MALICIOUS — Half-Life 2(cdfix).exe

MALICIOUS — Half-Life 2(cdfix).exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the HUILoader family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: e3bf6559517180c71d18a3bf29f5c3800e4c257eaeb86ca38bc5fbb811e1d9c0
SHA-1: 816d7d6d9d032f01fdbdd97e0a73652bd56e11be
MD5: 79a4163ecef44c4927cc5ab5ab902e34
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhMSTZM+9m2O7:blN9RkkkkkkTLSBva
TLSH: T1423AD040317A389CD7349F601924584DA16552C28A7D3DDB9B030B2D2D7B8FBB8E8E76
Submitted as: Half-Life 2(cdfix).exe
File type: pe · Size: 100333 bytes
Verdict: malicious (98/100) · Family: HUILoader

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Generic-9908425-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9908425-0 (rule Win.Trojan.Generic-9908425-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

2167 behavior events · 0 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Windows\win32dc\Counter-Strike fix.exe - 02bdd0e74c422ada46999293ea41ea09dfc8d4efaa15b8d836ee366309f9de3e
C:\Windows\win32dc\Quake3_cdfix.exe - 6e8fe49a1a9f01411787fe1a1d8266a5e289bf7ee2ec9837dfab526d81f2b4a0
C:\Windows\win32dc\FlatOut + serial.exe - 840de6e4afe4a15fb7fd2e6ba566df689087903000033d41d22cc316b206e63e
C:\Windows\win32dc\Sims 2(crack).exe - abe88bdea3140819f5147f68a5b76b463bc17d8a5aa3fba98f87655dce0500a5
C:\Windows\win32dc\Counter-Strike(trainer).exe - 06fc1a0c9abae235f4e4c3bb8082804400f97a77c643b1d844bd182ec50d550d
C:\Windows\win32dc\DAoC(serial).exe - db48f8e3aa19b5c455d717e24d64077ba7b8a1bb01e0a96b7e818643bb34265a
C:\Windows\win32dc\Silent Hill 4 patch.exe - 8e11d5d783ab2196b174f6fbb77556a213edbfdd56a17ee1ce8570172fe13d7b
C:\Windows\win32dc\Doom 3 hack.exe - 8bb8ee57ced71f2378ca51f5af88191a94660d871546e7fdf33fb27fc6a02e38

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787644552&P2=404&P3=2&P4=bjSunXy9Ag4EfVOCsmMjKjvD5kE3EKvoldQ1pAr5tVgSo5KejMwJ5z9iAx%2fC18ZiscZcHq58KuLGo1WcoGNdLA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787644636&P2=404&P3=2&P4=G15hm3CKGSOg6gF4H3Vb%2bS2w9F3A%2f5ZqsR3etw9p%2bGilqzOzFQnmFlQy%2fSlFl6UBsIhj2d6LpYjMNbgz9giO0g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

us.undernet.org

Embedded IP addresses

4.207.44.64
20.42.179.192
4.230.171.124
20.247.184.197
135.233.95.144
4.144.132.223
52.168.112.67
40.104.4.2
20.231.239.246
52.123.128.14
52.123.129.14
74.178.76.54
20.52.64.201
13.89.179.15
203.26.79.13
92.223.78.30
135.234.160.244
172.83.156.122
135.232.92.34
52.148.114.188
52.110.12.25
52.110.12.2
72.153.5.129
20.165.94.46
52.110.12.52

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report