Malicious Archive / .ZIP — malware analysis report

Static analysis result for SHA-256 fd94e76ad953daa3…

MALICIOUS

Archive / .ZIP

12.50 MB First seen: 2026-05-13
MD5: 5942e0bd15ecd25eac5223e9f40f0f36 SHA-1: fa87023b7a0e0333a1e886e283cc3e76ad5ab894 SHA-256: fd94e76ad953daa3928c17954ff178a8631ef3cacdf3fd523ba5b405bce4530f
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a ZIP archive that contains a malicious PDF file. The PDF likely exploits a vulnerability to download and execute a second-stage payload from one of the numerous suspicious URLs found within the archive. The presence of a malicious member within the archive and the numerous unknown reputation URLs strongly indicate a malicious intent.

Heuristics 3

  • Archive contains malicious member critical ARCHIVE_CHILD_MALICIOUS
    At least one extracted archive member was classified as malicious. The archive is a transport wrapper for that payload.
  • Archive entry limit reached (50) info ARCHIVE_LIMIT
    Only the first 50 files were scanned.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://beancountercity.in/cgi-bin/uiq/eH33354b10V0100f070006Rb6e5a28a102Td4c85c05203l0019 In document body
    • http://searchturne.org/cgi-bin/153/n002106203r000cR0b12b9caXdd4477e2Y6fb00630Z0100f060In document body
    • http://homesiteuk.com//load.php?spl=pdf_0dayIn document body
    • http://homesiteuk.com//load.php?spl=pdf_packIn document body
    • http://palosantomare.com/cgi-bin/kln/z002106203r000cRab1694f9X32ba6ce1Y6a30802fZ0100f060In document body
    • http://beancountercity.in/cgi-bin/uiq/eH7ba2bb91V0100f060006R638feeab106Tdd8aaa97201l0019In document body
    • http://seppx.in/x/l.php?s=printf_ie&&In document body
    • http://seppx.in/x/l.php?s=email_ie&&In document body
    • http://seppx.in/x/l.php?s=gicon_ie&&In document body
    • http://seppx.in/x/l.php?s=newp_&&In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019Ra1332e47Xb481cd51Y05daaa23Z0100f060In document body
    • http://ifgfgseithr.com/nte/INDEPHANDLER.php/eU230d9c2eH7de13cdaV0100f060006R7c70b16a102Tbe55d9ea203l000cIn document body
    • http://kopwe.info/page/hotweb.php/n00a102801r0409J14000601Ra646c2d6X0cbebb0bY4d7525a8Z03003f36In document body
    • http://beancountercity.in/cgi-bin/uiq/eH7adc7d0aV0100f060006R59dc2915102Tc03bb558203l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH23c7a86dV0100f060006R97f3b4e5106Td57b5ed5201l0019In document body
    • http://193.43.134.58/pb3/l.php?i=16In document body
    • http://gripioro.info/page/index/n002106201r0409R327cdf3bXd155b2baY4da061fbIn document body
    • http://beancountercity.in/cgi-bin/uiq/eH3837558bV0100f060006R97f3b4e5102T1f1a2a25201l0019In document body
    • http://ajxpeehuvpcv.com/nte/trest1.php/eH177f268bV0100f055006R78c8ab65105Td0dd5dac201l0019Kcab99e6dIn document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R01460fe9X96a56a3bY257307cfZ0100f060In document body
    • http://gaysex365.com/st/css/z/ex.php?h=ex1In document body
    • http://experimentaltraffic.com/cgi-bin/009/z002106203r000cR947fcdfbXb4351258Y2df2376fZ0100f060In document body
    • http://beancountercity.in/cgi-bin/uiq/eH7ed8fcfcV0100f060006Rf1353584102T35c38caf203l0019In document body
    • http://beancountercity.in/cgi-bin/uiq/eH52d108caV0100f060006Refe34b22102T7787f862203l0019In document body
    • http://zapot.info/page/hotweb.php/n00a102801r0409J14000601R508e06d7Xfa67aae7Y0b5ed1d6Z03003f36In document body
    • http://storesigma.com/cgi-bin/ids.html/n002106203r0409X552e5602Y1c7b94e7In document body
    • http://click-reklama.com/cgi-bin/plt/z006106201r0019R9710dd89X04b53fffY5c4f12beZ01001f50In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R79a13f8fXb40d51cfY1ed50170Z0100f060In document body
    • http://click-reklama.com/cgi-bin/plt/z006106201r0019R4b484276Xf9b06ddbY0306a0feZ0100f060In document body
    • http://beancountercity.in/cgi-bin/uiq/eH3489011eV0100f060006R81051ebb102Tbe8b9049203l0019In document body
    • http://ajxpeehuvpcv.com/nte/trest1%20.asp/eH7044afc7V0100f060006R634fcaff102Tef11f1e2201l0019K393bf015In document body
    • http://saqop.info/page/information.html/n00a106201r0409X80313459Y0cd9b6a4In document body
    • http://googleinru.in/cgi-bin/etn/z006106201r0019R5f0bac44Xeaf6551fY702ccd64Z0100f060In document body
    • http://93.174.93.11/~delmonca/u/load.phpIn document body
    • http://beancountercity.in/cgi-bin/uiq/eH7477f3f2V0100f060006Rc8f574ff102T3ac264f0203l0019In document body
    • http://experimentaltraffic.com/cgi-bin/009/z002106203r000cR3ae62427Xd50d7a4dY337c5e7aZ0100f060In document body
    • http://ajxpeehuvpcv.com/nte/TREST1.exe/eH525dc114V0100f060006Rc33e997f102T68196def201l0019Kd474d69bIn document body
    • http://www.xfa.org/schema/xfa-template/2.5/In document body
    • http://ns.adobe.com/xdp/In document body
    • http://www.xfa.org/schema/xci/1.0/In document body
    • http://www.xfa.org/schema/xfa-data/1.0/In document body
    • http://www.xfa.org/schema/xfa-form/2.8/In document body
    • http://ns.adobe.com/xtd/In document body
    • http://ns.adobe.com/xfdf/In document body
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document body
    • http://ns.adobe.com/pdf/1.3/In document body
    • http://ns.adobe.com/pdfx/1.3/In document body
    • http://ns.adobe.com/xap/1.0/In document body
    • http://ns.adobe.com/xap/1.0/mm/In document body
    • http://purl.org/dc/elements/1.1/In document body
    +2 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.