MALICIOUS — Sims 2 + cdfix.exe

MALICIOUS — Sims 2 + cdfix.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 1e66d498a876025d424ecdc781a559eecf6dbef9b7778ce6088bc551eddba0cd
SHA-1: 092e29b3eb1b6af4f2df416c81901453b22fa941
MD5: 615261ab7900ea5deca8ad4d7a52e5f7
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw13:/
TLSH: T17A60D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: Sims 2 + cdfix.exe
File type: pe · Size: 3525520 bytes
Verdict: malicious (98/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 6 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1579 behavior events · 0 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Windows\win32dc\Silent Hill 4(patch).exe - b4cd9303a8f27a0fb7a7062edc09450dba28b5a9d61240b45ad2bbb411e36dc4
C:\Windows\win32dc\Doom 3 cdfix.exe - 9cef08941e4f5ae9276561d6f9ec65ca5f82f074122c60f0e5266828e87324ed
C:\Windows\win32dc\FlatOut_trainer.exe - 54a12fc37db8cf2610fc637391226cdfe49900537bf500abee2535048df2b760
C:\Windows\win32dc\Silent Hill 4 + trainer.exe - 4371aa2774d6c9c752a0263fd74d8fc1db4f6ecffb8c7985a746188d39bc6820
C:\Windows\win32dc\BattleField 1942(patch).exe - 02278c0a53bfd361625acb76b0bd64697fbf7934753d4f003998e5ff666f9e61
C:\Windows\win32dc\Counter-Strike hack.exe - a1dab5e8d2f4fd5773cf19775405d97ea26664645d43e55495267236f754bb08

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787699002&P2=404&P3=2&P4=I47JjUNb6v3%2fI9OJFaE%2fTp57FZN71MBlAan0T1dnd2tmz7trx%2fsSagrIqc0BSujDu1LgurBOewSmKqWQNdvYrQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787699115&P2=404&P3=2&P4=QPItPG8XDDHi78AENFtFFsRJo0tTJeb7Vpq81cCDdFmAOGEBtSI8Tm%2fOPnuJ4v%2fd5yluqbuJKeRPqOcz6X2EHw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

us.undernet.org

Embedded IP addresses

203.26.79.13
4.150.223.113
4.230.171.124
172.215.188.225
4.144.132.223
135.232.92.137
20.165.94.54
4.150.223.107
20.112.250.133
172.66.2.5
52.123.128.14
4.150.223.109
52.110.12.25
52.110.12.46
135.233.45.223
172.83.156.122
52.123.252.238
74.178.232.29
52.123.252.235
52.148.114.188
20.42.73.28
72.153.5.132
52.110.12.10
52.110.12.18

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report