Malicious Archive / .ZIP — malware analysis report

Static analysis result for SHA-256 1afcc261f672b12d…

MALICIOUS

Archive / .ZIP

10.81 MB First seen: 2026-05-13
MD5: 375afae464276a8d448c5af43414181c SHA-1: 738deaea8630d48554207359ed6559be4e2f1939 SHA-256: 1afcc261f672b12dc79f211ca33e57c385efbadd148351ebed6e224cb3bb93d0
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The archive contains a malicious PDF, indicated by the ARCHIVE_CHILD_MALICIOUS heuristic. Several unknown URLs were extracted, suggesting a potential phishing or scam attempt. The embedded URL heuristic further supports that the document body contains links intended to direct the user to malicious sites. The presence of a malicious PDF within an archive strongly suggests it was delivered as a spearphishing attachment.

Heuristics 3

  • Archive contains malicious member critical ARCHIVE_CHILD_MALICIOUS
    At least one extracted archive member was classified as malicious. The archive is a transport wrapper for that payload.
  • Archive entry limit reached (50) info ARCHIVE_LIMIT
    Only the first 50 files were scanned.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://flshgamer.info/cgi-bin/kln/n002106203r000cR871ee3f1X15ef324aY0c895738Z0100f060 In document body
    • http://estguard.com/cgi-bin/ca7/z006106201r0019R5f9da700Xc788a028Y7b57924eZ0100f060In document body
    • http://ajnuocfdrukv.com/nte/trest1.py/eH43610b62V0100f060006R0eb223d6102Ta46cd4d9201l0019Kddf6eef0In document body
    • http://beancountercity.in/cgi-bin/uiq/eH41e476adV0100f060006R338f3551102T94630100201l0019In document body
    • http://networksportsgo.com/cgi-bin/153/n002106203r000cXc0dd2cd1Y5af98391Z0100f060In document body
    • http://beancountercity.in/cgi-bin/uiq/eH29fad7b0V0100f060006R97f3b4e5102Tb46d1eb1201l0019In document body
    • http://click-reklama.com/cgi-bin/plt/z002106201r0019R2b13dea0X6e03a049Y69b78292Z0100f060In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019Rd5a4cfaeX380ace9aY08fa49f3Z0100f060In document body
    • http://alegremente.com//qYNB0hR4A-l.php/4b37d241217f3c86ed8d2246dbd1a4ff?spl=pdf_2025In document body
    • http://gafreet.com/r/l.php?i=5In document body
    • http://vburivaly.info/cgi-bin/login.aspx/z00a106201r001dRe4e414f8Xb45a4c4cY4dc9052eZ0100f080In document body
    • http://beancountercity.in/cgi-bin/uiq/eH1e58828fV0100f060006Rcc7ca003102Tc11d6069203l0019In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R7b84c35eX945c0062Y1baec76fZ0100f060In document body
    • http://93.174.93.11/~delmonca/u/load.phpIn document body
    • http://gysoik.com/info/tele.html/n003106201r0409Rf3ef3275Xc19db696Y76e68c4fZ0100f080In document body
    • http://beancountercity.in/cgi-bin/uiq/eH0cae61c6V0100f060006R97f3b4e5102T8d76a05a203l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH6fb6a0ceV0100f060006R8125a41d102T4a519630203l0019In document body
    • http://video.k0x.in/cgi-bin/static.aspx/n002106201r0409Xc75f7800Y60aa218fIn document body
    • http://rebulkinc.com/cgi-bin/ca7/z002106201r0019R849c2690Xd56ffc79Y784ca648Z0100f060In document body
    • http://googleinru.in/cgi-bin/etn/z006106201r0019Rc1ea0838X6c5d6f67Y2a936aceZ01001f50In document body
    • http://ghjihkvuno.com/nte/indep/eH1e662482V0100f060006R00000000102T552d1d5f201l0409K240c3623In document body
    • http://ajxpeehuvpcv.com/nte/TREST1.py/eH5173cdbfV0100f060006Rdf839b79102Tc4bac528201l0019Kac7f564cIn document body
    • http://mobisexonline.com/new/post.php?e=8&&In document body
    • http://beancountercity.in/cgi-bin/uiq/eH6ebc8e83V0100f060006Rda313542102T997d92a1203l0019In document body
    • http://pipisechka.com/sleep/ehlmn2.exeIn document body
    • http://pipisechka.com/sleep/click.php?r=In document body
    • http://pipisechka.com/sleep/cdgjwx2.exeIn document body
    • http://pipisechka.com/sleep/hkqrsu2.exeIn document body
    • http://n-pills.com/n_p/getexe.php?spl=pdfIn document body
    • http://ajxpeehuvpcv.com/nte/TREST1.html/eH2a3c1d56V0100f060006R499ad219102T6f68dcf0201l0019Ked1e1f03In document body
    • http://frJ2D6RMt.elihforV/6LcIn document body
    • http://rfrfrf.com/hd/l.php?i=6In document body
    • http://microsoft-analytics.info/ll/l.php?i=6In document body
    • http://otokio.info/cgi-bin/login.html/z002106201r0409Rb93e71c0Xb4e4d531Y3fd5decfZ0100f070In document body
    • http://hdewptwhdve.com/nte/AVORP1AABBCC.py/eU230d9c2eH30bc4c83V0100f060006Ra396da17102T5f4e8b8d201l0019K7d6a2d49In document body
    • http://jlixup.info/cgi-bin/plt/eH02ea28acV0100f060006R845ca258102Td8ed707e201l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH6de10edeV0100f060006Rbbf91b4f102Tdb309e01203l0019In document body
    • http://oooowor.com/stat/load.php?spl=pdf_2012In document body
    • http://beancountercity.in/cgi-bin/uiq/eH6afd3394V0100f060006R97f3b4e5102T6c7b7cd0203l0019In document body
    • http://ad.ez.lv/info/us1.html/n002106201r0809R22c89a78Xbc04ff8dY409f6be3Z0100f080In document body
    • http://www.xfa.org/schema/xfa-template/2.5/In document body
    • http://ns.adobe.com/xdp/In document body
    • http://www.xfa.org/schema/xci/1.0/In document body
    • http://www.xfa.org/schema/xfa-data/1.0/In document body
    • http://www.xfa.org/schema/xfa-form/2.8/In document body
    • http://ns.adobe.com/xtd/In document body
    • http://ns.adobe.com/xfdf/In document body
    • http://ns.adobe.com/xap/1.0/In document body
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document body
    • http://purl.org/dc/elements/1.1/In document body
    +4 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.