Malicious Archive / .ZIP — malware analysis report

Static analysis result for SHA-256 b967bb1a9f00bbd2…

MALICIOUS

Archive / .ZIP

26.93 MB First seen: 2026-05-13
MD5: 92f4b92da92c918b6ecf1012b6db5baa SHA-1: 377d588550716963d68930a009d6f37bd8786cdf SHA-256: b967bb1a9f00bbd2749a92306e7d59a647faf5c7e9e88ce215fda733ae573b7c
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a ZIP archive that contains a malicious PDF file. Several URLs extracted from the archive are associated with unknown or malicious reputations, suggesting they are used for command and control or to download further payloads. The presence of a malicious PDF within the archive indicates a multi-stage attack, likely initiated by a spearphishing attachment.

Heuristics 3

  • Archive contains malicious member critical ARCHIVE_CHILD_MALICIOUS
    At least one extracted archive member was classified as malicious. The archive is a transport wrapper for that payload.
  • Archive entry limit reached (50) info ARCHIVE_LIMIT
    Only the first 50 files were scanned.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://experimentaltraffic.com/cgi-bin/009/z002106203r000cR3ae62427X44603f9eY7e298780Z0100f060 In document body
    • http://87.118.81.150/pek/l.php?i=4In document body
    • http://ldeqkkmloxk.com/nte/PROX.php/yH8cee2dfbV0100f060006R87006a76102Tc0febd6c203l000cIn document body
    • http://beancountercity.in/cgi-bin/uiq/eH33354b10V0100f070006Rb6e5a28a102Td4c85c05203l0019In document body
    • http://searchfunes.org/cgi-bin/153/n002106203r000cR178b7423Xc055a087Y4fdb59dfZ0100f060In document body
    • http://googleinru.in/cgi-bin/etn/z006106201r0019R249ce056Xdf336a64Y238c9871Z01001f50In document body
    • http://journalcubesite.com/news/march.html/n00a106201X62f6a25dY2d3edce0In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R97f3b4e5X9acb0418Y6445a7a5Z0100f060In document body
    • http://analytics-google.net/st/l.php?i=4In document body
    • http://analytics-google.net/st/l.php?i=5In document body
    • http://beancountercity.in/cgi-bin/uiq/eH0ee71a39V0100f060006Rf0a5a583102T94f1b0e7201l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH024facc0V0100f060006Red8e7a14102T155aa3e3203l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH096333b0V0100f060006Ra266e5d1102Tbcf22723201l0019In document body
    • http://mghvegumthr.com/nte/PROX%20.asp/eH5e2589f4V0100f060006R87006a76102Tbc585819203l000cK0be2f2b6In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R97f3b4e5Xbc7fa83dY794960afZ0100f060In document body
    • http://ajnuocfdrukv.com/nte/trest1.py/eH0e008ca8V0100f060006R04a05c22102Td343e6a2201l0019K5663321bIn document body
    • http://searchleaup.org/cgi-bin/153/n002106203r000cR0b12b9caX8a4f8dc8Y26077bdbZ0100f060In document body
    • http://qabaqbyqthr.com/nte/GNH4.py/eU230d9c2eH0b26b524V0100f060006Re898a4e4102Tcc72ea16203l000cKab454f40In document body
    • http://vbcveeuvthr.com/nte/goldmn.exe/eH39b2019eV0100f060006R6d9ac9a6102Tbe55ebee203l000cIn document body
    • http://click-reklama.com/cgi-bin/plt/z002106201r0019R0cbcf01eXb4098f55Y3388a9b2Z0100f060In document body
    • http://phjuibqpoxk.com/nte/utan.exe/yH51e3cc5cV0100f060006R95b6ddd7102Tc1371e8f201l0019In document body
    • http://wweerr.cz.cc/as/viewforum.php/195d0bde05d9c5c29d1670339464e181?spl=pdf_13In document body
    • http://ahjcwkbathr.com/nte/GNH4.php/eU230d9c2eH34ee621dV0100f060006R63e3ac3e102T43327901203l000cIn document body
    • http://193.43.134.58/pb1/l.php?i=5In document body
    • http://esli.tw/1/load.php?e=3In document body
    • http://grasma.com/spl6/load.phpIn document body
    • http://www.zeustech.net/In document body
    • http://]hostname[:port]/pathIn document body
    • http://ajijpqhathr.com/nte/goldmn.py/eH6b269912V0100f070006R09be76dd102T9b4faf48201l0809In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R11919e02X38bbd3f8Y7aadbc51Z0100f060In document body
    • http://ajxpeehuvpcv.com/nte/TREST1.html/eH202d6205V0100f060006R5cf50aa8102Td39f0527201l0019K17e51d1bIn document body
    • http://zenergieconseil.com/uploads/1/3/0/4/130477890/2778718.pdfIn document body
    • http://mypartypro.net/uploads/1/3/0/2/130289813/serefomebudeson-mafavamuv-ritiwigam.pdfIn document body
    • http://preparingforaction.org/uploads/1/3/0/4/130436068/kulizogesi_lusimixawobuke_vogarodowakurup_nawegumudeva.pdfIn document body
    • http://rexrussolaw.com/uploads/1/3/0/6/130639757/vusasopifonorus.pdfIn document body
    • http://minatangoboutique.com/uploads/1/3/0/5/130543877/53c9eb2fb1b.pdfIn document body
    • http://montessorilawrence.org/uploads/1/3/0/6/130639840/130639840.html#node+js+book+pdfIn document body
    • http://rebulkinc.com/cgi-bin/ca7/z002106201r0019R787a5999Xf718fe3aY519c0c04Z0100f060In document body
    • http://J.NgVP/.fJIn document body
    • http://djmx.info/page/information.html/n002106203r000cXc612fd84Y011778fcIn document body
    • http://ns.adobe.com/xdp/In document body
    • http://www.xfa.org/schema/xci/1.0/In document body
    • http://www.xfa.org/schema/xfa-template/2.5/In document body
    • http://ns.adobe.com/xtd/In document body
    • http://www.xfa.org/schema/xfa-data/1.0/In document body
    • http://ns.adobe.com/xfdf/In document body
    • http://www.xfa.org/schema/xfa-form/2.8/In document body
    • http://www.iec.chIn document body
    • http://www.tcpdf.orgIn document body
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document body
    +9 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.