Malicious Archive / .ZIP — malware analysis report

Static analysis result for SHA-256 be7abbad517250aa…

MALICIOUS

Archive / .ZIP

10.27 MB First seen: 2026-05-13
MD5: 82f5135cfb29bc06aaf2f3bb3c8b4d73 SHA-1: 7eacc8eea1c57a1eb3aa987dd5a146ac3fddc9d6 SHA-256: be7abbad517250aae1603fb1324fcfa13c8de1dafafb15b8b640d8823e979241
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The archive contains a malicious PDF file, indicated by the ARCHIVE_CHILD_MALICIOUS heuristic. This PDF likely serves as a lure, embedding URLs that point to executable files, suggesting an attempt to download and execute a secondary payload. The presence of multiple suspicious URLs associated with potential malware distribution supports this assessment.

Heuristics 3

  • Archive contains malicious member critical ARCHIVE_CHILD_MALICIOUS
    At least one extracted archive member was classified as malicious. The archive is a transport wrapper for that payload.
  • Archive entry limit reached (50) info ARCHIVE_LIMIT
    Only the first 50 files were scanned.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://addvertseense.co.uk/loqw2.exe In document body
    • http://addvertseense.co.uk/click.php?r=In document body
    • http://addvertseense.co.uk/afjlp2.exeIn document body
    • http://addvertseense.co.uk/binr2.exeIn document body
    • http://click-clicke.com/cgi-bin/plt/n005106201r0019Me296aea1R174ec2acXc72ae409Y3ec9f11cZ0100f060In document body
    • http://jlixup.info/cgi-bin/plt/eH71c7096fV0100f060006Rc61bf0f5102T137d0ba5201l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH1e5eb2adV0100f060006R97f3b4e5102Tbc110da1201l0019In document body
    • http://online358.net/work/load.php?e=3In document body
    • http://efxhifatwe.com/nte/trest7/eH48215e3aV0100f060006R00000000102T58a8888b201l0409Kdecfc6d1In document body
    • http://news.hermison.com/exe.php?spl=PDF%20(printdIn document body
    • http://news.hermison.com/exe.php?spl=PDF%20(EmailInfoIn document body
    • http://news.hermison.com/exe.php?spl=PDF%20(util_printfIn document body
    • http://news.hermison.com/exe.php?spl=PDF%20(GetIconIn document body
    • http://tdscounter1.com/cgi-bin/process/z002102801r0409J01000601R652120e0X6216af06Y78e7fb0aZ0100f020In document body
    • http://kjvs.info/ug7/l.php?i=6In document body
    • http://usfederalreserve.org/mm/load.php?spl=pdf_expIn document body
    • http://ajnuocfdrukv.com/nte/TREST1.py/eH570f4aa4V0100f060006Rf91172c9102T93fe3fde201l0019Ka871d079In document body
    • http://lorenutrop.com//load.php?id=4In document body
    • http://lorenutrop.com//load.php?id=3In document body
    • http://lorenutrop.com//load.php?id=5In document body
    • http://googleinrus.in/cgi-bin/plt/z005106201r0019R6b7378c9X20e85730Y080f3f5bZ01001f50In document body
    • http://109.95.115.36/usasp22/load.phpIn document body
    • http://grasma.com/spl6/load.phpIn document body
    • http://gkiplamin.ru/gla/ajmoqw2.exeIn document body
    • http://gkiplamin.ru/gla/click.php?r=In document body
    • http://gkiplamin.ru/gla/acjopz2.exeIn document body
    • http://gkiplamin.ru/gla/inopvy2.exeIn document body
    • http://ajnuocfdrukv.com/nte/trest1%20.asp/eH10a8153aV0100f060006R060b3f22102T1b3cb712201l0019Kf0e3c8bdIn document body
    • http://ajnuocfdrukv.com/nte/trest1.php/eH6fe41f68V01001f50006R7db610d2106T5e05ab7d201l0019K454a7825In document body
    • http://beancountercity.in/cgi-bin/uiq/eH4f123f38V0100f060006Re2b845b9102T4550ecfd203l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH79412895V0100f060006R2eba1bdc102Tc113c3e3203l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH643e9ee0V0100f060006R69711430106Tc5afa14b201l0019In document body
    • http://ifgfgseithr.com/nte/INDEPHANDLER.html/eU230d9c2eH0bca1f13V0100f060006R7c70b16a102Tbe55d995203l000cIn document body
    • http://beancountercity.in/cgi-bin/uiq/eH392034beV0100f060006R97f3b4e5102Tdd7b4ad4203l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH7124570cV0100f060006R97f3b4e5102T20ed737b201l0019In document body
    • http://cbate.info/cgi-bin/login.html/z002106201r0013R556f7d71Xef4db410Y09402ba9Z0100f070In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019Ra1332e47Xb5ed4deaY07c578b0Z0100f060In document body
    • http://beancountercity.in/cgi-bin/uiq/eH5f8e90eaV0100f060006R97f3b4e5102T50786b1c203l0019In document body
    • http://oyunland.org/fragus/houx2.exeIn document body
    • http://oyunland.org/fragus/click.php?r=In document body
    • http://oyunland.org/fragus/djnsu2.exeIn document body
    • http://oyunland.org/fragus/ghnps2.exeIn document body
    • http://evvjsdd.in/cgi-bin/gjj/n00a102801r0809J11000601R63d1f64eXdbd1a90eY0ea01a4fIn document body
    • http://click-reklama.com/cgi-bin/plt/z002106201r0019R05c813edX9411a716Y06768c97Z0100f060In document body
    • http://click-reklama.com/cgi-bin/plt/z006106201r0019Rcde4cc0eX7bec1b25Y7315d0d1Z0100f060In document body
    • http://googleinru.in/cgi-bin/etn/z006106201r0019R65bb15f5Xc417ac4cY2a41af63Z0100f060In document body
    • http://178.17.162.238/obuoan/l.php?i=5In document body
    • http://storesigma.com/cgi-bin/ids.html/n00a106201r0409X0aa283bbY44b456e0In document body
    • http://beancountercity.in/cgi-bin/uiq/eH5c2cd474V0100f060006R97f3b4e5106Tdf179f7a201l0019In document body
    • http://style-boards.com/forum/cosz2.exeIn document body
    +16 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.