] 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Borland Delphi Application Deployment via Group Policy

  • Scenario: IT administrators deploy a legacy internal line-of-business application (e.g., InventoryTracker.exe) built with Borland Delphi 7.0 to user workstations via Group Policy Software Installation. The binary retains the original Borland Delphi version string and lacks a modern Authenticode signature, triggering the “PseudoSigner” heuristic due to the specific compiler metadata and lack of a trusted signer.
  • Filter/Exclusion: Exclude files located in C:\Program Files\InternalApps\ or C:\Program Files (x86)\InternalApps\ where the file name matches *.exe and the PE header contains the Borland Delphi version string. Alternatively, add a GPO-based exclusion for the specific GUID of the software installation package.

• Scheduled Maintenance Job for Legacy Reporting Tool

  • Scenario: A nightly scheduled task (DailyReportGen) executes a 15-year-old reporting utility (ReportEngine.exe) written in Delphi 3.0. This tool runs under the SYSTEM account and is stored in C:\Scripts\Legacy\. The detection rule flags it because the binary is unsigned and contains the specific Anorganix or similar pseudo-signer artifact often found in older Delphi builds that were patched or repackaged by internal QA teams without re-signing.
  • Filter/Exclusion: Exclude the specific path C:\Scripts\Legacy\ReportEngine.exe in the EDR or YARA scanning engine. Ensure the exclusion is scoped to the exact file hash or path to avoid over-excluding the C:\Scripts\ directory.

• Third-Party Plugin for Adobe Acrobat or Office Suite

  • Scenario: A vendor-provided PDF plugin (`AcroDelphi