Threat Feed | Online Malware Sandbox

URL

https://shaw-104450.square.site

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

1/5

Logon form detected via Computer Vision

1/5

Resource is loaded from a service commonly used for temporary hosting

1/5

Page presents itself as a logon page

1/5

URL contains a TLD highly associated with phishing

1/5

Content matched by YARA rules

Phishing

tSMeymHmJRIy8hhJ.exe

2026-03-20T18:11:41.734

Windows Exe (x86-32)

tSMeymHmJRIy8hhJ.exe

malicious

SHA256: d478bcb0863f1408e5b93e39a353b3db1db9b60b4ca468b59c5c108baaef4c42

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

3/5

Modifies native system functions

3/5

Tries to evade debugger

2/5

Tries to detect kernel debugger

2/5

Tries to detect virtual machine

1/5

Enumerates running processes

1/5

Drops PE file

1/5

Executes dropped PE file

1/5

Tries to detect debugger

Trojan

http://ahhhh.pe.kr/zb41/data/1057168297/?email=narindra.mohan@sep.epson.com.sg

2026-03-20T18:07:43.131

URL

http://ahhhh.pe.kr/zb41/data/1057168297/?email=narindra.mohan@sep.epson.com.sg

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

4/5

Phishing page detected via Machine Learning

2/5

Page title matches the name of a popular online service

2/5

Unsecured data

2/5

Branded Logon form detected via Computer Vision

1/5

Page presents itself as a logon page

1/5

Loads image resources from another website

1/5

Branding image detected via Computer Vision

1/5

URL contains email address

Phishing

mFTwWm6UKSOCN2nj.exe

2026-03-20T18:06:39.692

Windows Exe (x86-32)

mFTwWm6UKSOCN2nj.exe

malicious

SHA256: 8fbb31dbf97ca504dc989b371309c3e3d30938255af43cd7acd47cef8c713934

VMRay Threat Identifiers

Severity

Operation

4/5

Writes into the memory of another process

4/5

Modifies Windows Update configuration

3/5

All network connection attempts failed

2/5

Tries to detect analyzer sandbox

1/5

Performs DNS request

1/5

Resolves API functions dynamically

1/5

Drops PE file

1/5

Creates a page with write and execute permissions

1/5

Executes dropped PE file

1/5

Installs system startup script or application

1/5

Creates mutex

1/5

Enumerates running processes

Injector

https://ipfs.io/ipfs/bafkreiduqiymxhzbmpbkdodknfproj7l4jsl4ynjohzl73admecfzbc2la#hmandel@peppertreefund.com

2026-03-20T18:04:13.077

URL

https://ipfs.io/ipfs/bafkreiduqiymxhzbmpbkdodknfproj7l4jsl4ynjohzl73admecfzbc2la#hmandel@peppertreefund.com

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Logon form is hosted on a static web hoster

5/5

Combination of other detections indicates a phishing website

4/5

Phishing page detected via Machine Learning

2/5

Page is served from a service commonly used for temporary hosting

1/5

Page secured via a Domain Validated SSL certificate

1/5

URL contains email address

1/5

Logon form detected via Computer Vision

1/5

Page contents are loaded dynamically

1/5

Tries to connect using an uncommon port

1/5

URL does not use standard port

1/5

Page presents itself as a logon page

Phishing