Threat Feed | Online Malware Sandbox

JScript

PAYMENT_REMITTANCE_2026.js

malicious

SHA256: 557bf35bc2dcd5c4d8b0e403bf59a33aa44aa0e393fc999666544e42904ba687

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

3/5

Suspicious content matched by YARA rules

3/5

All network connection attempts failed

3/5

Bypasses PowerShell execution policy

2/5

Executes PowerShell with hidden window

2/5

Executes PowerShell without default profile

1/5

Query OS Information

1/5

Connects to remote host

1/5

Accesses Microsoft Security Software registry keys

Downloader

JDvVphaTVdYKriDS.exe

2026-05-19T03:00:08.915

Windows Exe (x86-64)

JDvVphaTVdYKriDS.exe

malicious

SHA256: 90862483702f4fae6bd524881a63f74e0b087bff47536d677626c7389e84ba8a

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

3/5

Suspicious content matched by YARA rules

2/5

Creates an unusually large number of processes

1/5

Drops PE file

1/5

Creates mutex

1/5

Executes dropped PE file

1/5

Modifies operating system directory

1/5

Creates process with hidden window

PUA

Hacktool

Miner

XV15GA6QWh1fBEJq.exe

2026-05-19T02:56:36.980

Windows Exe (x86-64)

XV15GA6QWh1fBEJq.exe

malicious

SHA256: 3d31fe90bde8fa3ba82a3e661377e9386612942fb2db8e9d0dad93e9f014dc6d

VMRay Threat Identifiers

Severity

Operation

5/5

Modifies content of user files

4/5

Uses a double file extension

4/5

Masks file extension

2/5

Tries to detect application sandbox

1/5

Unusual large memory allocation

1/5

Installs system startup script or application

1/5

Modifies application directory

1/5

Modifies operating system directory

1/5

Performs DNS request

1/5

Content matched by YARA rules

1/5

Resolves API functions dynamically

1/5

Drops PE file

1/5

Executes dropped PE file

1/5

Timestamp manipulation

Ransomware

UUvGRyFc2Yoq5HZi.exe

2026-05-19T02:55:35.134

Windows Exe (x86-32)

UUvGRyFc2Yoq5HZi.exe

malicious

SHA256: 0acb9249d47a4ee5aa972e3be30b16d83beec2398f714633d127941feced39b1

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

1/5

Creates a page with write and execute permissions

1/5

Resolves API functions dynamically

1/5

Detects filename manipulation

1/5

Creates mutex

1/5

Enables process privileges

Virus

mSiGPrPrva1EtHjn.exe

2026-05-19T02:54:51.133

Windows Exe (x86-64)

mSiGPrPrva1EtHjn.exe

malicious

SHA256: 03ac94d24452c638492fdcc3e44c7b1b6a216cc23e7ca9a14b81b1e3706ca854

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

XWorm configuration was extracted

3/5

Redirect program startups

2/5

Signed executable failed signature validation

1/5

Executes dropped PE file

1/5

Creates process with hidden window

1/5

Accesses volumes directly

1/5

Modifies application directory

1/5

A monitored process crashed

1/5

Drops PE file

Spyware