MALICIOUS — BattleField 1942(cheat).exe

MALICIOUS — BattleField 1942(cheat).exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 2093445bb138090f77351f77d14b6fce1eed666c6ea27023c83bd197df2649c6
SHA-1: e39d9b79783fd9a044a1c59c021293509890c8a2
MD5: ba76ea322d7af6abf63c9a1607d98bd3
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw1D:b
TLSH: T16260D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: BattleField 1942(cheat).exe
File type: pe · Size: 3522429 bytes
Verdict: malicious (97/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 97/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Contacted 31 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 6 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

241 behavior events · 0 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Windows\win32dc\Silent Hill 4_fix.exe - 5d6ab14536c307fa5f5d1291a353ff074109d3c2eaefcf08f27c0814db13c046
C:\Windows\win32dc\Quake3_cheat.exe - a6590b2de43b6b3506032b013e10d05c5c8cced2a47116757b71898f7646197a
C:\Windows\win32dc\DAoC_codes.exe - ea281aa511549531bc0603a3be639c706658736e062f07ace863d47d00b6805d
C:\Windows\win32dc\Sims 2(nocd).exe - ad047e9bf8419ca9e84811272aee0c167abaa0a5bad50177b25c0b7714e629bc
C:\Windows\win32dc\Half-Life 2 + fix.exe - 8c0e5c0748a5e3cf2493d0de3aad3f41bead098eaccf690c0b4274b9a22debd4
C:\Windows\win32dc\Silent Hill 4_trainer.exe - 894f1b7c04b79fd241435717c611ba8b8976fabd6b727a3c458bd5a90408d0c5

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded IP addresses

74.178.232.29
20.184.175.8
4.230.171.124
48.211.4.16
4.144.132.114
20.42.179.192
74.179.77.204
74.179.77.164
52.168.117.168
20.231.239.246
72.145.35.100
135.234.160.245
52.110.12.2
52.110.12.38
40.79.167.10
172.66.2.5
203.26.79.13
52.148.114.188
20.42.65.84
92.223.78.30
20.76.201.171
142.250.183.35
135.233.45.221
52.123.252.198
135.233.95.80

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report