Threat Feed | Online Malware Sandbox

HTML Document

Invoice_Payment_Details_629204-ERR-220-02DSFIW89HK.PRN8A.htm

malicious

SHA256: 622677541a7c8d2a99484de8794640249e31151fd5f0b43ba3fb0409c3f379bf

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

2/5

The HTML file contains logon form

2/5

Branded Logon form detected via Computer Vision

1/5

Page presents itself as a logon page

1/5

Tries to connect using an uncommon port

1/5

Page contains clickables with luring keywords

1/5

URL does not use standard port

1/5

Branding image detected via Computer Vision

Phishing

https://transdifuogmgroup.vu/$sdrepaul@kecny.com

2026-04-28T10:51:52.405

URL

https://transdifuogmgroup.vu/$sdrepaul@kecny.com

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

5/5

Malicious content matched by YARA rules

4/5

Phishing page detected via Machine Learning

3/5

Page contains a Microsoft logon form

2/5

Branded Logon form detected via Computer Vision

1/5

Branding image detected via Computer Vision

1/5

URL contains obfuscated email address

1/5

Page uses exact branding image of a popular online service

1/5

Page presents itself as a logon page

1/5

Page secured via a Domain Validated SSL certificate

1/5

URL contains email address

Phishing

LdmqXyPniBBPgykC.exe

2026-04-28T10:50:12.955

Windows Exe (x86-32)

LdmqXyPniBBPgykC.exe

malicious

SHA256: 591b15a1b2cd776ed2ebad14e0f987f656f45bfeeb7d6823399f5914d2b2a4ce

VMRay Threat Identifiers

Severity

Operation

4/5

Loads a dropped DLL into a system binary

4/5

Event Triggered Execution

3/5

Tries to detect the presence of antivirus software

3/5

Modifies native system functions

3/5

Suspicious content matched by YARA rules

2/5

Queries OS info via WMI

2/5

Collects hardware properties

2/5

Signed executable failed signature validation

2/5

Schedules task

1/5

Checks external IP address

1/5

Content matched by YARA rules

1/5

Resolves API functions dynamically

1/5

Overwrites code

1/5

Drops PE file

1/5

Loads a dropped DLL

1/5

Executes dropped PE file

1/5

Timestamp manipulation

1/5

Executes WMI query

1/5

Creates process with hidden window

1/5

Installs system startup script or application

1/5

Modifies application directory

1/5

Modifies operating system directory

1/5

Enables process privileges

1/5

Query OS Information

1/5

Performs DNS request

1/5

Connects to remote host

https://ipfs.io/ipfs/bafybeickc6zachw4j2i5a75ona3daqy3xjlbe45otyubiwlvnjpkewlezy/?cms=number@spikkosms.com

2026-04-28T10:49:56.506

URL

https://ipfs.io/ipfs/bafybeickc6zachw4j2i5a75ona3daqy3xjlbe45otyubiwlvnjpkewlezy/?cms=number@spikkosms.com

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Logon form is hosted on a static web hoster

5/5

Combination of other detections indicates a phishing website

4/5

Phishing page detected via Machine Learning

2/5

Page is served from a service commonly used for temporary hosting

1/5

Page contents are loaded dynamically

1/5

URL contains email address

1/5

Page presents itself as a logon page

1/5

Page secured via a Domain Validated SSL certificate

1/5

Logon form detected via Computer Vision

Phishing

https://ipfs.io/ipfs/bafybeickc6zachw4j2i5a75ona3daqy3xjlbe45otyubiwlvnjpkewlezy/?cms=number@suncom1.com

2026-04-28T10:49:13.608

URL

https://ipfs.io/ipfs/bafybeickc6zachw4j2i5a75ona3daqy3xjlbe45otyubiwlvnjpkewlezy/?cms=number@suncom1.com

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Logon form is hosted on a static web hoster

5/5

Combination of other detections indicates a phishing website

4/5

Phishing page detected via Machine Learning

2/5

Page is served from a service commonly used for temporary hosting

1/5

Page contents are loaded dynamically

1/5

URL contains email address

1/5

Page presents itself as a logon page

1/5

Page secured via a Domain Validated SSL certificate

1/5

Logon form detected via Computer Vision

Phishing