Threat Feed | Online Malware Sandbox

URL

https://ingeko-energies.fr/wp-content/plugins/ojypkws/online.html

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

TelegramPhishkit configuration was extracted

4/5

Malicious host or URL detected via reputation

4/5

Malicious content matched by YARA rules

4/5

Phishing page detected via Machine Learning

2/5

Page title matches the name of a popular online service

1/5

Logon form detected via Computer Vision

1/5

Page is hosted on a CMS

1/5

Page presents itself as a logon page

Phishing

https://domain.pb3.duckdns.org

2026-08-21T15:23:48.290

URL

https://domain.pb3.duckdns.org

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

4/5

Phishing page detected via Machine Learning

4/5

Malicious host or URL detected via reputation

2/5

Page uses an invalid certificate

2/5

Performs DNS request for known DDNS domain

1/5

Page presents itself as a logon page

1/5

Logon form detected via Computer Vision

Phishing

https://35g.cc3.mytemp.website/api/

2026-08-21T15:22:16.410

URL

https://35g.cc3.mytemp.website/api/

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

5/5

Malicious content matched by YARA rules

4/5

Malicious host or URL detected via reputation

3/5

Page contains a Microsoft logon form

2/5

Branded Logon form detected via Computer Vision

2/5

Possible phishing kit behavior

2/5

Image references Microsoft Authenticator

1/5

Page uses exact branding image of a popular online service

1/5

Content matched by YARA rules

1/5

Page presents itself as a logon page

1/5

Page secured via a Domain Validated SSL certificate

1/5

Image references login keywords

1/5

Branding image detected via Computer Vision

Phishing

file.exe

2026-08-21T15:05:46.476

Windows Exe (x86-64)

file.exe

malicious

SHA256: a05e2a5c5b4b93447ad06a728f9e41ce9c65d876c87daa59ae2d8ead067d2192

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections shows multiple input capture behaviors

4/5

Malicious host or URL detected via reputation

4/5

Malicious content matched by YARA rules

4/5

Malicious file detected via reputation

3/5

Takes screenshot

3/5

Uses HTTP to upload a large amount of data

3/5

Tries to detect the presence of antivirus software

3/5

Captures clipboard data

2/5

Collects hardware properties

2/5

Queries OS info via WMI

2/5

Makes direct system call to possibly evade hooking based monitoring

2/5

Tries to detect virtual machine

2/5

Queries a host's domain name

2/5

Query Firmware Information

1/5

Downloads executable

1/5

URL contains a TLD highly associated with phishing

1/5

Tries to connect using an uncommon port

1/5

Creates a page with write and execute permissions

1/5

A monitored process crashed

Spyware

Downloader

https://fr8610.craftum.io

2026-08-21T14:58:19.424

URL

https://fr8610.craftum.io

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

4/5

Malicious host or URL detected via reputation

4/5

Phishing page detected via Machine Learning

4/5

Malicious content matched by YARA rules

3/5

Dynamically loads branding image via third-party API

2/5

Suspicious content matched by YARA rules

1/5

Logon form detected via Computer Vision

1/5

Page presents itself as a logon page

1/5

Page secured via a Domain Validated SSL certificate

1/5

Checks external IP address

1/5

Page contains a form with unusual text spacing

1/5

Loads resources from a public service

Phishing