Malicious Archive / .ZIP — malware analysis report

Static analysis result for SHA-256 207ec6ecb837c292…

MALICIOUS

Archive / .ZIP

11.48 MB First seen: 2026-05-13
MD5: 6804dfd2d6306500399879a33636d8a5 SHA-1: e6d590efdc2afa5d21bad3bd6e824e964f92333c SHA-256: 207ec6ecb837c292d150bbbe8cde6cc1d19b23bde872cd697bc4ed3dc4e64c21
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a ZIP archive identified as malicious due to containing a malicious PDF file. The archive exceeded its entry limit, indicating a potentially large or complex payload. The embedded PDF likely attempts to exploit vulnerabilities or trick the user into executing malicious code, as suggested by the numerous unknown reputation URLs present. The primary attack vector is likely spearphishing attachment, leading to exploitation for client execution.

Heuristics 3

  • Archive contains malicious member critical ARCHIVE_CHILD_MALICIOUS
    At least one extracted archive member was classified as malicious. The archive is a transport wrapper for that payload.
  • Archive entry limit reached (50) info ARCHIVE_LIMIT
    Only the first 50 files were scanned.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://click-reklama.com/cgi-bin/plt/z002106201r0019R643a0aa8X3f9b6855Y5fd28d95Z0100f060 In document body
    • http://91.216.3.108/fbok/banner.php/006f6137c3adeb1b84f95970f3d81f9f?spl=pdf_30aprIn document body
    • http://occs.kmd.com.tw/KMD/action/load.php?e=2In document body
    • http://ctrel.in/x/l.php?s=printf_ie&&In document body
    • http://ctrel.in/x/l.php?s=email_ie&&In document body
    • http://ctrel.in/x/l.php?s=gicon_ie&&In document body
    • http://ctrel.in/x/l.php?s=newp_&&In document body
    • http://beancountercity.in/cgi-bin/uiq/eH132a0bc1V0100f060006R55290aec102Tf70e7aa3201l0019In document body
    • http://rapportianalitic.in//load.php?id=4In document body
    • http://rapportianalitic.in//load.php?id=3In document body
    • http://rapportianalitic.in//load.php?id=5In document body
    • http://kiso.in/she/p.php?e=8&&In document body
    • http://blackmelisa.com/el/getexe.php?spl=pdfIn document body
    • http://ajnuocfdrukv.com/nte/trest1.php/eH2a1904a6V0100f060006R04fe5173102Tbcaa5dd3201l0019K975b8d6eIn document body
    • http://ahjcwkbathr.com/nte/indep8.exe/eH25d2625fV0100f060006R7fb2c620102T4333dea1203l000cIn document body
    • http://beancountercity.in/cgi-bin/uiq/eH441d8af1V0100f060006R6812cc78102Tb61ac734203l0019In document body
    • http://safdasdf.info/cgi-bin/001/n002106203r000cR6b03454fXfd8e3d4eY253757afZ0100f060In document body
    • http://193.43.134.58/pb1/l.php?i=4In document body
    • http://jetdap.com/info/sun.html/n002106204r0409R059a19e7X2ddda170Y084139f7Z0100f060In document body
    • http://beancountercity.in/cgi-bin/uiq/eH0c02a123V0100f060006R97f3b4e5102T8d82ba4e203l0019In document body
    • http://jgtdirect.com/cgi-bin/click3/n002106201r0409X94125c4bY2ba4e68eZ0100f070In document body
    • http://08.autdh.in/x/l.php?s=printf_ie&&In document body
    • http://08.autdh.in/x/l.php?s=email_ie&&In document body
    • http://08.autdh.in/x/l.php?s=gicon_ie&&In document body
    • http://08.autdh.in/x/l.php?s=newp_&&In document body
    • http://193.43.134.58/pb2/l.php?i=6In document body
    • http://beancountercity.in/cgi-bin/uiq/eH3984b189V0100f060006R3899f746106T02157dc3201l0019In document body
    • http://ufgxhcouncz.com/nte/goldmn.exe/yH28cbf833V0100f060006R47e3948a102Tbb53873e203l000cIn document body
    • http://nedty.info/page/news.php/n002106201r0409Rd60e401dXdb05488cY49f59fafZ0100f070In document body
    • http://beancountercity.in/cgi-bin/uiq/eH7ce8af8dV0100f060006R64d7a175102Tc43a1a80201l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH786ecbfeV0100f060006R962dfba4102Tda13b6da203l0019In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R3da04e14Xb4817a51Y0ae140c6Z0100f060In document body
    • http://click-reklama.com/cgi-bin/plt/z002106201r0019Rf9fc495bXb931cf0bY63243f04Z0100f060In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019Rbb248a07Xe42dea13Y4d2b99f0Z0100f060In document body
    • http://cashcarus.com/news/body.html/n002106204r0409R89bf0c61Xbc4b6eadY3879a944Z0100f060In document body
    • http://huil.in/x/exe.php?src=3Dboss&id=3Dbomba&x=pdf1In document body
    • http://huil.in/x/exe.php?src=3Dboss&id=3Dbomba&x=pdf2In document body
    • http://huil.in/x/exe.php?src=3Dboss&id=3Dbomba&x=pdf3In document body
    • http://tt.cluboz.cn//getexe.php?spl=pdfIn document body
    • http://ajnuocfdrukv.com/nte/trest1%20.asp/eH0e49b44aV0100f060006R79afb3c4102T7db2b54e201l0019K4e2bd9f8In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R75dd5706Xd3fe05c4Y1b9dc56bZ0100f060In document body
    • http://lbsaw.com/cgi-bin/click3/n002106201r0409X94125c57Y1e22b634Z0100f070In document body
    • http://beancountercity.in/cgi-bin/uiq/eH03205242V0100f060006R38a970dd106Tcce3c3b5201l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH3a131cbeV0100f060006R9271e16c102T131112d6203l0019In document body
    • http://megawebs.info/page/news.php/n00a106201r0409R80eddb9cX679a6fedY71ad5caaZ0100f080In document body
    • http://ajnuocfdrukv.com/nte/TREST1%20.asp/eH1e88a39bV0100f060006R6005f40c102Tce68d367201l0019Kcef608f7In document body
    • http://ajxpeehuvpcv.com/nte/TREST1.html/eH3a038a7dV0100f060006R67a5c9cd102Ta74f858c201l0019K90869762In document body
    • http://click-reklama.com/cgi-bin/plt/z002106201r0019Rfa757987Xb41eccd3Y5438ecbfZ0100f060In document body
    • http://ns.adobe.com/xdp/In document body
    • http://www.xfa.org/schema/xci/1.0/In document body
    +5 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.