Scan report · 16 days agoPublic

kh3a.de

193.34.145.201AS51167 · DE

Submittedhttps://kh3a.de/internationalmicro/

Landed onhttps://kh3a.de/internationalmicro/download.html· 1 redirect

Suspicious: page delivers an executable (https://kh3a.de/interna…onalmicro/download.php)

delivers a script, not an installer ("International_Micro_Photonix_Adobe.vbs"); execution instructions ("downloads folder")

Engine tags

Verdict

3 of 8 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 11.0 s · 8 requests

01 · Visitor openskh3a.de/internationalmicro/

02 · Redirected · 1 hopSame host, another address/internationalmicro/download.html

03 · Page shown

Background Image Page

04 · File delivered · maliciousInternational_Micro_Photonix_Adobe.vbskh3a.deHanded over by the page, not served at the scanned address.

05 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Dangerous — confirmed threat

Automated

It is listed on external threat-intelligence feeds. The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

MalwareMalware found in the downloaded file

International_Micro_Photonix_Adobe.vbs

We analysed the file this page delivered — it is Malicious.

Success

SHA-256 915d728ded4ad03b084a0c94e2e06d5b95046bde985b118ad18903440b3d2124

SupportingPage delivers an executable under a document pretext

https://kh3a.de/internationalmicro/download.php · delivers a script, not an installer ("International_Micro_Photonix_Adobe.vbs"); execution instructions ("downloads folder")

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

Files · 2

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Downloaded fileCleanThe engine stored it under a generated name

SHA-2569cc0dfa491f5eebdca6a351e699886946b0b96fdbcb7d454ea15af2fffdf6b93

Fromhxxps://kh3a[.]de/internationalmicro/

Delivered fileMaliciousInternational_Micro_Photonix_Adobe.vbs

SHA-256915d728ded4ad03b084a0c94e2e06d5b95046bde985b118ad18903440b3d2124

Fromhxxps://kh3a[.]de/internationalmicro/download[.]php

Infrastructure

IP: 193.34.145.201CONTABO - Contabo GmbH, DE · AS51167DE
TLS: CN=YR1, O=Let's Encrypt, C=US · expires Nov 30, 2026
Redirects: 1 hop · /internationalmicro/ → /internationalmicro/download.html

76 malicious22 suspicious

Hashes & fingerprints

Page Hash347c411107631293635d2f3880dfb5faa2113d6a11f4264c6d82e441c672fd01 DOM Hash809048cca3afc48fbeff3a5e5eb3d54a7f1c56bf7fe14883b2b60b80cd51b344 Screenshot pHashc3383c6ec3ce9638 JARM15d3fd16d29d29d00042d43d0000007cad75e0049912dcaa3fad94e678d707 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint53951FC526AD4EF2D1277ED5922A43855026FE24 Cert IssuerCN=YR1, O=Let's Encrypt, C=US

Page capture

Live

Title “Background Image Page”

Visit Site

Engines

8 · time to verdict