MALICIOUS — Half-Life 2 + cdfix.exe

MALICIOUS — Half-Life 2 + cdfix.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: cfdac88688c586af04c67658419fdf6db337f40c78c6fac38dc90f01efa315d0
SHA-1: 5b6528e46fb80ab95ac5d2ee2d25a778b6c10c1a
MD5: 14db89db321005e1857ccb7c709977d4
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw1M:k
TLSH: T19C60D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: Half-Life 2 + cdfix.exe
File type: pe · Size: 3526597 bytes
Verdict: malicious (98/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1570 behavior events · 0 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Windows\win32dc\Sims 2 + hack.exe - 6181090942bd95d1c4b4a1fc01fdc435ad80dc6b3b3f5c14344161eb30046ffa
C:\Windows\win32dc\FlatOut serial.exe - 63f6be498edce658ecdd670d69804010aac9cd9fbdc6bf94f1e8f407cc64d1c8
C:\Windows\win32dc\Counter-Strike(cheat).exe - 2d2d611454e93418ed8db51bfcc909b42a9f0f1dc79100e756055a1cfa1975a0
C:\Windows\win32dc\Doom 3 + hack.exe - 30b8147ec2718e11e2d5e3194ff6bb7e06b3068c9159af080ac6c3de4e46752a
C:\Windows\win32dc\UT2004(nocd).exe - 1c5c016d37b755ca51473cb3c9dbe46d357cc10ff66ec3543f6c2a1d5476ce62
C:\Windows\win32dc\Doom 3 cheat.exe - 5450c49041f7b453477eb0f3cd91a2cc0f8bc51d34b5a4a6e0d7d1c9d8c4ffe5
C:\Windows\win32dc\FlatOut nocd.exe - d74f6fe2034e139fd6fca4915d5d5a6993455ebc6ea56c000036c1cc2e0bf3ed
C:\Windows\win32dc\BattleField 1942_serial.exe - 89c8a441768b91d3d0e86b2639d21db9c22780ec350e97c84db894e341092f0b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787680715&P2=404&P3=2&P4=EgCb1Us7GoeXm9lzhylI3%2fQW%2b%2fNFDAWSU7N2Sx9IDs25X%2ffnS2QAa17eeRnvQpDoULZToYZiEqZJPZZe1JhlPw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787680793&P2=404&P3=2&P4=Pv5slI1ZvKGPfoxr9SB8ptry6t6%2bwocR3RmenDFyZvBsxTjsQLy5ia5CNOLhaAvqTfomdOIUFFI7Vlce55OAzw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

us.undernet.org

Embedded IP addresses

20.42.65.89
20.247.184.142
57.155.104.224
4.230.171.124
48.211.4.16
74.178.76.128
135.233.95.135
20.76.201.171
52.123.129.14
40.103.64.226
52.178.17.233
20.42.65.90
51.104.15.253
135.234.160.245
162.159.142.9
203.26.79.13
199.71.214.87
20.42.179.192
20.165.94.46
52.148.114.188
72.145.35.99
135.232.92.34
52.110.12.53
52.110.12.47

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report