Threat Feed | Online Malware Sandbox

URL

https://bafkreigpjn3s2fqrshfis7pxoozccl4pdr3yadaewzw6hzugfn53k7jp2a.ipfs.dweb.link

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

5/5

Logon form is hosted on a static web hoster

4/5

Malicious content matched by YARA rules

4/5

Phishing page detected via Machine Learning

3/5

Sends data via a Telegram bot

3/5

Page contains a Microsoft logon form

2/5

Branded Logon form detected via Computer Vision

1/5

Page presents itself as a logon page

1/5

Loads resources from a public service

1/5

Branding image detected via Computer Vision

1/5

Page secured via a Domain Validated SSL certificate

1/5

Checks external IP address

Phishing

https://pub-bd9a8f553c1940e69c014a5e0e8754bb.r2.dev/secure.html

2026-03-30T18:05:43.718

URL

https://pub-bd9a8f553c1940e69c014a5e0e8754bb.r2.dev/secure.html

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

4/5

Phishing page detected via Machine Learning

2/5

Branded Logon form detected via Computer Vision

2/5

Page is served from a service commonly used for temporary hosting

2/5

Page contains captcha and branding image

1/5

Resource is loaded from a service commonly used for temporary hosting

1/5

Page secured via a Domain Validated SSL certificate

1/5

Logon form detected via Computer Vision

1/5

Page contents are loaded dynamically

1/5

Branding image detected via Computer Vision

1/5

URL contains a TLD highly associated with phishing

1/5

Page uses exact branding image of a popular online service

1/5

Loads image resources from another website

Phishing

YFTZ6wr4BGvYSAOz.exe

2026-03-30T17:57:08.226

Windows Exe (x86-32)

YFTZ6wr4BGvYSAOz.exe

malicious

SHA256: 91dc34026f62584217f6b238184f1b3f9476d17b185e5746947f713a9edeb486

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

2/5

Deletes file after execution

1/5

Tries to detect debugger

1/5

Creates a page with write and execute permissions

1/5

Drops PE file

1/5

Timestamp manipulation

1/5

Creates process with hidden window

1/5

Drops PE masquerading Filename

1/5

Modifies application directory

ROzUg9DcC51wB22Z.exe

2026-03-30T17:51:44.528

Windows Exe (x86-32)

ROzUg9DcC51wB22Z.exe

malicious

SHA256: b92c52f57a4d71f648c00d99fc075cde134cb4b82169c3905c0e3c2982b08daa

VMRay Threat Identifiers

Severity

Operation

5/5

Deletes user files

1/5

Modifies operating system directory

1/5

Creates mutex

1/5

Modifies application directory

1/5

Enumerates running processes

1/5

Possibly does reconnaissance

Wiper

57833350_Jorge.lNk

2026-03-30T17:51:33.652

Windows Batch File (Shell Link)

57833350_Jorge.lNk

malicious

SHA256: cf7825a6bdcf0fffdfcd7790a3408162e39ba082d007922d7756ea22effb1eb5

VMRay Threat Identifiers

Severity

Operation

4/5

Uses Alternate Data Stream (ADS) file attributes

4/5

Attempts to connect through HTTPS

3/5

All network connection attempts failed

2/5

Drops PE file