Threat Feed | Online Malware Sandbox

HTML Document

specsPOdocs.html

malicious

SHA256: 6ef5fa10955c4be919dcf0958c56d2ca7b717976606a79b4af7e39187bdae938

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

2/5

The HTML file contains logon form

2/5

Page uses exact same title as that of a popular online service

1/5

Resource is loaded from a service commonly used for temporary hosting

1/5

Page presents itself as a logon page

1/5

Logon form detected via Computer Vision

1/5

Page contains clickables with luring keywords

1/5

URL contains a TLD highly associated with phishing

1/5

Content matched by YARA rules

Phishing

Py7qIcZLnWxJrDrj.dll

2026-04-21T08:41:06.637

Windows DLL (x86-64)

Py7qIcZLnWxJrDrj.dll

malicious

SHA256: 841b4476fee6d2401fba240903b35826ebc178593d4d0684ec5eba40c0fa3a59

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

XWorm configuration was extracted

3/5

Modifies native system functions

1/5

Downloads file

1/5

Tries to detect debugger

1/5

Overwrites code

1/5

Installs system startup script or application

1/5

Enables process privileges

1/5

Creates mutex

Spyware

Downloader

z1scan_copy_3486180358.exe

2026-04-21T08:37:44.357

Windows Exe (x86-32)

z1scan_copy_3486180358.exe

malicious

SHA256: 346627d7d58703c3da5b604372778175219e5f7f8c0998f742ebede838fa79e4

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

XWorm configuration was extracted

4/5

Process Hollowing

4/5

Modifies Windows Defender configuration

3/5

Monitors keyboard input

3/5

Suspicious content matched by YARA rules

2/5

Modifies control flow of a process started from a created or modified executable

1/5

Enumerates running processes

1/5

Creates process with hidden window

1/5

Connects to remote host

1/5

Tries to connect using an uncommon port

1/5

Content matched by YARA rules

1/5

Reads from memory of another process

1/5

Enables process privileges

1/5

Creates a page with write and execute permissions

1/5

Installs system startup script or application

1/5

Creates mutex

Spyware

Injector

file.exe

2026-04-21T08:37:20.285

Windows Exe (x86-64)

file.exe

malicious

SHA256: 4016c65aa176fb5099eb0e40221e540a052d65e24b7798eda94298e919a4419b

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

4/5

Makes indirect system call to possibly evade hooking based monitoring

2/5

Delays execution

2/5

Tries to detect analyzer sandbox

1/5

Resolves API functions dynamically

1/5

Downloads executable

1/5

Creates a page with write and execute permissions

Downloader

Hacktool

RKg52MNZE0FS1IEQ.exe

2026-04-21T08:36:45.736

Windows Exe (x86-32)

RKg52MNZE0FS1IEQ.exe

malicious

SHA256: a2b4b3d95ce8e954fd1d7f4a1d9535bba004cb2978a041420e2dbb4a32f0c2ac

VMRay Threat Identifiers

Severity

Operation

5/5

Remcos configuration was extracted

5/5

Malicious content matched by YARA rules

3/5

All network connection attempts failed

2/5

Delays execution

1/5

Creates mutex

1/5

Resolves API functions dynamically

1/5

Connects to remote host

1/5

Tries to connect using an uncommon port

1/5

Query OS Information

Backdoor