The DHL-N-35385784.zip was sent to a phoenix exploit kit sitting on a static IP address (no DNS name) on port 8080. The exploit kit had a multi-capability PDF document that would exploit PDF readers with different exploits depending on what they were vulnerable to. It also, in the case of the DVMTK (Damn Vulnerable Malware Testing Kit) also hit the Windows Help and Support Center vulnerability (CVE-2010-1885)”]
Source: https://blog.talosintelligence.com/2012/04/special-delivery-phoenix-exploit-kit.html