MALICIOUS — Half-Life 2_codes.exe

MALICIOUS — Half-Life 2_codes.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: daef77bc6555e56b5eee99a81ad500cb8ae4ed9d9e9eeecbecf7bd0f594a5081
SHA-1: eadc0cc5e6952b1fe166dc6581827fbf3845ac51
MD5: 7f535b5d4de2614fb2b55b4809c298bd
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw1R:p
TLSH: T1A660D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: Half-Life 2_codes.exe
File type: pe · Size: 3520516 bytes
Verdict: malicious (98/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1062 behavior events · 0 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Windows\win32dc\UT2004(serial).exe - 35af0629a8957baa6a9dc6421bb16f5ba30bb856aac0887f3e2d8fbdf324af75
C:\Windows\win32dc\Quake3 crack.exe - ce4045565cbfa2281de7606851299b447c55b2cfd7e76b344175579e568477d7
C:\Windows\win32dc\BattleField 1942(crack).exe - 8273d0597f009e9ebd9237a50a554cbd547a7f21b817bca00251ea96c91c6eb7
C:\Windows\win32dc\Silent Hill 4 nocd.exe - a1959ba168138805572bb47c06d94273d5d0777de57dcc5568acaa2e81380b2c
C:\Windows\win32dc\Sims 2_fix.exe - 03d2b44017a5056a51e27cdf99159a51df99694d88f4be7ed8c949311bf4ecf6
C:\Windows\win32dc\Half-Life 2(nocd).exe - 2f6f0d84553e6c1e1093f99ab76018c62b025d3f2cc25128027c0aad63a0f670
C:\Windows\win32dc\Doom 3 + cdfix.exe - e405a4c81135c633f1081e91e9624bdd48d6e80fc236ce91c302be2361cd3162
C:\Windows\win32dc\UT2004(codes).exe - f602d09a4977cd4827c3d71abffa8447bca3ca7922482fc3122a94a91854c9f3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787666803&P2=404&P3=2&P4=QA8yq%2b5WMnzChhF4513g0XC7FL%2bbyHD%2fZqRm%2fLSYIui09BRZDGY4V7GArdObXecFHVaE%2bwe4X3qNsSFzGKmifw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787666880&P2=404&P3=2&P4=VRUUGCMPdVW0ufve93qcuQlL4jX70nsQtonlaqkn4HaGa0h%2bC%2fQsKxN76ivqn2DPWla2TxhK62k0bWa5LWGmYA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

us.undernet.org

Embedded IP addresses

52.123.252.245
20.184.175.18
20.184.175.14
74.178.76.128
4.230.171.124
74.178.240.51
85.210.193.152
52.230.60.54
52.123.129.14
20.236.44.162
52.123.128.14
20.50.201.205
203.26.79.13
74.179.77.204
172.178.240.163
74.178.76.44
172.83.156.122
52.148.114.188
72.145.35.99
48.192.143.121
135.234.160.246
92.223.78.30
142.250.195.227
52.110.12.8
52.110.12.24

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report