Delf

Category: trojan_generic · Aliases: None known · Sample count (EMBER 2018): 1,727 · Enrichment: hand-curated · Updated: 2026-05-27

Overview

Delf is a generic avclass label applied to malware compiled with Delphi or Borland Pascal, covering many different families that happen to share this development toolchain. Delf detections span trojans, backdoors, info-stealers, and droppers; the label identifies the compiler family rather than a specific malware family.

Frequently Asked Questions

What is Delf?

Delf is a generic avclass label applied to malware compiled with Delphi or Borland Pascal, covering many different families that happen to share this development toolchain. Delf detections span trojans, backdoors, info-stealers, and droppers; the label identifies the compiler family rather than a specific malware family.

How does Delf spread?

Delf is a generic detection name covering many Delphi-compiled trojans distributed through phishing emails, malicious downloads, and bundled installers.

What are the signs of a Delf infection?

Generic trojan signs apply: unexpected outbound connections, unsigned Delphi binaries in startup, and antivirus detections referencing Win32/Delf or Trojan.Delf variants.

What should I do if I think I have Delf on my system?

If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance.

Need help with an active incident? If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance.

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/delf.json

About this catalog

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families extracted from the EMBER 2018 benchmark. The catalog is also published on Hugging Face and Kaggle.