Malicious Archive / .ZIP — malware analysis report

Static analysis result for SHA-256 1caab23e7a4a759f…

MALICIOUS

Archive / .ZIP

23.70 MB First seen: 2026-05-13
MD5: 707428bf8713fde6a4951178375ce356 SHA-1: 909155ea5852c247bde10eb3750a5271387e6a99 SHA-256: 1caab23e7a4a759f8bd3ea5ee15ef9665d496f33c9bd996219e683a2af3fb465
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The archive file exceeded its entry limit, indicating a large number of contained files. One of these contained files was identified as malicious with a high risk score. This suggests the archive is being used as a container to deliver malicious content, likely through a social engineering lure such as a phishing email.

Heuristics 3

  • Archive contains malicious member critical ARCHIVE_CHILD_MALICIOUS
    At least one extracted archive member was classified as malicious. The archive is a transport wrapper for that payload.
  • Archive entry limit reached (50) info ARCHIVE_LIMIT
    Only the first 50 files were scanned.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://phjuibqpoxk.com/nte/utan.html/yH02f3ba93V0100f060006R138dcef4102T059f8608201l0019 In document body
    • http://chura.pl/hlp/getexe.php?spl=pdfIn document body
    • http://beancountercity.in/cgi-bin/uiq/eH6abc8cbdV0100f060006Ra266e5d1102T411e8834201l0019In document body
    • http://usfederalbanks.org/mm/load.php?spl=pdf_expIn document body
    • http://geonetsa.com/cgi-bin/ca7/z002106201r0019Rb238cf9dX878dbddeY6436679bZ0100f060In document body
    • http://beancountercity.in/cgi-bin/uiq/eH18672bfbV0100f060006Ref827d7a102Tf143cb8d201l0019In document body
    • http://www.bitstream.comIn document body
    • http://ajnuocfdrukv.com/nte/TREST1.exe/eH331bf874V0100f060006R8dcaec54102Td09b8253201l0019K3a372111In document body
    • http://www.mooseroutdoors.com.au/ext/eleo/load.php?spl=pdf_expIn document body
    • http://zupde.com/e/getexe.php?spl=pdfIn document body
    • http://ajnuocfdrukv.com/nte/TREST1.html/eH65c3c19fV0100f060006Rdf839b79102Tbcb102f6201l0019Ka9bf9855In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R77f90eedX3c16258cY55bb05e7Z0100f060In document body
    • http://google.com.analytics.sadfeygscun.com/nte/avorp1trest11.py/eU230d9c2eH09f81f89V0100f070006Rf129df8a102T45139698201l0409Ke05013d1In document body
    • http://estguard.com/cgi-bin/ca7/z002106201r0019R60344482Xd17f8fb4Y4ce2dde4Z0100f060In document body
    • http://beancountercity.in/cgi-bin/uiq/eH014b8682V0100f060006R97f3b4e5106Tbc1df5a2201l0019In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019Rf1b27c4eX6dd5709fY6f2459f6Z0100f060In document body
    • http://liaynoxlthr.com/nte/GNH4.html/eU230d9c2eH3cdb4804V0100f060006R7f4bd47d102Td254f74e203l000cIn document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019Re2305810Xdcc10ae7Y62c2f47fZ0100f060In document body
    • http://wordshappy.com/info/acon.html/n00a106201r1009Xb46910d5Y3d12ce21In document body
    • http://grasma.com/spl6/load.phpIn document body
    • http://3k70.cn/f0/load.php?e=2In document body
    • http://llopos.info/page/information.html/n002106201r0409Xbcaceb21Y272e8968In document body
    • http://kkfsd.info/cgi-bin/mx/n002106201r0409R7f10381bX36b771a3Y214be496Z0100f080In document body
    • http://beancountercity.in/cgi-bin/uiq/eH6afd3394V0100f060006R97f3b4e5102T6c7b7cd0203l0019In document body
    • http://109.95.115.36/usasp/load.phpIn document body
    • http://ajnuocfdrukv.com/nte/TREST1.html/eH0f743c34V0100f060006R42e579d1102Tc74cbcf1201l0019K554f6559In document body
    • http://ajnuocfdrukv.com/nte/trest1.exe/eH59ba4960V0100f060006R6d3429e9102Tbcd466a3201l0019K98836554In document body
    • http://unastatiomask.com/info/nag3.html/n002103801r0409R2d0b805fX235d0bf5Y5578e73cZ40111253In document body
    • http://networkget.com/cgi-bin/176/n002106201r0019Ra001e36bX7a98a121Y189b8babZ0100f060In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019Rd5a4cfaeX380ace9aY08fa49f3Z0100f060In document body
    • http://state-tn.net/e/load.php?spl=pdf_newIn document body
    • http://state-tn.net/e/load.php?spl=pdf_packIn document body
    • http://beancountercity.in/cgi-bin/uiq/eH72832d2fV0100f060006R16ad8707102T7ec70c15203l0019In document body
    • http://www.lnt.eng.br/armacon.htmlIn document body
    • http://www.multcalc.com.br/calcvigas.htmlIn document body
    • http://beancountercity.in/cgi-bin/uiq/eH1cd4f022V0100f060006R97f3b4e5102T807737b9201l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH687a8b62V0100f060006Rd28ed6e0102Tda7ebcfd201l0019In document body
    • http://ns.adobe.com/xdp/In document body
    • http://www.xfa.org/schema/xci/1.0/In document body
    • http://www.xfa.org/schema/xfa-template/2.5/In document body
    • http://www.xfa.org/schema/xfa-data/1.0/In document body
    • http://www.xfa.org/schema/xfa-form/2.8/In document body
    • http://ns.adobe.com/xtd/In document body
    • http://ns.adobe.com/xfdf/In document body
    • http://www.xfa.org/schema/xci/3.0/In document body
    • http://www.xfa.org/schema/xfa-template/3.0/In document body
    • http://www.xfa.org/schema/xfa-template/2.8/In document body
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document body
    • http://ns.adobe.com/pdf/1.3/In document body
    • http://ns.adobe.com/xap/1.0/In document body
    +6 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.