Malicious Archive / .ZIP — malware analysis report

Static analysis result for SHA-256 af62659973731586…

MALICIOUS

Archive / .ZIP

10.20 MB First seen: 2026-05-13
MD5: 35a5bc0c10feab5cbb10701537f771af SHA-1: f9195ce68b26c1d71e62c87752387144e78be028 SHA-256: af62659973731586730c830af42095de8c75bd829b92eacd93044b4f33eaf555
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The archive contains a malicious PDF, indicated by the ARCHIVE_CHILD_MALICIOUS heuristic. This PDF likely uses embedded URLs to download a second-stage payload, as suggested by the EMBEDDED_URL heuristic and the numerous unknown-reputation URLs extracted. The archive also reached its entry limit, suggesting a potentially complex or multi-stage infection chain.

Heuristics 3

  • Archive contains malicious member critical ARCHIVE_CHILD_MALICIOUS
    At least one extracted archive member was classified as malicious. The archive is a transport wrapper for that payload.
  • Archive entry limit reached (50) info ARCHIVE_LIMIT
    Only the first 50 files were scanned.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://diaiscjdthr.com/nte/PROX.php/eH1c200e39V0100f060006R83c4b01e102T4e6f8942203l000cKe07c96bd In document body
    • http://beancountercity.in/cgi-bin/uiq/eH7f8cb177V0100f060006R97f3b4e5102Tf22caa39201l0019In document body
    • http://lastyears.info/page/information.html/n00a106201Xd1120e87Y7709db32In document body
    • http://googleinru.in/cgi-bin/etn/z006106201r0019R463e721fXc7bb19f7Y3bf99d6aZ0100f060In document body
    • http://ajxpeehuvpcv.com/nte/TREST1.py/eH36f13139V0100f060006Rcdf695e4102T96bffe69201l0019K1c3345f3In document body
    • http://onnejgt.com/cgi-bin/click3/n002106201r0409X940c47dbY6e0d8559Z0100f070In document body
    • http://rebulkinc.com/cgi-bin/ca7/n002106204r0409R4ee17895Xef8d9d36Y31e88c29In document body
    • http://ajnuocfdrukv.com/nte/trest1.py/eH4f111714V0100f060006Ref6a58b9102Tda36a674201l0019Kefc6bb89In document body
    • http://tanoup.biz/unip/load.phpIn document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019Rccbb2c4aXb47aaa3aY603642a9Z0100f060In document body
    • http://vgeohemef.info/cgi-bin/ae/eH0e035376V0100f060006R428e72bf102T96d0875e201l0019In document body
    • http://ddehkyhddve.com/nte/prox.exe/eH1841a048V0100f060006R83c4b01e102T9a2cde18203l000cK373f37f4In document body
    • http://kjvs.info/ug7/l.php?i=4In document body
    • http://kjvs.info/ug7/l.php?i=5In document body
    • http://qmyzued.info/cgi-bin/login.aspx/z002106201r0409R2057b57cXbc875446Y608caf29Z0100f070In document body
    • http://bm95.kmu.edu.tw/PHPBB3/styles/getexe.php?spl=pdfIn document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R05d373ddXb4b33defY4b7f053eZ0100f060In document body
    • http://botiire.com/info/sun.html/n002106201r0409R43518d0dX74c2c625Y595f9bd7In document body
    • http://qataloq.com/dir/load.php?spl=pdf_expIn document body
    • http://click-reklama.com/cgi-bin/plt/z002106201r0019Rfb0a7510Xbaef4159Y1c46c1d9Z0100f060In document body
    • http://www.nethealthcarego.com/cgi-bin/158/n00220148e87er71adXc1f9295bY55225647In document body
    • http://ajnuocfdrukv.com/nte/trest1%20.asp/eH44a6f25dV0100f060006Rca6a9684102T93b08805201l0019K59926c2bIn document body
    • http://beancountercity.in/cgi-bin/uiq/eH6b0c2f55V0100f060006Refe34b22102Tb18bf711203l0019In document body
    • http://mysterio.info/cgi-bin/worker/z002106201r0019R9347f85cX948991a0Y37311666Z0100f060In document body
    • http://77.92.158.122/webmail/inc/web/load.php?stat=3DWindowsIn document body
    • http://rhjtuuqrmlc.com/nte/PROX.py/yH2377c987V0100f060006Rb33a7f51102Tc5caafa4201l0019In document body
    • http://businessokworld.info/cgi-bin/001/n002106203r000cR71d76445Xd92211caY1cef5d45Z0100f060In document body
    • http://93.174.93.11/~delmonca/u/load.phpIn document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R4f17240dX413cd0f5Y03af4cc8Z0100f060In document body
    • http://addvertseense.co.uk/lnvy2.exeIn document body
    • http://addvertseense.co.uk/click.php?r=In document body
    • http://addvertseense.co.uk/flmt2.exeIn document body
    • http://addvertseense.co.uk/efjt2.exeIn document body
    • http://klirok.net/3/getexe.php?spl=pdf_expIn document body
    • http://legeni.biz/var/l.php?i=16In document body
    • http://geawseeper.com/w/l.php?i=5In document body
    • http://beancountercity.in/cgi-bin/uiq/eH741aeeb5V0100f060006R3c88eeec102T68354e07201l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH5cd92014V0100f060006R4430ff7a102T3b194afa203l0019In document body
    • http://ajxpeehuvpcv.com/nte/trest1.py/eH5ab7a024V0100f060006R507fe6fa102Tdbcfdf65201l0019Kbbc9846cIn document body
    • http://beancountercity.in/cgi-bin/uiq/eH0c53f841V0100f050006Rbd22b3e8105T6da1a35d203l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH2f3dcc88V0100f060006R97f3b4e5102T945f296e201l0019In document body
    • http://microsoft-analytics.info/ll/l.php?i=16In document body
    • http://qepol.info/page/information.html/n003106201r0409Xbcaceb21Y1d5c36dfIn document body
    • http://ns.adobe.com/xdp/In document body
    • http://www.xfa.org/schema/xci/1.0/In document body
    • http://www.xfa.org/schema/xfa-data/1.0/In document body
    • http://www.xfa.org/schema/xfa-form/2.8/In document body
    • http://www.xfa.org/schema/xfa-template/2.5/In document body
    • http://ns.adobe.com/xtd/In document body
    • http://ns.adobe.com/xfdf/In document body

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.