Malicious Archive / .ZIP — malware analysis report

Static analysis result for SHA-256 72876f5c6811bb01…

MALICIOUS

Archive / .ZIP

43.09 MB First seen: 2026-05-13
MD5: 8dbab245a15f8fda47b4899bf17813f0 SHA-1: d802ede906fb19c4185fa1b088d95168ddf21403 SHA-256: 72876f5c6811bb0116ccd4361ae9b27b81230ce96a4e6d49be89e02e7c0204f3
64 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The primary finding is a malicious PDF embedded within a ZIP archive, identified as exploiting CVE-2011-2462. This exploit is known to facilitate client-side execution of arbitrary code. The PDF likely attempts to download and execute a secondary payload from one of the unknown reputation URLs. The archive structure and the embedded malicious PDF strongly suggest this is a spearphishing attachment.

Heuristics 3

  • Archive contains malicious member critical ARCHIVE_CHILD_MALICIOUS
    At least one extracted archive member was classified as malicious. The archive is a transport wrapper for that payload.
  • Archive entry limit reached (50) info ARCHIVE_LIMIT
    Only the first 50 files were scanned.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bagsevn.info/tre/LENA.html/yHd0bcd291V0100f090006R0000000010aT9c45e4d5201l0809329 In document body
    • http://beancountercity.in/cgi-bin/uiq/eH78dd1a36V0100f060006R97f3b4e5102T6a315b4f203l0019In document body
    • http://diaiscjdthr.com/nte/indephandler.html/eU230d9c2eH7b212191V0100f060006Rdedb4260102T4e60eadf203l000cKd9f4e1a4In document body
    • http://bibi137.webhosting.com.ua/bl2//download_file.php?e=Adobe-80-2010-0188��In document body
    • http://diamondbagline.com/ele/load.php?spl=pdf_expIn document body
    • http://online-counter.cn/stats/211/loadpdf.phpIn document body
    • http://soulcaferestaurant.com/content/aza.html/n002106201Xd0c583bbY60e84a00In document body
    • http://trsaero.com/cgi-bin/001/n002106203r0409R5b582482X49364bdcY01b77fc5In document body
    • http://geawseeper.com/w/l.php?i=4In document body
    • http://geonetsa.com/cgi-bin/ca7/z002106201r0019Rffed1eefXd97936feY5d721693Z0100f060In document body
    • http://www.greenlpl.com/exe.php?spl=PDF%20(printdIn document body
    • http://www.greenlpl.com/exe.php?spl=PDF%20(EmailInfoIn document body
    • http://www.greenlpl.com/exe.php?spl=PDF%20(util_printfIn document body
    • http://www.greenlpl.com/exe.php?spl=PDF%20(GetIconIn document body
    • http://K.egh/4In document body
    • http://www.bitstream.comIn document body
    • http://aghveruathr.com/nte/indephandler.exe/eU230d9c2eH4f2cbdeaV0100f060006R9d5a0bdc102Tda444a66203l000cIn document body
    • http://ajnuocfdrukv.com/nte/TREST1.exe/eH58cb2e01V0100f060006R746fedfc102Tc0978bbb201l0019Kde02fbc8In document body
    • http://qmyzued.info/cgi-bin/login.aspx/z002106201r0409R50f6a9d4Xb4b6666eY7acc8815Z0100f070In document body
    • http://webgetwise.com/cgi-bin/176/n002106201r0019Ra001e36bX9496eefeY4727314fZ0100f060In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R5f0bac44Xbc4374a9Y12913501Z0100f060In document body
    • http://bagsevn.info/tre/lena.php/yHef7fdd75V0100f070006R00000000102Ta385e159201l0409329In document body
    • http://beancountercity.in/cgi-bin/uiq/eH0b60e0a5V0100f060006R2897f598102Tf21efc56203l0019In document body
    • http://qghgixfqthr.com/nte/GNH4.exe/eU230d9c2eH37a7d592V0100f060006Rf877e361102Td100f97d203l000cK291d16b6In document body
    • http://bagsevn.info/tre/lena.php/yH01718a24V03f01236002R2ef1b8d1102T4d8bb600Q000002fe901801F0020000aJ14000601l0409329In document body
    • http://77.78.240.89/xx3/l.php?i=8In document body
    • http://gwen.broken-road.com/fanlistings/actors/f/load.phpIn document body
    • http://frjfLJTsZMt.elGABcdYg/F41BIn document body
    • http://93.174.93.11/~delmonca/u/load.phpIn document body
    • http://besazex.info/page/news.php/n002106201r0409Rb470cb79Xd7fd25b2Y05bae5f2Z0100f080In document body
    • http://neevia.comIn document body
    • http://09.2.03.00.17820.937.22.login-court-verification-secured-asp-info-court-order.adobe.verification.login.curety.com/98/u889iuoio0000111/In document body
    • http://pderkyhpgdw.com/nte/GOLDMN.html/yH99ff6f8eV0100f060006R06242da7102Td4fc82be203l000c329In document body
    • http://ajxpeehuvpcv.com/nte/trest1.py/eH6e34a5b8V0100f060006R98e51d2b102Tc7a4f62f201l0019Kc8e5aed2In document body
    • http://tommaherinc.info/exe.phpIn document body
    • http://beancountercity.in/cgi-bin/uiq/eH4629ec75V0100f060006R18b17df4102Tfa72693f203l0019In document body
    • http://pbcplifpgdw.com/nte/goldmn.asp/yHdf91a600V0100f060006R06242da7102T929633c0203l000c329In document body
    • http://qghtdopqoxk.com/nte/utan.php/yH0ea52705V0100f060006Rd4e569f0102Tc0fc475f203l000cIn document body
    • http://www.xfa.org/schema/xfa-template/2.5/In document body
    • http://ns.adobe.com/xdp/In document body
    • http://www.xfa.org/schema/xci/1.0/In document body
    • http://ns.adobe.com/xtd/In document body
    • http://www.xfa.org/schema/xfa-data/1.0/In document body
    • http://ns.adobe.com/xfdf/In document body
    • http://www.xfa.org/schema/xfa-form/2.8/In document body
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document body
    • http://ns.adobe.com/iX/1.0/In document body
    • http://ns.adobe.com/pdf/1.3/In document body
    • http://ns.adobe.com/xap/1.0/In document body
    • http://ns.adobe.com/xap/1.0/mm/In document body
    +21 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.