Malicious Archive / .ZIP — malware analysis report

Static analysis result for SHA-256 cc9f17b1156c1e13…

MALICIOUS

Archive / .ZIP

32.19 MB First seen: 2026-05-13
MD5: fa59322a8569b52a81267154334532bf SHA-1: 9386fae6f7c49cfef8e90c09a88e548a27d9e3f0 SHA-256: cc9f17b1156c1e1348ef78c63ca21a0e0a8ec24d606c4250e13e94d55138256b
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The archive exceeded its entry limit, indicating a large number of contained files. One of these members, a PDF, was identified as malicious. Several unknown reputation URLs were extracted, suggesting potential download or redirection activity. The presence of a malicious PDF within an archive strongly implies a spearphishing attachment vector, likely leading to exploitation or further payload delivery.

Heuristics 3

  • Archive contains malicious member critical ARCHIVE_CHILD_MALICIOUS
    At least one extracted archive member was classified as malicious. The archive is a transport wrapper for that payload.
  • Archive entry limit reached (50) info ARCHIVE_LIMIT
    Only the first 50 files were scanned.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.zeustech.net/ In document body
    • http://]hostname[:port]/pathIn document body
    • http://72.9.234.194/~wcnet/images/upl/getexe.php?spl=pdfIn document body
    • http://ajnuocfdrukv.com/nte/trest1.html/eH4116eb59V0100f060006R0990c487102T50bcdfb3201l0019K9449353dIn document body
    • http://ajijpqhathr.com/nte/prox.html/eH69a2b75dV0100f060006R87006a76102T35e81c37203l000cIn document body
    • http://93.174.93.11/~delmonca/u/load.phpIn document body
    • http://www.nethealthcarego.com/cgi-bin/176/n006106201r0019Xc7bec91bY7eb18a69In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R18490a89X54515eadY4702d5cfZ0100f060In document body
    • http://state-ks.net/e/load.php?spl=pdf_newIn document body
    • http://state-ks.net/e/load.php?spl=pdf_packIn document body
    • http://estguard.com/cgi-bin/ca7/z002106201r0019R17465350Xb4bad415Y77d0cabcZ0100f060In document body
    • http://proanalytics.cn/frag2/load.php?e=2In document body
    • http://beancountercity.in/cgi-bin/uiq/eH217d6df4V0100f060006R97f3b4e5102T1488bcdd203l0019In document body
    • http://palosantomare.com/cgi-bin/kln/z002106203r000cRaa421985Xc1748143Y5273d3e0Z0100f060In document body
    • http://01.tacex.in/x/l.php?s=printf_ie&In document body
    • http://01.tacex.in/x/l.php?s=email_ie&In document body
    • http://01.tacex.in/x/l.php?s=gicon_ie&In document body
    • http://01.tacex.in/x/l.php?s=newp_&In document body
    • http://sipypygos.info/cgi-bin/xpa/z002106201r0019Rb29631f6Xd78cde26Y6a89c805Z0100f060In document body
    • http://beancountercity.in/cgi-bin/uiq/eH6339b796V0100f060006Rfbe69a11102Tf2dc94c0201l0019In document body
    • http://findeditors.org/stat/zcdaf2.exeIn document body
    • http://findeditors.org/stat/dhlnw2.exeIn document body
    • http://findeditors.org/stat/hezk2.exeIn document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R97f3b4e5Xb42385b6Y46aacc42Z0100f060In document body
    • http://beancountercity.in/cgi-bin/uiq/eH6d4dc1dbV0100f060006R00000000102T301a72cf201l0019In document body
    • http://palosantomare.com/cgi-bin/kln/z002106203r000cRab1694f9Xc1748143Y74401448Z0100f060In document body
    • http://news.hermison.com/exe.php?spl=PDF%20(printdIn document body
    • http://news.hermison.com/exe.php?spl=PDF%20(EmailInfoIn document body
    • http://news.hermison.com/exe.php?spl=PDF%20(util_printfIn document body
    • http://news.hermison.com/exe.php?spl=PDF%20(GetIconIn document body
    • http://J.ZK/DhPJfIn document body
    • http://J.ZK/DhPJf2In document body
    • http://liaynoxlthr.com/nte/GOLDMN.exe/eH153f99afV0100f060006Rb5ec5077102Td254f74e203l000cIn document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019Red4edc28X96e7c65dY64e7b8c7Z0100f060In document body
    • http://prodgame6.ru/s/file.php?spl=00In document body
    • http://gccmimxtuf.com/nte/nov1.py/eH35b4fd57V0100f060006Rf82fea65102T0ec5b74f203l000cIn document body
    • http://beancountercity.in/cgi-bin/uiq/eH2a6a6d26V0100f060006R55290aec102T3bef8361203l0019In document body
    • http://huil.in/x/exe.php?src=boss&id=bomba&x=pdf4In document body
    • http://adult-xxxvids.com/xxxprivate/getexe.php?spl=pdfIn document body
    • http://networkget.com/cgi-bin/176/n002106201r0019Ra001e36bX0d6b5b10Y7e5fc538Z0100f060In document body
    • http://ajxpeehuvpcv.com/nte/TREST1.php/eH2de8defeV0100f060006R6d3429e9102T37231136201l0019K5f35201eIn document body
    • http://91.216.3.179/xx3/l.php?i=4In document body
    • http://91.216.3.179/xx3/l.php?i=5In document body
    • http://www.apache.org/In document body
    • http://www.xfa.org/schema/xfa-template/2.5/In document body
    • http://ns.adobe.com/xdp/In document body
    • http://www.xfa.org/schema/xci/1.0/In document body
    • http://www.xfa.org/schema/xfa-data/1.0/In document body
    • http://www.xfa.org/schema/xfa-form/2.8/In document body
    • http://ns.adobe.com/xtd/In document body
    +10 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.