Threat Feed | Online Malware Sandbox

URL

http://mail.intomahost2.com/port/paypal/auth/login.php

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

4/5

Malicious host or URL detected via reputation

4/5

Phishing page detected via Machine Learning

2/5

Unsecured data

2/5

Performs DNS request for known DDNS domain

1/5

Page presents itself as a logon page

1/5

Tries to connect using an uncommon port

1/5

Logon form detected via Computer Vision

1/5

URL does not use standard port

Phishing

01930f_x86_exe.exe

2026-10-12T21:23:02.308

Windows Exe (x86-32)

01930f_x86_exe.exe

malicious

SHA256: 224bf0bd119ef5c8aed25875cb66f62f9e2054dea8de5a3083cc43468a5da0da

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

4/5

Malicious file detected via reputation

4/5

Malicious host or URL detected via reputation

4/5

Writes into the memory of another process

4/5

Process Hollowing

2/5

Delays execution

1/5

Reads from memory of another process

1/5

Drops PE file

1/5

Loads a dropped DLL

1/5

Boot or Logon Autostart Execution

1/5

Installs system service

1/5

Reads system data

1/5

Enumerates running processes

1/5

Queries system time

1/5

Creates a page with write and execute permissions

1/5

Creates process with hidden window

1/5

Modifies operating system directory

1/5

Performs DNS request

1/5

Connects to remote host

1/5

Tries to connect using an uncommon port

Trojan

Injector

04485e_x64_dll.dll

2026-10-12T21:22:46.487

Windows DLL (x86-64)

04485e_x64_dll.dll

malicious

SHA256: 1327c0684c8341d3d17b035c63315df93d6315b97b9484f1075b9bf251485e15

VMRay Threat Identifiers

Severity

Operation

4/5

Process Hollowing

4/5

Malicious file detected via reputation

4/5

Malicious host or URL detected via reputation

4/5

Writes into the memory of another process

2/5

Delays execution

1/5

Creates process with hidden window

1/5

Creates a page with write and execute permissions

1/5

Connects to remote host

1/5

Tries to connect using an uncommon port

1/5

Performs DNS request

1/5

Installs system service

1/5

Modifies operating system directory

1/5

Queries system time

1/5

Reads from memory of another process

Injector

06526f_x86_dll.dll

2026-10-12T21:22:36.999

Windows DLL (x86-32)

06526f_x86_dll.dll

malicious

SHA256: fae30c83ee2d6a1736a8b9004c7c1a0881dd9cbf9f65d956be29540c574e21a6

VMRay Threat Identifiers

Severity

Operation

4/5

Process Hollowing

4/5

Malicious file detected via reputation

4/5

Malicious host or URL detected via reputation

4/5

Writes into the memory of another process

4/5

Modifies control flow of another process

2/5

Delays execution

1/5

Creates a page with write and execute permissions

1/5

Connects to remote host

1/5

Tries to connect using an uncommon port

1/5

Performs DNS request

1/5

Installs system service

1/5

Modifies operating system directory

1/5

Queries system time

1/5

Reads from memory of another process

1/5

Creates process with hidden window

Injector

L242526513.lnk

2026-10-12T21:18:55.013

Windows Batch File (Shell Link)

L242526513.lnk

malicious

SHA256: 9472176e23edc4ba35e3137489bc5b1585a87daf04783515bd2af1a8f6afe15b

VMRay Threat Identifiers

Severity

Operation

5/5

Modifies operating system directory

4/5

Attempts to connect through HTTP

4/5

Malicious file detected via reputation

2/5

Queries a host's domain name

2/5

Uses system binaries to initiate network connections

1/5

Opens mutex