Malicious Archive / .ZIP — malware analysis report

Static analysis result for SHA-256 5c360145f97edea3…

MALICIOUS

Archive / .ZIP

12.86 MB First seen: 2026-05-13
MD5: 371335e948ea268cb68570c6fb6eca82 SHA-1: cc7bcc07b5bc42b7252ee2d2abb8c58a7a213f3e SHA-256: 5c360145f97edea3703194dff9e55761f0a22fe28a6b43add0a8a7dc72cc2aac
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a ZIP archive that contains a malicious PDF file. The PDF likely exploits a vulnerability or uses social engineering to trick the user into executing a payload. Numerous URLs were extracted, suggesting the PDF attempts to download additional malicious content or redirect the user to a compromised site.

Heuristics 3

  • Archive contains malicious member critical ARCHIVE_CHILD_MALICIOUS
    At least one extracted archive member was classified as malicious. The archive is a transport wrapper for that payload.
  • Archive entry limit reached (50) info ARCHIVE_LIMIT
    Only the first 50 files were scanned.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wertionase.com/cache/load.php In document body
    • http://adultxxxblog8.in//load746.php?spl=pdf_expIn document body
    • http://statisticpossibly.com/cgi-bin/009/z002106203r000cR3ae62427Xc065874fY450d50b9Z0100f060In document body
    • http://style-boards.com/forum/dnsx2.exeIn document body
    • http://style-boards.com/forum/click.php?r=In document body
    • http://style-boards.com/forum/gijrvx2.exeIn document body
    • http://style-boards.com/forum/aelm2.exeIn document body
    • http://google.analytics.com.hzlyaejcvmat.info/kav/KAV2.py/eHcb7cfae3V0100f070006R1f73eccc102T80f0c7cf201l0409Kc0d2a4a1In document body
    • http://beancountercity.in/cgi-bin/uiq/eH5f7e16bbV0100f060006R97f3b4e5102T69e2a20d201l0019In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R3fcd0992X95cdae92Y08018528Z0100f060In document body
    • http://beancountercity.in/cgi-bin/uiq/eH010f5339V0100f060006R97f3b4e5102T9aebd85d201l0019In document body
    • http://ajnuocfdrukv.com/nte/TREST1.html/eH6b33aa47V0100f060006Rca476eb0102Tf917a8ff201l0019K3d132ee9In document body
    • http://qbzrfzyudfeo.com/lee/TATRA9.py/eH56df6a02V0100f070006Rd08354e5102Tf8299764201l0409K63516520In document body
    • http://grinchalina4.com/pek/l.php?i=16In document body
    • http://www.hoploawq.com/exe.php?spl=PDF%20(printdIn document body
    • http://www.hoploawq.com/exe.php?spl=PDF%20(EmailInfoIn document body
    • http://www.hoploawq.com/exe.php?spl=PDF%20(util_printfIn document body
    • http://www.hoploawq.com/exe.php?spl=PDF%20(GetIconIn document body
    • http://flshgamer.info/cgi-bin/kln/n002106204r0409Xd1a5b21dY0291c32bIn document body
    • http://geonetsa.com/cgi-bin/ca7/z002106201r0019R8fea1881X9404bb6dY52e4d589Z0100f060In document body
    • http://teamnunda.com/info/getexe.php?spl=pdfIn document body
    • http://xgazz.biz/var/l.php?i=5In document body
    • http://ghjihkvuno.com/nte/trest6/eH1e662482V0100f060006R00000000102T552d13d6201l0409K4b31f9feIn document body
    • http://www.ylwgheakrozn.com/nte/avorp1nov1.py/eU230d9c2eH58d6713cV0100f070006R00000000102T9443b919201l0409K2950521eIn document body
    • http://kjvs.info/ug7/l.php?i=16In document body
    • http://mhjvjcdmtwe.com/nte/TREST2.exe/eH2f818960V0100f060006Reb09ea6f102Te86bfe0a201l0019K4246fff3In document body
    • http://ns2.ratare.com/info/sun.html/n00a106201459r66b3X8fa04d1aY004675bdIn document body
    • http://estguard.com/cgi-bin/ca7/z002106201r0019R3fc02bb2Xb4725043Y578d7681Z0100f060In document body
    • http://adminregion.info/born/egmntvwz3.exeIn document body
    • http://adminregion.info/born/bij3.exeIn document body
    • http://adminregion.info/born/cikox3.exeIn document body
    • http://beancountercity.in/cgi-bin/uiq/eH1753f9aaV0100f060006R1f671b4e102T1aca20ec201l0019In document body
    • http://substance-news.info/style/bijs2.exeIn document body
    • http://substance-news.info/style/click.php?r=In document body
    • http://substance-news.info/style/afhjmx2.exeIn document body
    • http://substance-news.info/style/aimy2.exeIn document body
    • http://lometr.pl/hlp/getexe.php?spl=pdfIn document body
    • http://ajnuocfdrukv.com/nte/TREST1.html/eH7090ce11V0100f060006R87d80615102Tda291710201l0019Kd699c28cIn document body
    • http://xxxsssxxx.biz/ecto/l.php?i=16In document body
    • http://rebulkinc.com/cgi-bin/ca7/n002106201r0019R33a39b67Xd05f15cfY1422320cZ0100f060In document body
    • http://enginesoons.cn//load.php?spl=pdf_expIn document body
    • http://ajnuocfdrukv.com/nte/trest1.exe/eH2cca850bV0100f060006R7185358d102T300a67cc201l0019Ka4a64667In document body
    • http://experimentaltraffic.com/cgi-bin/009/z002106203r000cR466edc59Xb435a88eY425d040eZ0100f060In document body
    • http://gccmimxtuf.com/nte/nov1.py/eH435cbacbV0100f060006Rf82fea65102T0ec5b74f203l000cIn document body
    • http://beancountercity.in/cgi-bin/uiq/eH6797f00bV0100f060006R97f3b4e5106Tbc1528bc201l0019In document body
    • http://erbition.com/info/dat.html/n003106201r0409Xda9e58e9Y5371af49Z0100f080In document body
    • http://nethealthcarego.com/cgi-bin/153/n002106201856r0012Xa09b57b8Y361cc94bIn document body
    • http://lomahhs.net//viewforum.php/43158609347328b7d0553fd62db0c8f7?spl=pdf_2030In document body
    • http://www.xfa.org/schema/xfa-template/2.5/In document body
    • http://ns.adobe.com/xdp/In document body
    +5 more URL(s)
🗂 Part of campaign: adultxxxblog8.in 61 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.