Malicious Archive / .ZIP — malware analysis report

Static analysis result for SHA-256 c563efab8f609ac3…

MALICIOUS

Archive / .ZIP

11.15 MB First seen: 2026-05-13
MD5: cc9a60f5ac1b3367f981892e6f080ec2 SHA-1: d8c6adfb190fa700618b6e78fb5951f6682fd98b SHA-256: c563efab8f609ac32f12221f74fc984d70068103e5fcfa47b8495a53a7bc1006
64 Risk Score

Malware Insights

The file is a ZIP archive that exceeded its entry limit during scanning, indicating a potentially large or complex archive. It contains a member identified as malicious, which is the primary indicator of compromise. The specific nature of the malicious member could not be further analyzed due to the archive entry limit.

Heuristics 3

  • Archive contains malicious member critical ARCHIVE_CHILD_MALICIOUS
    At least one extracted archive member was classified as malicious. The archive is a transport wrapper for that payload.
  • Archive entry limit reached (50) info ARCHIVE_LIMIT
    Only the first 50 files were scanned.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.pxdmx.in/x/l.php?s=printf_& In document body
    • http://www.pxdmx.in/x/l.php?s=email_&In document body
    • http://www.pxdmx.in/x/l.php?s=gicon_&In document body
    • http://www.pxdmx.in/x/l.php?s=newp_&In document body
    • http://images-dns.com/cfnu2.exeIn document body
    • http://images-dns.com/click.php?r=In document body
    • http://images-dns.com/djnrsy2.exeIn document body
    • http://images-dns.com/agtu2.exeIn document body
    • http://itkornoval.in/x/exe.php?src=&id=890&x=pdf4In document body
    • http://beancountercity.in/cgi-bin/uiq/eH174dcbd7V0100f060006Rf12592d5102T7f61304f201l0019In document body
    • http://busergondermags.com/f2hubba/bgqy3.exeIn document body
    • http://busergondermags.com/f2hubba/defgknoty3.exeIn document body
    • http://busergondermags.com/f2hubba/afu3.exeIn document body
    • http://qjieaicqfir.com/nte/avorp1indep8.py/eU230d9c2eH2b129ab1V0100f060006R5783f090102Td535db50203l000cIn document body
    • http://minutesun.net/cgi-bin/ids.html/n00a106201r0409R76511e5eX9498518aY0276589cZ0100f080In document body
    • http://searchturne.org/cgi-bin/153/n002106203r000cR0b12b9caXdd7b0beeY674b4ebdZ0100f060In document body
    • http://trafficland.in/x/exe.php?src=1513&id=1513&x=pdf1In document body
    • http://trafficland.in/x/exe.php?src=1513&id=1513&x=pdf2In document body
    • http://trafficland.in/x/exe.php?src=1513&id=1513&x=pdf3In document body
    • http://kiaho.info/cgi-bin/login.shtml/z00a106201r1009R07bf0119X54c8d456Y0314b88dZ0100f080In document body
    • http://palliative3678.info/a5z/l.php?i=4In document body
    • http://mysterio.info/cgi-bin/worker/z002106201r0019R11b04a95X49123080Y016855f6Z0100f060In document body
    • http://addvertseense.co.uk/inpu2.exeIn document body
    • http://addvertseense.co.uk/click.php?r=In document body
    • http://addvertseense.co.uk/dflvy2.exeIn document body
    • http://addvertseense.co.uk/eistw2.exeIn document body
    • http://traffic.banners.od.ua:80/p/exe.php?spl=PDFIn document body
    • http://mirroronerofive.com/sleep/ehpv2.exeIn document body
    • http://mirroronerofive.com/sleep/click.php?r=In document body
    • http://mirroronerofive.com/sleep/elmnpr2.exeIn document body
    • http://mirroronerofive.com/sleep/agjtv2.exeIn document body
    • http://fdevkimfncz.com/nte/GOLDMN.exe/yH215aef48V0100f060006Rde9e11c8102Td630b633203l000cIn document body
    • http://google.com.analytics.ajbnmtoacun.com/nte/trest11.py/eH2a43453dV0100f080006R01afc9e0108T967043a8201l000aK0a031cc3In document body
    • http://beancountercity.in/cgi-bin/uiq/eH0a8e2df6V0100f060006R97f3b4e5102T835904b8203l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH715d948dV0100f060006R199f92ea102T21c00dff203l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH42afcd06V0100f060006Rca083bb7102T26567e85203l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH7ebd0cd7V0100f060006R066e59b8102T945067c3201l0019In document body
    • http://jjat.info/as2/l.php?i=4In document body
    • http://estguard.com/cgi-bin/ca7/z002106201r0019R6ff8b4aeXba2cf12eY33f308f5Z0100f060In document body
    • http://beancountercity.in/cgi-bin/uiq/eH443c97ecV0100f060006R7fa1276e106Tfa794dc6203l0019In document body
    • http://visa-network.com/ele/load.php?spl=PDFIn document body
    • http://click-reklama.com/cgi-bin/plt/z002106201r0019Rfc89bc1bXb44d87eeY2910ecbdZ0100f060In document body
    • http://beancountercity.in/cgi-bin/uiq/eH67776997V0100f060006Rb2b3c811102Tbc8e521d201l0019In document body
    • http://basehanpd.info/tre/lena.exe/yH4bb5d68dV03006f36002R502a006f102T44466549J14000601Q00000000901801F0035010al0409In document body
    • http://ajxpeehuvpcv.com/nte/trest1.php/eH68ac7ae6V0100f060006Rbed31eb4105T50bc8a52201l0019Kae986977In document body
    • http://searchleaup.org/cgi-bin/153/n002106203r000cR15db4937X8a4b96dfY7098c1ceZ0100f060In document body
    • http://redkoeebalovo.us/cgi-bin/php/n002106204r0409Xfb281e80Y792c2233In document body
    • http://byfskefe.in/cgi-bin/gjj/n00a102801r0809J11000601R63d1f64eX26f942c3Y1b3da771In document body
    • http://beancountercity.in/cgi-bin/uiq/eH23f46ac9V0100f060006Rfbe69a11102T54316a09201l0019In document body
    • http://gameloss.in/cgi-bin/gyw/z00a102801r0c0aJ11000601R3725690dXf1bef776Y728737d5Z0100f036In document body
    +17 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.