MALICIOUS — BattleField 1942 fix.exe

MALICIOUS — BattleField 1942 fix.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 8c24a787a95d5edf0e22c758c5e3299e88f6457e5ec289e93a4346459e7d5897
SHA-1: 7dcdbd2eb3da4ad78e31c33244c51b56050fae09
MD5: b202af375f5dec0f0fc3a95a57f7b164
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw1F:t
TLSH: T18560D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: BattleField 1942 fix.exe
File type: pe · Size: 3524612 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7872) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1312 behavior events · 0 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Windows\win32dc\Doom 3(trainer).exe - 79fffb33ee7dfaebf90616dfffe94445fc8253288baeccf1283011e081c85181
C:\Windows\win32dc\BattleField 1942(codes).exe - 49077ba42c4129249b38aa38eb9f9f96370d23d6a7a94a59fe72f2f577b0f138
C:\Windows\win32dc\Half-Life 2(cdfix).exe - 58895fb1c840e81aad7bf46069bf6c25587deac1883540c5cb83eec49f1063c5
C:\Windows\win32dc\Doom 3 codes.exe - a4f5e33ac5fb461cdd6b6cdedb7b1f7c0aa5de8190925c05bd8f62301e08d3b2
C:\Windows\win32dc\Doom 3 + hack.exe - a05e5c85c7d5161e8a6c0595d10cc13f47be86554eaf36844be6288fa226c871
C:\Windows\win32dc\Silent Hill 4 cheat.exe - b788822b0e455bdfd8e2285939d53d2612fe84b26fb32c0498c79756b8fbe2db
C:\Windows\win32dc\Quake3 + patch.exe - 7d065192c6020b46461c6fce5830c734552f49489190a4366978e148457f8606

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787668563&P2=404&P3=2&P4=PI2qHZ6LSbxik%2bqGzDT4fGwyH5i0v6pxFViOypjlWMGpVCBfvlOiolftyh0sX1xxYuUMv6z%2bNp573RvrQJopSA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787668654&P2=404&P3=2&P4=EmG6ziv0kOL5KRjP1ifp1invHjgmIJnP3oBDs2eRZs%2fq4iHglLKJ5pferPgX1vTOn%2fXdVx3wG%2bmnsldB2%2fdz7g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

us.undernet.org

Embedded IP addresses

52.110.12.42
52.110.12.14
52.123.252.242
52.168.117.169
4.230.171.124
52.253.84.76
172.215.188.225
74.179.77.204
20.184.175.21
74.178.240.51
52.123.252.238
20.236.44.162
52.123.128.14
203.26.79.13
135.234.160.246
74.178.232.29
172.83.156.122
52.148.114.188
20.184.175.23
20.184.175.18
72.154.7.109
52.110.12.37
52.110.12.48

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report