MALICIOUS — Silent Hill 4 + codes.exe

MALICIOUS — Silent Hill 4 + codes.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: b2c3b51a2d9000488276f82767a6d81e704cc6c4c0b94cfe517f61758b2c3184
SHA-1: 5073641d151f63cceef80ca8bf64f77bf36bcb18
MD5: b3396b3238c5b4e6b045d3f69af871b3
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw12:e
TLSH: T10E60D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: Silent Hill 4 + codes.exe
File type: pe · Size: 3527568 bytes
Verdict: malicious (98/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1700 behavior events · 0 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Windows\win32dc\Sims 2 cheat.exe - d531dd165742e7703cd90db156126a126c9c07744e3f8a4afdb151c219cd790e
C:\Windows\win32dc\Silent Hill 4 fix.exe - 0716c5a748345955128ec652713fcbcb097e95e3c47258594ae699d93db77a7c
C:\Windows\win32dc\Sims 2 + patch.exe - a388f7ccef1a4846327637f82cf5901468754c254160a05c252c4e2d77fe417e
C:\Windows\win32dc\Half-Life 2(cdfix).exe - b60a89252ea86d20523c810271376822771170e8b09b566bad4640574105396f
C:\Windows\win32dc\Sims 2_serial.exe - b533a2532014c394ca36d64411eaeae4c0bf89817acdf1d40d60dd85f5bbced3
C:\Windows\win32dc\Doom 3_cheat.exe - d9c54b0221f82f5fef72cae98aa6c5beabab213dd8fcfc91a2aecb7d9dc8a644
C:\Windows\win32dc\Counter-Strike_nocd.exe - f9d8f515f05a80d6213d0058e33b376b01b01cc43fb6c12569d05112c7824cc8
C:\Windows\win32dc\Sims 2(crack).exe - e2b1c6f8fccfc46a48dd8f3cb17f4a32298c56a7b7856cf2661d4c55d4465666

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787664136&P2=404&P3=2&P4=aP4XkYCI%2bJZ%2bcazUG8mwYXSyu9jZebagKL16b5%2f7CYrUlTIoTIzCK7%2f%2bjLTIE3V37zwUDm8VUl4Tf0WPvQsy3g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787664224&P2=404&P3=2&P4=NCcAXCyvKX2S6P8gSH%2bzMqiOFsumXWvCvH4ePm5nYecM6%2bXTZM7TbTO15HWX7LixfFH0jwUj5gShbajQWx4Alw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

us.undernet.org

Embedded IP addresses

20.89.1.13
52.253.84.76
40.84.85.40
4.230.171.124
135.232.92.137
74.179.77.164
51.104.15.252
20.231.239.246
40.99.134.18
52.123.129.14
135.233.45.222
52.123.252.241
92.223.78.30
203.26.79.13
172.83.156.122
52.123.252.197
135.233.95.80
52.148.114.188
85.210.193.152
72.145.35.114
52.110.12.5
52.110.12.40

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report