MALICIOUS — Half-Life 2 + hack.exe

MALICIOUS — Half-Life 2 + hack.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the HUILoader family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8b19007831287b7a13e545d893a06148b86a11a4750d2148973b22e7f11cf70e
SHA-1: dd04aba3710428d9213f2e6545556f04c9051325
MD5: a2a2e72c84f82a791fc3c3a037a54949
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhMSTZM+9m2OR:blN9RkkkkkkTLSBvyJh
TLSH: T18F3BD04071B6388CCB349F511524994C616552C2CA7C3D9B9B030B2D3D778BBB9E8EB6
Submitted as: Half-Life 2 + hack.exe
File type: pe · Size: 105581 bytes
Verdict: malicious (97/100) · Family: HUILoader

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Generic-9908425-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 97/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9908425-0 (rule Win.Trojan.Generic-9908425-0) - engine signal, weight 0.90, confidence 0.95
Contacted 27 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 9 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

302 behavior events · 0 ATT&CK techniques · 9 dropped files.

Dropped files

C:\Windows\win32dc\Doom 3 serial.exe - 0a1b8ce348c2a623e9a536073defa0abe7b1715211505134e5f486951fca27e9
C:\Windows\win32dc\BattleField 1942 + serial.exe - d4b94d50143338c464cbd58c9e76a60b805a6b1c31aacb852092f6d2f225ba93
C:\Windows\win32dc\DAoC patch.exe - 47d04faf9922ea8f975eec628d877e5cceb5d54824c3c788ff5202ed30d12528
C:\Windows\win32dc\UT2004 + crack.exe - 5cab94bbe5d7079ee9d96b17dcad1e11a51014ea3793e696db66502d59f24846
C:\Windows\win32dc\UT2004(cdfix).exe - 088f23cf64f99e478964ffeeebd18d1c2888c6947bdcf833c2d02883e1f5b13f
C:\Windows\win32dc\Half-Life 2_trainer.exe - a695dd467e9aafa5751e79b8ab7a8084f08cfeceb43ce9be08ca37b62c33bcf7
C:\Windows\win32dc\FlatOut patch.exe - 2ecd734de05f982b73c9fb1d36720ebdcd5a367a80521b5e6432ac05e2a46997
C:\Windows\win32dc\Sims 2(patch).exe - a75eab08713549892403218fbf8b95abf698277a1fa8012044c30ec1a7ac11d9
C:\Windows\win32dc\UT2004 + cdfix.exe - 34d4e65d7e9ade93fd4b314e06bde4c2c0a1e36d6421e8bfa21a01161e5aab43

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787644980&P2=404&P3=2&P4=L9drl8GBHA3%2fNvAXlAZRFeNT2z8mJrqMfJJx%2bRC%2ff4xxZxA6rqNkQqz0iBLvo%2fHsc5sI%2bxLOcSdwZHp0ecf%2bMg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787644999&P2=404&P3=2&P4=HWoyIJI74o%2boZl6kesoGwdu7s0XIefTGBJt3EJCfDwvFRLc9ywVw1t%2brYo5WGwhogXLAcJvkK%2fLaWEvsSb8fcQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.165.94.46
20.184.175.18
4.230.171.124
48.211.4.16
20.247.185.124
135.232.92.34
135.233.95.144
4.150.223.102
74.178.76.54
74.178.76.128
52.123.252.238
203.26.79.13
20.76.201.171
52.123.128.14
52.123.129.14
52.123.252.197
135.232.92.137
162.159.142.9
135.233.45.221
52.148.114.188
92.223.78.30
72.154.7.98
135.233.45.222
48.199.12.1
51.104.15.252

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report