Malicious Archive / .ZIP — malware analysis report

Static analysis result for SHA-256 2e4ad204e3b2096c…

MALICIOUS

Archive / .ZIP

31.41 MB First seen: 2026-05-13
MD5: 574a253557c81144c6ee7a92ca663341 SHA-1: 64f3d6e007779bba485fe4584075cc358a7e60d4 SHA-256: 2e4ad204e3b2096cf35380f5d1e9e4f5c48c3fccb536ed3912ef16d5d7bf919c
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a ZIP archive identified as malicious due to containing a malicious PDF file. Several unknown URLs were extracted, suggesting a potential download or redirection chain. The presence of a malicious PDF within the archive indicates it was likely intended to be delivered as a spearphishing attachment to trick the recipient into opening the PDF.

Heuristics 3

  • Archive contains malicious member critical ARCHIVE_CHILD_MALICIOUS
    At least one extracted archive member was classified as malicious. The archive is a transport wrapper for that payload.
  • Archive entry limit reached (50) info ARCHIVE_LIMIT
    Only the first 50 files were scanned.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://palosantomare.com/cgi-bin/kln/z002106203r000cRb2f956dfXc1748143Y0c3f1900Z0100f060 In document body
    • http://asewety.info/page/news.php/n00a106201r0409Rc263a7b7Xbb86078bY7656595fZ0100f070In document body
    • http://free.1ci1.com/load.phpIn document body
    • http://91.201.196.100/sples/load.phpIn document body
    • http://jgthome.com/cgi-bin/click3/n002106201r0409X94125c49Y4737728dZ0100f070In document body
    • https://skbizcorp.com/js/frk/dropbox/spacebox/index.htmlIn document body
    • http://ocsp.verisign.com0In document body
    • http://ocsp.verisign.com01In document body
    • http://www.monotypeimaging.com/In document body
    • http://style-boards.com/forum/bcgino2.exeIn document body
    • http://style-boards.com/forum/click.php?r=In document body
    • http://style-boards.com/forum/abcpuw2.exeIn document body
    • http://style-boards.com/forum/dirx2.exeIn document body
    • http://trafo-ix02.in/qWEdw/load.php?spl=pdf_2020In document body
    • http://ajnuocfdrukv.com/nte/trest1.py/eH2762975fV0100f060006Rcb5a17f6102T8c9daefc201l0019K392701ffIn document body
    • http://beancountercity.in/cgi-bin/uiq/eH601a1f99V0100f060006Red7760b5102T770d2cad201l0019In document body
    • http://scdipvbsmcp.com/w.php?f=26&e=5In document body
    • http://lindaritchies.com//banner.php?spl=pdf_2013In document body
    • http://pornognomik.ru/romantic/load.php?e=2In document body
    • http://beancountercity.in/cgi-bin/uiq/eH2be7ccefV01001f50006Rdf7ba419106Td2ecd6de201l0019In document body
    • http://click-reklama.com/cgi-bin/plt/z002106201r0019R265d5e47Xbc4d973dY03097e69Z0100f060In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019Rc77ee0dbX94c61b72Y78206e3bZ0100f060In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R2504a6b3Xa6b34a23Y3623b129Z0100f060In document body
    • http://allegiantcare.com/w.php?f=16&e=3In document body
    • https://www.yalovio.com/ald/crypt/index.htmlIn document body
    • https://pdfcrowd.com/doc/api/?ref=pdfIn document body
    • https://pdfcrowd.com/?ref=pdfIn document body
    • http://www.monotype.comMonotypeIn document body
    • http://www.monotype.comHowardIn document body
    • http://www.ascendercorp.com/In document body
    • http://www.ascendercorp.com/typedesigners.htmlIn document body
    • http://lo.dep.lt/info/us1.html/n002102801r0409J11000601R18ad2bacX3eeb054fY1e5440e1Z03003f36In document body
    • http://jlixup.info/cgi-bin/plt/eH02ea28acV0100f060006R845ca258102Td8ed707e201l0019In document body
    • http://oyunland.org/fragus/adkq2.exeIn document body
    • http://oyunland.org/fragus/click.php?r=In document body
    • http://oyunland.org/fragus/acdpt2.exeIn document body
    • http://oyunland.org/fragus/gouv2.exeIn document body
    • http://ajxpeehuvpcv.com/nte/TREST1%20.asp/eH670068f4V0100f060006Ref6a58b9102Tb4d8f780201l0019K8680605fIn document body
    • http://crailind34.info/nte/ros.html/eH5acd4dcbV0100f070006R45a2c145102Td3c01abc201l0804In document body
    • http://beancountercity.in/cgi-bin/uiq/eH43bb8cb2V0100f060006Rba48a7b2102T67e3d20b201l0019In document body
    • http://phjuibqpoxk.com/nte/proxIn document body
    • http://www.microsoft.org/schema/xci/2.6/In document body
    • http://www.microsoft.org/schema/xffdsa-template/2f/In document body
    • http://bryhw.in/x/l.php?s=printf_ie&&In document body
    • http://bryhw.in/x/l.php?s=email_ie&&In document body
    • http://bryhw.in/x/l.php?s=gicon_ie&&In document body
    • http://bryhw.in/x/l.php?s=newp_&&In document body
    • http://www.bitstream.comIn document body
    • http://www.zeustech.net/In document body
    • http://]hostname[:port]/pathIn document body
    +46 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.