{
  "type": "MD5",
  "indicator": "b3487fdd1efd2d1ea1550fef5b749037",
  "general": {
    "sections": [
      "general",
      "analysis"
    ],
    "type": "md5",
    "type_title": "FileHash-MD5",
    "indicator": "b3487fdd1efd2d1ea1550fef5b749037",
    "validation": [],
    "base_indicator": {
      "id": 2584,
      "indicator": "b3487fdd1efd2d1ea1550fef5b749037",
      "type": "FileHash-MD5",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "55006e5d13432a032406d7b3",
          "name": "EquationDrug Espionage Platform",
          "description": "",
          "modified": "2017-08-24T10:52:09.070000",
          "created": "2015-03-11T16:33:33.678000",
          "tags": [],
          "references": [
            "https://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
          ],
          "public": 1,
          "adversary": null,
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "",
          "export_count": 48,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlienVault",
            "id": "2",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
            "is_subscribed": true,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1,
            "hostname": 1,
            "FileHash-MD5": 24
          },
          "indicator_count": 26,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 386491,
          "modified_text": "3201 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "FileHash-MD5",
          "related_indicator_is_active": 1
        },
        {
          "id": "698e93e1ab02db8c49e8c3ed",
          "name": "\u201cBroken Seal\u201d DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)",
          "description": "Forensic analysis indicates a DocuSign-themed phishing campaign using a deliberately invalid X.509 PKI seal (\u201cBroken Seal\u201d) to trigger fail-open verification logic in automated handlers. The delivery mechanism bypasses Secure Email Gateway (SEG) reputation checks by using encrypted channels and human-gated infrastructure. The payload is a fileless Process Hollowing (RunPE) malware that injects into RWX memory of legitimate processes to evade disk-based EDR.",
          "modified": "2026-05-17T15:52:35.396000",
          "created": "2026-02-13T03:00:49.872000",
          "tags": [
            "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi",
            "9698f46495ce9401c8bcaf9a2afe1598",
            "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)",
            "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71",
            "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3",
            "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link",
            "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)"
          ],
          "references": [
            "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
            "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
            "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
            "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
            "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
            "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
            "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
            "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
            "Verification failure observed in automated verification handlers during sandbox replay.",
            "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
            "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
            "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
            "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
            "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
            "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
            "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
            "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
            "",
            "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr",
            "My Independent research finds an intersect between different pdf DV versions being able to connect to Raspberry Pi devices as it was the FCC application document. Risk: Mac ID connectivity to all."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "China",
            "United States of America",
            "Spain",
            "Japan",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 28000,
            "FileHash-SHA256": 48374,
            "FileHash-MD5": 42596,
            "FileHash-SHA1": 23243,
            "hostname": 35654,
            "URL": 75758,
            "SSLCertFingerprint": 30,
            "CVE": 7585,
            "email": 316,
            "FileHash-IMPHASH": 8,
            "CIDR": 26205,
            "JA3": 1,
            "URI": 5,
            "IPv4": 574,
            "Mutex": 1
          },
          "indicator_count": 288350,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 92,
          "modified_text": "13 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "FileHash-MD5",
          "related_indicator_is_active": 1
        },
        {
          "id": "69f4dfa6405cf7858f1b732a",
          "name": "2015: Malware Analysis Report",
          "description": "",
          "modified": "2026-05-01T17:15:18.968000",
          "created": "2026-05-01T17:15:18.968000",
          "tags": [],
          "references": [
            "2015-01-08 - Getmypass Point of Sale Malware Update.pdf",
            "2015-01-13 - New Carberp variant heads down under.pdf",
            "2015-01-11 - The Mozart RAM Scraper.pdf",
            "2015-01-06 - Linux DDoS Trojan hiding itself with an embedded rootkit.pdf",
            "2015-01-09 - Chanitor Downloader Actively Installing Vawtrak.pdf",
            "2015-01-08 - Major malvertising campaign spreads Kovter Ad Fraud malware.pdf",
            "2015-01-15 - Weiterentwicklung anspruchsvoller Spyware- von Agent.BTZ zu ComRAT.pdf",
            "2015-01-20 - Analysis of Project Cobra.pdf",
            "2015-01-14 - Catching the \u201cInception Framework\u201d Phishing Attack.pdf",
            "2015-01-22 - New RATs Emerge from Leaked Njw0rm Source Code.pdf",
            "2015-01-26 - Storm Chasing- Hunting Hurricane Panda.pdf",
            "2015-01-21 - The DGA of Symmi.pdf",
            "2015-01-22 - Malvertising Leading To Flash Zero Day Via Angler Exploit Kit.pdf",
            "2015-02-04 - Pawn Storm Update- iOS Espionage App Found.pdf",
            "2015-01-22 - Scarab attackers took aim at select Russian targets since 2012.pdf",
            "2015-02-09 - Anthem Breach May Have Started in April 2014.pdf",
            "2015-02-15 - Carbanak.pdf",
            "2015-02-16 - Equation- The Death Star of Malware Galaxy.pdf",
            "2015-02-16 - How \u201comnipotent\u201d hackers tied to NSA hid for 14 years\u2014and were found at last.pdf",
            "2015-02-12 - Mobile Malware Gang Steals Millions from South Korean Users.pdf",
            "2015-02-17 - Ali Baba, the APT group from the Middle East.pdf",
            "2015-02-17 - Angry Android hacker hides Xbot malware in popular application icons .pdf",
            "2015-02-17 - BE2 extraordinary plugins, Siemens targeting, dev fails.pdf",
            "2015-02-18 - Babar- espionage software finally found and put under the microscope.pdf",
            "2015-02-18 - Babar- Suspected Nation State Spyware In The Spotlight.pdf",
            "2015-02-17 - The Desert Falcons targeted attacks.pdf",
            "2015-02-18 - Sexually Explicit Material Used as Lures in Recent Cyber Attacks.pdf",
            "2015-02-05 - Anatomy of a Brute Force Campaign- The Story of Hee Thai Limited.pdf",
            "2015-02-18 - Meet Babar, a New Malware Almost Certainly Created by France.pdf",
            "2015-02-25 - KINS Banking Trojan Source Code.pdf",
            "2015-02-19 - Arid Viper \u2013 Israel entities targeted by malware packaged with sex video.pdf",
            "2015-02-23 - Cyber Kung-Fu- The Great Firewall Art of DNS Poisoning.pdf",
            "2015-02-27 - ScanBox Framework.pdf",
            "2015-02-25 - Pony Sourcecode.pdf",
            "2015-02-20 - The DGAs of Necurs.pdf",
            "2015-03-03 - C99Shell not dead.pdf",
            "2015-03-03 - PwnPOS- Old Undetected PoS Malware Still Causing Havoc.pdf",
            "2015-03-04 - New crypto ransomware in town - CryptoFortress.pdf",
            "2015-03-04 - And you get a POS malware name...and you get a POS malware name....and you get a POS malware name.....pdf",
            "2015-03-06 - Animals in the APT Farm.pdf",
            "2015-03-07 - Slave, Banatrix and ransomware.pdf",
            "2015-02-27 - The Anthem Hack- All Roads Lead to China.pdf",
            "2015-03-05 - Casper Malware- After Babar and Bunny, Another Espionage Cartoon.pdf",
            "2015-03-09 - CryptoFortress mimics TorrentLocker but is a different ransomware.pdf",
            "2015-03-04 - Who\u2019s Really Spreading through the Bright Star-.pdf",
            "2015-03-10 - The DGA of Pykspa.pdf",
            "2015-03-11 - Malvertising Targeting European Transit Users.pdf",
            "2015-03-19 - Analyzing a Backdoor-Bot forthe MIPS Platform.pdf",
            "2015-03-11 - Inside the EquationDrug Espionage Platform.pdf",
            "2015-02-27 - VB2014 paper- The pluginer - Caphaw.pdf",
            "2015-03-19 - Rocket Kitten Showing Its Claws- Operation Woolen-GoldFish and the GHOLE campaign.pdf",
            "2015-03-30 - Fake Judicial Spam Leads to Backdoor with Fake Certificate Authority.pdf",
            "2015-03-19 - FindPOS- New POS Malware Family Discovered.pdf",
            "2015-03-31 - Volatile Cedar - Analysis of a Global Cyber Espionage Campaign.pdf",
            "2015-03-20 - Threat Spotlight- PoSeidon, A Deep Dive Into Point of Sale Malware.pdf",
            "2015-03-30 - New reconnaissance threat Trojan.Laziok targets the energy sector.pdf",
            "2015-03-31 - Sinkholing Volatile Cedar DGA Infrastructure.pdf",
            "2015-04-01 - NewPosThings Has New PoS Things.pdf",
            "2015-04-09 - Beebone Botnet Takedown- Trend Micro Solutions.pdf",
            "2015-03-28 - UACME.pdf",
            "2015-04-09 - Operation Buhtrap, the trap for Russian accountants.pdf",
            "2015-04-13 - Cyber Deterrence in Action- A story of one long HURRICANE PANDA campaign.pdf",
            "2015-04-15 - Elite cyber crime group strikes back after attack by rival APT gang.pdf",
            "2015-04-13 - Analyzing Gootkit's persistence mechanism (new ASEP inside!).pdf",
            "2015-04-14 - Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets.pdf",
            "2015-04-15 - Betabot retrospective.pdf",
            "2015-04-12 - SIMDA- A Botnet Takedown.pdf",
            "2015-04-15 - Knowledge Fragment- Bruteforcing Andromeda Configuration Buffers.pdf",
            "2015-04-13 - sqlconnt1.exe.pdf",
            "2015-04-18 - Operation RussianDoll- Adobe & Windows Zero-Day Exploits Likely Leveraged by Russia\u2019s APT28 in Highly-Targeted Attack.pdf",
            "2015-04-15 - New POS Malware Emerges - Punkey.pdf",
            "2015-04-15 - The Chronicles of the Hellsing APT- the Empire Strikes Back.pdf",
            "2015-04-21 - Bedep\u2019s DGA- Trading Foreign Exchange for Malware Domains.pdf",
            "2015-04-17 - Andromeda-Gamarue bot loves JSON too (new versions details).pdf",
            "2015-04-27 - Attacks against Israeli & Palestinian interests.pdf",
            "2015-05-04 - Threat Spotlight- Rombertik \u2013 Gazing Past the Smoke, Mirrors, and Trapdoors.pdf",
            "2015-04-15 - The Chronicles of the Hellsing APT_the Empire Strikes Back.pdf",
            "2015-05-10 - Third-Party Software Was Entry Point for Background-Check System Hack.pdf",
            "2015-04-29 - Unboxing Linux-Mumblehard- Muttering spam from your servers.pdf",
            "2015-05-15 - Carefirst Blue Cross Breach Hits 1.1M.pdf",
            "2015-05-14 - The Naikon APT.pdf",
            "2015-05-07 - Dissecting the \u201cKraken\u201d.pdf",
            "2015-05-18 - Cmstar Downloader- Lurid and Enfal\u2019s New Cousin.pdf",
            "2015-05-17 - Newest addition to a happy family- KBOT.pdf",
            "2015-05-22 - The DGA of Ranbyus.pdf",
            "2015-04-27 - Threat Spotlight- TeslaCrypt \u2013 Decrypt It Yourself.pdf",
            "2015-05-20 - Bedep Ad-Fraud Botnet Analysis \u2013 Exposing the Mechanics Behind 153.6M Defrauded Ad Impressions A Day.pdf",
            "2015-05-23 - NitlovePOS- Another New POS Malware.pdf",
            "2015-05-26 - Moose \u2013 the router worm with an appetite for social networks.pdf",
            "2015-05-18 - TT Malware Log.pdf",
            "2015-06-01 - Rhetoric Foreshadows Cyber Activity in the South China Sea.pdf",
            "2015-05-28 - Unusual Exploit Kit Targets Chinese Users (Part 1).pdf",
            "2015-06-03 - Thamar Reservoir \u2013 An Iranian cyber-attack campaign against targets in the Middle East.pdf",
            "2015-06-01 - \u201cTroldesh\u201d \u2013 New Ransomware from Russia.pdf",
            "2015-06-04 - KeyBase Keylogger Malware Family Exposed.pdf",
            "2015-06-12 - Unusual Exploit Kit Targets Chinese Users (Part 2).pdf",
            "2015-06-15 - Stegoloader- A Stealthy Information Stealer.pdf",
            "2015-06-15 - Catching Up on the OPM Breach.pdf",
            "2015-06-10 - The Mystery of Duqu 2.0- a sophisticated cyberespionage actor returns.pdf",
            "2015-06-16 - Operation Lotus Blossom- A New Nation-State Cyberthreat-.pdf",
            "2015-06-09 - New Data- Volatile Cedar Malware Campaign.pdf",
            "2015-05-29 -The MsnMM Campaigns - The Earliest Naikon APT Campaigns.pdf",
            "2015-06-22 - Games are over- Winnti is now targeting pharmaceutical companies.pdf",
            "2015-06-19 - Digital Attack on German Parliament- Investigative Report on the Hack of the Left Party Infrastructure in Bundestag.pdf",
            "2015-06-23 - Operation Clandestine Wolf \u2013 Adobe Flash Zero-Day in APT3 Phishing Campaign.pdf",
            "2015-06-18 - So Long, and Thanks for All the Domains.pdf",
            "2015-06-17 - The Spring Dragon APT.pdf",
            "2015-06-25 - Sundown EK Spreads LuminosityLink RAT- Light After Dark.pdf",
            "2015-06-24 - Stealthy Cyberespionage Campaign Attacks With Social Engineering.pdf",
            "2015-06-24 - UnFIN4ished Business.pdf",
            "2015-07-08 - Wild Neutron \u2013 Economic espionage threat actor returns with new tricks.pdf",
            "2015-07-02 - Win32-Lethic Botnet Analysis.pdf",
            "2015-07-10 - Sednit APT Group Meets Hacking Team.pdf",
            "2015-06-24 - Elusive HanJuan EK Drops New Tinba Version (updated).pdf",
            "2015-07-07 - Dyre Banking Trojan Exploits CVE-2015-0057.pdf",
            "2015-07-13 - Revisiting The Bunitu Trojan.pdf",
            "2015-07-14 - BernhardPOS.pdf",
            "2015-07-14 - TeslaCrypt 2.0 disguised as CryptoWall.pdf",
            "2015-07-08 - Butterfly- Profiting from high-level corporate attacks.pdf",
            "2015-07-05 - Spy Tech Company 'Hacking Team' Gets Hacked.pdf",
            "2015-07-08 - Animal Farm APT and the Shadow of French Intelligence.pdf",
            "2015-07-16 - Github Repo with source code of cd00r.c.pdf",
            "2015-07-19 - The Faulty Precursor of Pykspa's DGA.pdf",
            "2015-07-31 - OTX Pulse on PlugX.pdf",
            "2015-08 - Uncovering the Seven Pointed Dagger.pdf",
            "2015-07-27 - UPS- Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload.pdf",
            "2015-07-13 - \u201cForkmeiamfamous\u201d- Seaduke, latest weapon in the Duke armory.pdf",
            "2015-07-20 - Watering Hole Attack on Aerospace Firm Exploits CVE-2015-5122 to Install IsSpace Backdoor.pdf",
            "2015-07-22 - Duke APT group's latest tools- cloud services and Linux support.pdf",
            "2015-07-30 - Sakula Malware Family.pdf",
            "2015-08-10 - Darkhotel\u2019s attacks in 2015.pdf",
            "2015-08-05 - Newly discovered Chinese hacking group hacked 100+ websites to use as \u201cwatering holes\u201d.pdf",
            "2015-07-31 - OTX- FBI Flash 68 (PlugX).pdf",
            "2015-07-30 - Operation Potao Express- Analysis of a cyber?espionage toolkit.pdf",
            "2015-08-18 - Knowledge Fragment- Unwrapping Fobber.pdf",
            "2015-08-12 - Islamic State Hacking Division.pdf",
            "2015-08-19 - Antak WebShell.pdf",
            "2015-08-12 - Tinba Trojan Sets Its Sights on Romania.pdf",
            "2015-08-05 - Newly discovered Chinese hacking group hacked over 100 websites to use as \u201cwatering holes\u201d.pdf",
            "2015-08-18 - ransomware open-sources.pdf",
            "2015-08-26 - Sphinx, a new variant of Zeus available for sale in the underground.pdf",
            "2015-08-19 - Inside Neutrino botnet builder.pdf",
            "2015-08-05 - Threat Group 3390 Cyberespionage.pdf",
            "2015-08-24 - Sphinx- New Zeus Variant for Sale on the Black Market.pdf",
            "2015-08-05 - Who\u2019s Behind Your Proxy- Uncovering Bunitu\u2019s Secrets.pdf",
            "2015-08-20 - Retefe Banking Trojan Targets Sweden, Switzerland and Japan.pdf",
            "2015-09-09 - Pony Stealer Malware.pdf",
            "2015-09-16 - Operation Iron Tiger- Attackers Shift from East Asia to the United States.pdf",
            "2015-08-27 - London Calling- Two-Factor Authentication Phishing From Iran.pdf",
            "2015-09-11 - CSI MacMark- Janicab.pdf",
            "2015-09-12 - Stuxnet code.pdf",
            "2015-09-23 - Chinese Actors Use \u20183102\u2019 Malware in Attacks on US Government and EU Media.pdf",
            "2015-08-27 - New Spear Phishing Campaign Pretends to be EFF.pdf",
            "2015-09-08 - Carbanak gang is back and packing new guns.pdf",
            "2015-09-03 - Three Variants of Murofet's DGA.pdf",
            "2015-09-01 - Attackers Target Organizations in Japan; Transform Local Sites into C&C Servers for EMDIVI Backdoor.pdf",
            "2015-08-31 - Shifu- \u2018Masterful\u2019 New Banking Trojan Is Attacking 14 Japanese Banks.pdf",
            "2015-09-14 - The Shade Encryptor- a Double Threat.pdf",
            "2015-09-11 - SUCEFUL- Next Generation ATM Malware.pdf",
            "2015-09-09 - Satellite Turla- APT Command and Control in the Sky.pdf",
            "2015-09-17 - The Dukes- 7 Years Of Russian Cyber-Espionage.pdf",
            "2015-09-24 - Credit Card-Scraping Kasidet Builder Leads to Spike in Detections.pdf",
            "2015-09-24 - Kovter malware learns from Poweliks with persistent fileless registry update.pdf",
            "2015-09-18 - Operation Arid Viper Slithers Back into View.pdf",
            "2015-09-01 - Fancy Bear.pdf",
            "2015-09-25 - Notes on Linux-Xor.DDoS.pdf",
            "2015-09-23 - Ranbyus's DGA, Revisited.pdf",
            "2015-09-29 - Andromeda Bot Analysis part 1.pdf",
            "2015-10-06 - I am HDRoot! Part 1.pdf",
            "2015-10-06 - Ticked Off- Upatre Malware\u2019s Simple Anti-analysis Trick to Defeat Sandboxes.pdf",
            "2015-10-01 - Linux.Rekoobe.1.pdf",
            "2015-10-06 - MOKER- A NEW APT DISCOVERED WITHIN A SENSITIVE NETWORK.pdf",
            "2015-10-06 - Targeted Attack Exposes OWA Weakness.pdf",
            "2015-09-28 - Gaza cybergang, where\u2019s your IR team-.pdf",
            "2015-10-12 - Keybase Logger-Clipboard-CredsStealer campaign.pdf",
            "2015-10-07 - Hacker Group Creates Network of Fake LinkedIn Profiles.pdf",
            "2015-10-09 - Latest TeslaCrypt Ransomware Borrows Code From Carberp Trojan.pdf",
            "2015-10-09 - Beta Bot Analysis- Part 1.pdf",
            "2015-10-13 - I am HDRoot! Part 2.pdf",
            "2015-09-28 - Two New PoS Malware Affecting US SMBs.pdf",
            "2015-10-13 - Dridex (Bugat v5) Botnet Takeover Operation.pdf",
            "2015-10-19 - Github Repository for AllaKore.pdf",
            "2015-10-16 - Surveillance Malware Trends- Tracking Predator Pain and HawkEye.pdf",
            "2015-10-13 - New Adobe Flash Zero-Day Used in Pawn Storm Campaign Targeting Foreign Affairs Ministries.pdf",
            "2015-09-24 - Meet GreenDispenser- A New Breed of ATM Malware.pdf",
            "2015-10-17 - How to Write Simple but Sound Yara Rules \u2013 Part 2.pdf",
            "2015-10-13 - Prolific Cybercrime Gang Favors Legit Login Credentials.pdf",
            "2015-10-15 - Archivist.pdf",
            "2015-09-23 - Quaverse RAT- Remote-Access-as-a-Service.pdf",
            "2015-10-26 - Duuzer back door Trojan targets South Korea to take over computers.pdf",
            "2015-10-22 - Pawn Storm Targets MH17 Investigation Team.pdf",
            "2015-11-02 - Troj-Cryakl-B.pdf",
            "2015-09-29 - Andromeda Bot Analysis part 2.pdf",
            "2015-10-28 - Reversing the C2C HTTP Emmental communication.pdf",
            "2015-11-02 - Modular trojan for hidden access to a computer.pdf",
            "2015-11-03 - Reversing the SMS C&C protocol of Emmental (1st part - understanding the code).pdf",
            "2015-11-05 - Sphinx Moth- Expanding our knowledge of the \u201cWild Neutron\u201d - \u201cMorpho\u201d APT.pdf",
            "2015-09-28 - Hammertoss- What, Me Worry-.pdf",
            "2015-10-08 - Dyre Malware Campaigners Innovate with Distribution Techniques.pdf",
            "2015-11-04 - \u201cOffline\u201d Ransomware Encrypts Your Data without C&C Communication.pdf",
            "2015-11-10 - Bookworm Trojan- A Model of Modular Architecture.pdf",
            "2015-11-11 - Operation Buhtrap malware distributed via ammyy.com.pdf",
            "2015-11-02 - Shifu \u2013 the rise of a self-destructive banking trojan.pdf",
            "2015-11-04 - DroidJack isn\u2019t the only spying software out there- Avast discovers OmniRat.pdf",
            "2015-11-17 - New Memory Scraping Technique in Cherry Picker PoS Malware.pdf",
            "2015-11-11 - AbaddonPOS- A new point of sale threat linked to Vawtrak.pdf",
            "2015-12-01 - China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets.pdf",
            "2015-11-16 - Shining the Spotlight on Cherry Picker PoS Malware.pdf",
            "2015-12-03 - Colombians major target of email campaigns delivering Xtreme RAT.pdf",
            "2015-11-04 - A Technical Look At Dyreza.pdf",
            "2015-12-04 - Sofacy APT hits high profile targets with updated toolset.pdf",
            "2015-12-16 - Nemucod malware spreads ransomware Teslacrypt around the world.pdf",
            "2015-12-08 - VT Report for SmartEyes.pdf",
            "2015-12-09 - Inside Chimera Ransomware - the first 'doxingware' in wild.pdf",
            "2015-12-18 - Attack on French Diplomat Linked to Operation Lotus Blossom.pdf",
            "2015-12-17 - SlemBunk- An Evolving Android Trojan Family Targeting Users of Worldwide Banking Apps.pdf",
            "2015-12-26 - Backdoor- Win32-Hesetox.A- vSkimmer POS Malware Analysis _.pdf",
            "2015-11-20 - A king's ransom- an analysis of the CTB-locker ransomware.pdf",
            "2015-11-16 - Introducing LogPOS.pdf",
            "2015-12-22 - Kraken's two Domain Generation Algorithms.pdf",
            "2015-12-07 - Iran-based attackers use back door threats to spy on Middle Eastern targets.pdf",
            "2015-11-06 - OmniRAT Takes Over Android Devices Through Social Engineering Tricks.pdf",
            "2015-12-11 - LATENTBOT- Trace Me If You Can.pdf",
            "2015-11-30 - Inside Braviax-FakeRean- An analysis and history of a FakeAV family.pdf",
            "2015-12-01 - Operation Black Atlas Endangers In-Store Card Payments and SMBs Worldwide; Switches between BlackPOS and Other Tools.pdf",
            "2015-12-22 - BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger.pdf",
            "Agent.BTZ to ComRAT.pdf",
            "2015-11-25 - Detecting GlassRAT using Security Analytics and ECAT.pdf",
            "2015-12-08 - Packrat- Seven Years of a South American Threat Actor.pdf",
            "Afghan Government Compromise - Browser Beware.pdf",
            "Anthem hack all roads lead to China.pdf",
            "ANALYSIS ON APT TO BE ATTACK THAT FOCUSING ON CHINAS GOVERNMENT AGENCY.pdf",
            "Animals in the APT Farm.pdf",
            "APT CVE-2015-5119.pdf",
            "APT 28 (1).pdf",
            "Attacks against Israeli & Palestinian interests.pdf",
            "APT group ups targets us gov.pdf",
            "Black Energy.pdf",
            "blog.pdf",
            "APT 28.pdf",
            "Babar.pdf",
            "Black Vine.pdf",
            "Behind the syria conflict.pdf",
            "Attacks on France TV5 Monde.pdf",
            "Casper Malware.pdf",
            "2015-12-31 - Overseas -Dark Inn- organization launched an APT attack on executives of domestic enterprises.pdf",
            "Demonstrating Hustle.pdf",
            "Cmstar Downloader.pdf",
            "Apt 28 (2).pdf",
            "Bookworm Trojan (1).pdf",
            "ANALYSIS ON APT-TO-BE ATTACK THAT FOCUSING ON CHINAS GOVERNMENT AGENCY.pdf",
            "Duke cloud Linux.pdf",
            "Dukes.pdf",
            "Duqu 2.0 Yara rules.pdf",
            "Duqu 2.0 Win32K Exploit.pdf",
            "Dino.pdf",
            "Duke cloud Linux (1).pdf",
            "Goldfish Phishing.pdf",
            "Indicators of Compormise Hellsing.pdf",
            "Rocket Kitten.pdf",
            "Trojan Skelky.pdf",
            "Wild Neutron.pdf",
            "2015-04-09 - The Banking Trojan Emotet- Detailed Analysis.pdf",
            "2015-07-23 - An Analysis of the Qadars Banking Trojan.pdf",
            "Babar or Bunny.pdf",
            "BBSRAT Roaming Tiger.pdf",
            "Blue termite (1).pdf",
            "China Peace Palace.pdf",
            "Copy Kittens.pdf",
            "Emdivi.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "kikinumpav",
            "id": "385742",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1032,
            "FileHash-SHA1": 544,
            "IPv4": 487,
            "FileHash-MD5": 1665,
            "URL": 673,
            "hostname": 959,
            "CVE": 45,
            "FileHash-SHA256": 411,
            "email": 11,
            "CIDR": 4,
            "BitcoinAddress": 2,
            "YARA": 7
          },
          "indicator_count": 5840,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 13,
          "modified_text": "29 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "FileHash-MD5",
          "related_indicator_is_active": 1
        },
        {
          "id": "69bf64e1d5e06aa6207f78de",
          "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos",
          "description": "",
          "modified": "2026-03-27T00:30:39.055000",
          "created": "2026-03-22T03:41:21.863000",
          "tags": [
            "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi",
            "9698f46495ce9401c8bcaf9a2afe1598",
            "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)",
            "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71",
            "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3",
            "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link",
            "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)"
          ],
          "references": [
            "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
            "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
            "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
            "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
            "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
            "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
            "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
            "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
            "Verification failure observed in automated verification handlers during sandbox replay.",
            "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
            "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
            "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
            "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
            "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
            "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
            "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
            "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
            "",
            "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "China",
            "United States of America",
            "Spain",
            "Japan",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In"
          ],
          "TLP": "green",
          "cloned_from": "698e93e1ab02db8c49e8c3ed",
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 27572,
            "FileHash-SHA256": 46076,
            "FileHash-MD5": 42177,
            "FileHash-SHA1": 22874,
            "hostname": 33438,
            "URL": 74810,
            "SSLCertFingerprint": 21,
            "CVE": 7579,
            "email": 297,
            "FileHash-IMPHASH": 8,
            "CIDR": 26203,
            "JA3": 1
          },
          "indicator_count": 281056,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 149,
          "modified_text": "64 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "FileHash-MD5",
          "related_indicator_is_active": 1
        },
        {
          "id": "69bf64eccb5d39a90a3c391e",
          "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos",
          "description": "",
          "modified": "2026-03-27T00:30:39.055000",
          "created": "2026-03-22T03:41:32.565000",
          "tags": [
            "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi",
            "9698f46495ce9401c8bcaf9a2afe1598",
            "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)",
            "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71",
            "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3",
            "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link",
            "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)"
          ],
          "references": [
            "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
            "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
            "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
            "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
            "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
            "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
            "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
            "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
            "Verification failure observed in automated verification handlers during sandbox replay.",
            "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
            "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
            "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
            "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
            "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
            "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
            "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
            "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
            "",
            "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "China",
            "United States of America",
            "Spain",
            "Japan",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In"
          ],
          "TLP": "green",
          "cloned_from": "698e93e1ab02db8c49e8c3ed",
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 27572,
            "FileHash-SHA256": 46076,
            "FileHash-MD5": 42177,
            "FileHash-SHA1": 22874,
            "hostname": 33438,
            "URL": 74810,
            "SSLCertFingerprint": 21,
            "CVE": 7579,
            "email": 297,
            "FileHash-IMPHASH": 8,
            "CIDR": 26203,
            "JA3": 1
          },
          "indicator_count": 281056,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 152,
          "modified_text": "64 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "FileHash-MD5",
          "related_indicator_is_active": 1
        },
        {
          "id": "69b211200d2561de69baba7d",
          "name": "equation drug clone AV",
          "description": "",
          "modified": "2026-03-12T01:04:32.845000",
          "created": "2026-03-12T01:04:32.845000",
          "tags": [],
          "references": [
            "https://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
          ],
          "public": 1,
          "adversary": null,
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "55006e5d13432a032406d7b3",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1,
            "hostname": 1,
            "FileHash-MD5": 24
          },
          "indicator_count": 26,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 65,
          "modified_text": "79 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "FileHash-MD5",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "",
        "2015-04-27 - Attacks against Israeli & Palestinian interests.pdf",
        "2015-10-15 - Archivist.pdf",
        "2015-09-29 - Andromeda Bot Analysis part 1.pdf",
        "2015-09-24 - Meet GreenDispenser- A New Breed of ATM Malware.pdf",
        "2015-03-07 - Slave, Banatrix and ransomware.pdf",
        "2015-04-09 - Operation Buhtrap, the trap for Russian accountants.pdf",
        "2015-06-03 - Thamar Reservoir \u2013 An Iranian cyber-attack campaign against targets in the Middle East.pdf",
        "Anthem hack all roads lead to China.pdf",
        "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr",
        "APT 28 (1).pdf",
        "Demonstrating Hustle.pdf",
        "2015-02-17 - BE2 extraordinary plugins, Siemens targeting, dev fails.pdf",
        "2015-02-17 - The Desert Falcons targeted attacks.pdf",
        "2015-03-28 - UACME.pdf",
        "2015-01-22 - Malvertising Leading To Flash Zero Day Via Angler Exploit Kit.pdf",
        "2015-02-18 - Sexually Explicit Material Used as Lures in Recent Cyber Attacks.pdf",
        "2015-03-11 - Malvertising Targeting European Transit Users.pdf",
        "2015-07-05 - Spy Tech Company 'Hacking Team' Gets Hacked.pdf",
        "2015-12-17 - SlemBunk- An Evolving Android Trojan Family Targeting Users of Worldwide Banking Apps.pdf",
        "My Independent research finds an intersect between different pdf DV versions being able to connect to Raspberry Pi devices as it was the FCC application document. Risk: Mac ID connectivity to all.",
        "2015-09-24 - Kovter malware learns from Poweliks with persistent fileless registry update.pdf",
        "2015-09-29 - Andromeda Bot Analysis part 2.pdf",
        "2015-09-08 - Carbanak gang is back and packing new guns.pdf",
        "2015-10-01 - Linux.Rekoobe.1.pdf",
        "2015-11-04 - A Technical Look At Dyreza.pdf",
        "2015-02-09 - Anthem Breach May Have Started in April 2014.pdf",
        "2015-08-05 - Who\u2019s Behind Your Proxy- Uncovering Bunitu\u2019s Secrets.pdf",
        "2015-05-14 - The Naikon APT.pdf",
        "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
        "2015-08-24 - Sphinx- New Zeus Variant for Sale on the Black Market.pdf",
        "Duke cloud Linux (1).pdf",
        "2015-11-16 - Introducing LogPOS.pdf",
        "2015-05-22 - The DGA of Ranbyus.pdf",
        "2015-06-01 - \u201cTroldesh\u201d \u2013 New Ransomware from Russia.pdf",
        "Rocket Kitten.pdf",
        "Black Vine.pdf",
        "2015-09-11 - SUCEFUL- Next Generation ATM Malware.pdf",
        "2015-07-23 - An Analysis of the Qadars Banking Trojan.pdf",
        "2015-01-09 - Chanitor Downloader Actively Installing Vawtrak.pdf",
        "2015-02-18 - Babar- Suspected Nation State Spyware In The Spotlight.pdf",
        "2015-02-17 - Ali Baba, the APT group from the Middle East.pdf",
        "2015-07-13 - Revisiting The Bunitu Trojan.pdf",
        "2015-04-27 - Threat Spotlight- TeslaCrypt \u2013 Decrypt It Yourself.pdf",
        "Dukes.pdf",
        "2015-05-26 - Moose \u2013 the router worm with an appetite for social networks.pdf",
        "2015-10-13 - I am HDRoot! Part 2.pdf",
        "2015-11-20 - A king's ransom- an analysis of the CTB-locker ransomware.pdf",
        "2015-01-22 - Scarab attackers took aim at select Russian targets since 2012.pdf",
        "2015-08-12 - Tinba Trojan Sets Its Sights on Romania.pdf",
        "2015-02-17 - Angry Android hacker hides Xbot malware in popular application icons .pdf",
        "2015-03-31 - Volatile Cedar - Analysis of a Global Cyber Espionage Campaign.pdf",
        "2015-06-01 - Rhetoric Foreshadows Cyber Activity in the South China Sea.pdf",
        "2015-11-03 - Reversing the SMS C&C protocol of Emmental (1st part - understanding the code).pdf",
        "2015-09-23 - Chinese Actors Use \u20183102\u2019 Malware in Attacks on US Government and EU Media.pdf",
        "2015-10-12 - Keybase Logger-Clipboard-CredsStealer campaign.pdf",
        "2015-09-28 - Gaza cybergang, where\u2019s your IR team-.pdf",
        "2015-11-02 - Troj-Cryakl-B.pdf",
        "2015-02-27 - The Anthem Hack- All Roads Lead to China.pdf",
        "Apt 28 (2).pdf",
        "2015-10-06 - Ticked Off- Upatre Malware\u2019s Simple Anti-analysis Trick to Defeat Sandboxes.pdf",
        "2015-05-23 - NitlovePOS- Another New POS Malware.pdf",
        "2015-09-28 - Two New PoS Malware Affecting US SMBs.pdf",
        "2015-08-18 - ransomware open-sources.pdf",
        "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
        "2015-06-25 - Sundown EK Spreads LuminosityLink RAT- Light After Dark.pdf",
        "2015-01-14 - Catching the \u201cInception Framework\u201d Phishing Attack.pdf",
        "2015-05-20 - Bedep Ad-Fraud Botnet Analysis \u2013 Exposing the Mechanics Behind 153.6M Defrauded Ad Impressions A Day.pdf",
        "2015-08-19 - Inside Neutrino botnet builder.pdf",
        "Babar.pdf",
        "2015-03-03 - PwnPOS- Old Undetected PoS Malware Still Causing Havoc.pdf",
        "2015-12-09 - Inside Chimera Ransomware - the first 'doxingware' in wild.pdf",
        "2015-04-15 - New POS Malware Emerges - Punkey.pdf",
        "2015-12-07 - Iran-based attackers use back door threats to spy on Middle Eastern targets.pdf",
        "2015-10-28 - Reversing the C2C HTTP Emmental communication.pdf",
        "2015-08-05 - Newly discovered Chinese hacking group hacked 100+ websites to use as \u201cwatering holes\u201d.pdf",
        "2015-12-08 - VT Report for SmartEyes.pdf",
        "2015-03-03 - C99Shell not dead.pdf",
        "2015-09-09 - Pony Stealer Malware.pdf",
        "2015-10-07 - Hacker Group Creates Network of Fake LinkedIn Profiles.pdf",
        "2015-06-23 - Operation Clandestine Wolf \u2013 Adobe Flash Zero-Day in APT3 Phishing Campaign.pdf",
        "2015-06-17 - The Spring Dragon APT.pdf",
        "2015-07-10 - Sednit APT Group Meets Hacking Team.pdf",
        "2015-03-10 - The DGA of Pykspa.pdf",
        "2015-09-16 - Operation Iron Tiger- Attackers Shift from East Asia to the United States.pdf",
        "Duqu 2.0 Win32K Exploit.pdf",
        "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
        "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
        "2015-08-10 - Darkhotel\u2019s attacks in 2015.pdf",
        "2015-01-08 - Getmypass Point of Sale Malware Update.pdf",
        "2015-05-15 - Carefirst Blue Cross Breach Hits 1.1M.pdf",
        "2015-03-06 - Animals in the APT Farm.pdf",
        "2015-07-22 - Duke APT group's latest tools- cloud services and Linux support.pdf",
        "2015-12-26 - Backdoor- Win32-Hesetox.A- vSkimmer POS Malware Analysis _.pdf",
        "2015-02-18 - Babar- espionage software finally found and put under the microscope.pdf",
        "2015-12-04 - Sofacy APT hits high profile targets with updated toolset.pdf",
        "Goldfish Phishing.pdf",
        "2015-06-24 - Stealthy Cyberespionage Campaign Attacks With Social Engineering.pdf",
        "2015-07-08 - Butterfly- Profiting from high-level corporate attacks.pdf",
        "Verification failure observed in automated verification handlers during sandbox replay.",
        "2015-04-15 - Elite cyber crime group strikes back after attack by rival APT gang.pdf",
        "2015-01-22 - New RATs Emerge from Leaked Njw0rm Source Code.pdf",
        "2015-03-11 - Inside the EquationDrug Espionage Platform.pdf",
        "2015-04-15 - Betabot retrospective.pdf",
        "2015-06-04 - KeyBase Keylogger Malware Family Exposed.pdf",
        "2015-12-31 - Overseas -Dark Inn- organization launched an APT attack on executives of domestic enterprises.pdf",
        "Wild Neutron.pdf",
        "ANALYSIS ON APT-TO-BE ATTACK THAT FOCUSING ON CHINAS GOVERNMENT AGENCY.pdf",
        "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
        "2015-02-19 - Arid Viper \u2013 Israel entities targeted by malware packaged with sex video.pdf",
        "2015-02-23 - Cyber Kung-Fu- The Great Firewall Art of DNS Poisoning.pdf",
        "2015-03-05 - Casper Malware- After Babar and Bunny, Another Espionage Cartoon.pdf",
        "2015-07-13 - \u201cForkmeiamfamous\u201d- Seaduke, latest weapon in the Duke armory.pdf",
        "2015-04-09 - Beebone Botnet Takedown- Trend Micro Solutions.pdf",
        "2015-03-04 - And you get a POS malware name...and you get a POS malware name....and you get a POS malware name.....pdf",
        "2015-04-13 - Analyzing Gootkit's persistence mechanism (new ASEP inside!).pdf",
        "2015-07-16 - Github Repo with source code of cd00r.c.pdf",
        "2015-06-22 - Games are over- Winnti is now targeting pharmaceutical companies.pdf",
        "2015-10-08 - Dyre Malware Campaigners Innovate with Distribution Techniques.pdf",
        "2015-09-18 - Operation Arid Viper Slithers Back into View.pdf",
        "2015-02-18 - Meet Babar, a New Malware Almost Certainly Created by France.pdf",
        "APT 28.pdf",
        "2015-04-21 - Bedep\u2019s DGA- Trading Foreign Exchange for Malware Domains.pdf",
        "2015-10-06 - I am HDRoot! Part 1.pdf",
        "2015-04-29 - Unboxing Linux-Mumblehard- Muttering spam from your servers.pdf",
        "2015-09-25 - Notes on Linux-Xor.DDoS.pdf",
        "https://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/",
        "2015-04-13 - Cyber Deterrence in Action- A story of one long HURRICANE PANDA campaign.pdf",
        "Black Energy.pdf",
        "2015-07-08 - Animal Farm APT and the Shadow of French Intelligence.pdf",
        "2015-11-16 - Shining the Spotlight on Cherry Picker PoS Malware.pdf",
        "2015-05-28 - Unusual Exploit Kit Targets Chinese Users (Part 1).pdf",
        "2015-07-30 - Operation Potao Express- Analysis of a cyber?espionage toolkit.pdf",
        "2015-06-12 - Unusual Exploit Kit Targets Chinese Users (Part 2).pdf",
        "2015-10-17 - How to Write Simple but Sound Yara Rules \u2013 Part 2.pdf",
        "2015-11-17 - New Memory Scraping Technique in Cherry Picker PoS Malware.pdf",
        "2015-04-13 - sqlconnt1.exe.pdf",
        "2015-04-15 - The Chronicles of the Hellsing APT_the Empire Strikes Back.pdf",
        "2015-04-14 - Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets.pdf",
        "2015-01-06 - Linux DDoS Trojan hiding itself with an embedded rootkit.pdf",
        "2015-07-19 - The Faulty Precursor of Pykspa's DGA.pdf",
        "2015-11-11 - AbaddonPOS- A new point of sale threat linked to Vawtrak.pdf",
        "2015-12-03 - Colombians major target of email campaigns delivering Xtreme RAT.pdf",
        "Afghan Government Compromise - Browser Beware.pdf",
        "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
        "2015-12-08 - Packrat- Seven Years of a South American Threat Actor.pdf",
        "2015-02-05 - Anatomy of a Brute Force Campaign- The Story of Hee Thai Limited.pdf",
        "2015-10-22 - Pawn Storm Targets MH17 Investigation Team.pdf",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
        "2015-09-23 - Quaverse RAT- Remote-Access-as-a-Service.pdf",
        "2015-12-01 - Operation Black Atlas Endangers In-Store Card Payments and SMBs Worldwide; Switches between BlackPOS and Other Tools.pdf",
        "2015-04-12 - SIMDA- A Botnet Takedown.pdf",
        "Cmstar Downloader.pdf",
        "2015-10-09 - Beta Bot Analysis- Part 1.pdf",
        "2015-09-01 - Attackers Target Organizations in Japan; Transform Local Sites into C&C Servers for EMDIVI Backdoor.pdf",
        "2015-12-22 - BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger.pdf",
        "2015-09-14 - The Shade Encryptor- a Double Threat.pdf",
        "2015-08-31 - Shifu- \u2018Masterful\u2019 New Banking Trojan Is Attacking 14 Japanese Banks.pdf",
        "2015-03-30 - Fake Judicial Spam Leads to Backdoor with Fake Certificate Authority.pdf",
        "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
        "2015-10-26 - Duuzer back door Trojan targets South Korea to take over computers.pdf",
        "2015-10-19 - Github Repository for AllaKore.pdf",
        "2015-12-18 - Attack on French Diplomat Linked to Operation Lotus Blossom.pdf",
        "Attacks against Israeli & Palestinian interests.pdf",
        "Casper Malware.pdf",
        "Trojan Skelky.pdf",
        "2015-04-01 - NewPosThings Has New PoS Things.pdf",
        "2015-11-10 - Bookworm Trojan- A Model of Modular Architecture.pdf",
        "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
        "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
        "2015-06-15 - Stegoloader- A Stealthy Information Stealer.pdf",
        "2015-09-23 - Ranbyus's DGA, Revisited.pdf",
        "2015-07-08 - Wild Neutron \u2013 Economic espionage threat actor returns with new tricks.pdf",
        "2015-05-10 - Third-Party Software Was Entry Point for Background-Check System Hack.pdf",
        "2015-08-18 - Knowledge Fragment- Unwrapping Fobber.pdf",
        "2015-10-09 - Latest TeslaCrypt Ransomware Borrows Code From Carberp Trojan.pdf",
        "2015-10-16 - Surveillance Malware Trends- Tracking Predator Pain and HawkEye.pdf",
        "2015-09-28 - Hammertoss- What, Me Worry-.pdf",
        "2015-05-29 -The MsnMM Campaigns - The Earliest Naikon APT Campaigns.pdf",
        "2015-03-04 - New crypto ransomware in town - CryptoFortress.pdf",
        "2015-11-04 - DroidJack isn\u2019t the only spying software out there- Avast discovers OmniRat.pdf",
        "2015-04-15 - Knowledge Fragment- Bruteforcing Andromeda Configuration Buffers.pdf",
        "2015-11-05 - Sphinx Moth- Expanding our knowledge of the \u201cWild Neutron\u201d - \u201cMorpho\u201d APT.pdf",
        "Indicators of Compormise Hellsing.pdf",
        "2015-11-25 - Detecting GlassRAT using Security Analytics and ECAT.pdf",
        "2015-02-16 - Equation- The Death Star of Malware Galaxy.pdf",
        "2015-01-13 - New Carberp variant heads down under.pdf",
        "2015-04-17 - Andromeda-Gamarue bot loves JSON too (new versions details).pdf",
        "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
        "2015-03-31 - Sinkholing Volatile Cedar DGA Infrastructure.pdf",
        "2015-07-30 - Sakula Malware Family.pdf",
        "2015-08-20 - Retefe Banking Trojan Targets Sweden, Switzerland and Japan.pdf",
        "2015-06-16 - Operation Lotus Blossom- A New Nation-State Cyberthreat-.pdf",
        "2015-10-13 - New Adobe Flash Zero-Day Used in Pawn Storm Campaign Targeting Foreign Affairs Ministries.pdf",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
        "2015-06-10 - The Mystery of Duqu 2.0- a sophisticated cyberespionage actor returns.pdf",
        "2015-06-19 - Digital Attack on German Parliament- Investigative Report on the Hack of the Left Party Infrastructure in Bundestag.pdf",
        "2015-11-02 - Modular trojan for hidden access to a computer.pdf",
        "Behind the syria conflict.pdf",
        "Bookworm Trojan (1).pdf",
        "Duke cloud Linux.pdf",
        "BBSRAT Roaming Tiger.pdf",
        "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
        "2015-03-30 - New reconnaissance threat Trojan.Laziok targets the energy sector.pdf",
        "2015-07-20 - Watering Hole Attack on Aerospace Firm Exploits CVE-2015-5122 to Install IsSpace Backdoor.pdf",
        "2015-11-02 - Shifu \u2013 the rise of a self-destructive banking trojan.pdf",
        "2015-02-27 - VB2014 paper- The pluginer - Caphaw.pdf",
        "Babar or Bunny.pdf",
        "2015-06-24 - Elusive HanJuan EK Drops New Tinba Version (updated).pdf",
        "2015-06-09 - New Data- Volatile Cedar Malware Campaign.pdf",
        "APT group ups targets us gov.pdf",
        "2015-02-25 - Pony Sourcecode.pdf",
        "2015-02-04 - Pawn Storm Update- iOS Espionage App Found.pdf",
        "2015-05-17 - Newest addition to a happy family- KBOT.pdf",
        "2015-06-18 - So Long, and Thanks for All the Domains.pdf",
        "2015-05-18 - TT Malware Log.pdf",
        "2015-09-24 - Credit Card-Scraping Kasidet Builder Leads to Spike in Detections.pdf",
        "2015-04-09 - The Banking Trojan Emotet- Detailed Analysis.pdf",
        "2015-02-27 - ScanBox Framework.pdf",
        "APT CVE-2015-5119.pdf",
        "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
        "2015-08-12 - Islamic State Hacking Division.pdf",
        "2015-07-07 - Dyre Banking Trojan Exploits CVE-2015-0057.pdf",
        "China Peace Palace.pdf",
        "2015-01-15 - Weiterentwicklung anspruchsvoller Spyware- von Agent.BTZ zu ComRAT.pdf",
        "2015-12-01 - China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets.pdf",
        "Attacks on France TV5 Monde.pdf",
        "Duqu 2.0 Yara rules.pdf",
        "2015-08-05 - Threat Group 3390 Cyberespionage.pdf",
        "2015-01-08 - Major malvertising campaign spreads Kovter Ad Fraud malware.pdf",
        "2015-02-20 - The DGAs of Necurs.pdf",
        "2015-12-11 - LATENTBOT- Trace Me If You Can.pdf",
        "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
        "2015-04-15 - The Chronicles of the Hellsing APT- the Empire Strikes Back.pdf",
        "2015-11-11 - Operation Buhtrap malware distributed via ammyy.com.pdf",
        "2015-05-07 - Dissecting the \u201cKraken\u201d.pdf",
        "Agent.BTZ to ComRAT.pdf",
        "2015-03-20 - Threat Spotlight- PoSeidon, A Deep Dive Into Point of Sale Malware.pdf",
        "2015-12-22 - Kraken's two Domain Generation Algorithms.pdf",
        "2015-07-27 - UPS- Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload.pdf",
        "2015-07-02 - Win32-Lethic Botnet Analysis.pdf",
        "2015-08-27 - New Spear Phishing Campaign Pretends to be EFF.pdf",
        "2015-03-19 - Analyzing a Backdoor-Bot forthe MIPS Platform.pdf",
        "2015-09-09 - Satellite Turla- APT Command and Control in the Sky.pdf",
        "2015-06-24 - UnFIN4ished Business.pdf",
        "Copy Kittens.pdf",
        "2015-09-11 - CSI MacMark- Janicab.pdf",
        "2015-08-26 - Sphinx, a new variant of Zeus available for sale in the underground.pdf",
        "2015-09-01 - Fancy Bear.pdf",
        "2015-07-31 - OTX- FBI Flash 68 (PlugX).pdf",
        "Blue termite (1).pdf",
        "2015-08-05 - Newly discovered Chinese hacking group hacked over 100 websites to use as \u201cwatering holes\u201d.pdf",
        "2015-09-12 - Stuxnet code.pdf",
        "2015-01-20 - Analysis of Project Cobra.pdf",
        "2015-08-19 - Antak WebShell.pdf",
        "2015-10-13 - Dridex (Bugat v5) Botnet Takeover Operation.pdf",
        "2015-01-11 - The Mozart RAM Scraper.pdf",
        "2015-05-04 - Threat Spotlight- Rombertik \u2013 Gazing Past the Smoke, Mirrors, and Trapdoors.pdf",
        "blog.pdf",
        "2015-02-16 - How \u201comnipotent\u201d hackers tied to NSA hid for 14 years\u2014and were found at last.pdf",
        "2015-11-06 - OmniRAT Takes Over Android Devices Through Social Engineering Tricks.pdf",
        "ANALYSIS ON APT TO BE ATTACK THAT FOCUSING ON CHINAS GOVERNMENT AGENCY.pdf",
        "Dino.pdf",
        "2015-03-19 - FindPOS- New POS Malware Family Discovered.pdf",
        "2015-12-16 - Nemucod malware spreads ransomware Teslacrypt around the world.pdf",
        "Animals in the APT Farm.pdf",
        "2015-01-26 - Storm Chasing- Hunting Hurricane Panda.pdf",
        "2015-10-13 - Prolific Cybercrime Gang Favors Legit Login Credentials.pdf",
        "2015-07-31 - OTX Pulse on PlugX.pdf",
        "2015-10-06 - Targeted Attack Exposes OWA Weakness.pdf",
        "2015-07-14 - BernhardPOS.pdf",
        "2015-11-04 - \u201cOffline\u201d Ransomware Encrypts Your Data without C&C Communication.pdf",
        "2015-10-06 - MOKER- A NEW APT DISCOVERED WITHIN A SENSITIVE NETWORK.pdf",
        "2015-03-19 - Rocket Kitten Showing Its Claws- Operation Woolen-GoldFish and the GHOLE campaign.pdf",
        "2015-09-17 - The Dukes- 7 Years Of Russian Cyber-Espionage.pdf",
        "Emdivi.pdf",
        "2015-02-12 - Mobile Malware Gang Steals Millions from South Korean Users.pdf",
        "2015-11-30 - Inside Braviax-FakeRean- An analysis and history of a FakeAV family.pdf",
        "2015-09-03 - Three Variants of Murofet's DGA.pdf",
        "2015-06-15 - Catching Up on the OPM Breach.pdf",
        "2015-04-18 - Operation RussianDoll- Adobe & Windows Zero-Day Exploits Likely Leveraged by Russia\u2019s APT28 in Highly-Targeted Attack.pdf",
        "2015-07-14 - TeslaCrypt 2.0 disguised as CryptoWall.pdf",
        "2015-02-15 - Carbanak.pdf",
        "2015-08-27 - London Calling- Two-Factor Authentication Phishing From Iran.pdf",
        "2015-02-25 - KINS Banking Trojan Source Code.pdf",
        "2015-08 - Uncovering the Seven Pointed Dagger.pdf",
        "2015-03-09 - CryptoFortress mimics TorrentLocker but is a different ransomware.pdf",
        "2015-03-04 - Who\u2019s Really Spreading through the Bright Star-.pdf",
        "2015-05-18 - Cmstar Downloader- Lurid and Enfal\u2019s New Cousin.pdf",
        "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
        "2015-01-21 - The DGA of Symmi.pdf"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Legal, financial, healthcare, government, municipal, real-estate, enterprise-technology, critical-in"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "55006e5d13432a032406d7b3",
      "name": "EquationDrug Espionage Platform",
      "description": "",
      "modified": "2017-08-24T10:52:09.070000",
      "created": "2015-03-11T16:33:33.678000",
      "tags": [],
      "references": [
        "https://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
      ],
      "public": 1,
      "adversary": null,
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "",
      "export_count": 48,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlienVault",
        "id": "2",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
        "is_subscribed": true,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1,
        "hostname": 1,
        "FileHash-MD5": 24
      },
      "indicator_count": 26,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 386491,
      "modified_text": "3201 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "FileHash-MD5",
      "related_indicator_is_active": 1
    },
    {
      "id": "698e93e1ab02db8c49e8c3ed",
      "name": "\u201cBroken Seal\u201d DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)",
      "description": "Forensic analysis indicates a DocuSign-themed phishing campaign using a deliberately invalid X.509 PKI seal (\u201cBroken Seal\u201d) to trigger fail-open verification logic in automated handlers. The delivery mechanism bypasses Secure Email Gateway (SEG) reputation checks by using encrypted channels and human-gated infrastructure. The payload is a fileless Process Hollowing (RunPE) malware that injects into RWX memory of legitimate processes to evade disk-based EDR.",
      "modified": "2026-05-17T15:52:35.396000",
      "created": "2026-02-13T03:00:49.872000",
      "tags": [
        "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi",
        "9698f46495ce9401c8bcaf9a2afe1598",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)",
        "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71",
        "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link",
        "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)"
      ],
      "references": [
        "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
        "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
        "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
        "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
        "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
        "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
        "Verification failure observed in automated verification handlers during sandbox replay.",
        "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
        "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
        "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
        "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
        "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
        "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
        "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
        "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
        "",
        "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr",
        "My Independent research finds an intersect between different pdf DV versions being able to connect to Raspberry Pi devices as it was the FCC application document. Risk: Mac ID connectivity to all."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "China",
        "United States of America",
        "Spain",
        "Japan",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 28000,
        "FileHash-SHA256": 48374,
        "FileHash-MD5": 42596,
        "FileHash-SHA1": 23243,
        "hostname": 35654,
        "URL": 75758,
        "SSLCertFingerprint": 30,
        "CVE": 7585,
        "email": 316,
        "FileHash-IMPHASH": 8,
        "CIDR": 26205,
        "JA3": 1,
        "URI": 5,
        "IPv4": 574,
        "Mutex": 1
      },
      "indicator_count": 288350,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 92,
      "modified_text": "13 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "FileHash-MD5",
      "related_indicator_is_active": 1
    },
    {
      "id": "69f4dfa6405cf7858f1b732a",
      "name": "2015: Malware Analysis Report",
      "description": "",
      "modified": "2026-05-01T17:15:18.968000",
      "created": "2026-05-01T17:15:18.968000",
      "tags": [],
      "references": [
        "2015-01-08 - Getmypass Point of Sale Malware Update.pdf",
        "2015-01-13 - New Carberp variant heads down under.pdf",
        "2015-01-11 - The Mozart RAM Scraper.pdf",
        "2015-01-06 - Linux DDoS Trojan hiding itself with an embedded rootkit.pdf",
        "2015-01-09 - Chanitor Downloader Actively Installing Vawtrak.pdf",
        "2015-01-08 - Major malvertising campaign spreads Kovter Ad Fraud malware.pdf",
        "2015-01-15 - Weiterentwicklung anspruchsvoller Spyware- von Agent.BTZ zu ComRAT.pdf",
        "2015-01-20 - Analysis of Project Cobra.pdf",
        "2015-01-14 - Catching the \u201cInception Framework\u201d Phishing Attack.pdf",
        "2015-01-22 - New RATs Emerge from Leaked Njw0rm Source Code.pdf",
        "2015-01-26 - Storm Chasing- Hunting Hurricane Panda.pdf",
        "2015-01-21 - The DGA of Symmi.pdf",
        "2015-01-22 - Malvertising Leading To Flash Zero Day Via Angler Exploit Kit.pdf",
        "2015-02-04 - Pawn Storm Update- iOS Espionage App Found.pdf",
        "2015-01-22 - Scarab attackers took aim at select Russian targets since 2012.pdf",
        "2015-02-09 - Anthem Breach May Have Started in April 2014.pdf",
        "2015-02-15 - Carbanak.pdf",
        "2015-02-16 - Equation- The Death Star of Malware Galaxy.pdf",
        "2015-02-16 - How \u201comnipotent\u201d hackers tied to NSA hid for 14 years\u2014and were found at last.pdf",
        "2015-02-12 - Mobile Malware Gang Steals Millions from South Korean Users.pdf",
        "2015-02-17 - Ali Baba, the APT group from the Middle East.pdf",
        "2015-02-17 - Angry Android hacker hides Xbot malware in popular application icons .pdf",
        "2015-02-17 - BE2 extraordinary plugins, Siemens targeting, dev fails.pdf",
        "2015-02-18 - Babar- espionage software finally found and put under the microscope.pdf",
        "2015-02-18 - Babar- Suspected Nation State Spyware In The Spotlight.pdf",
        "2015-02-17 - The Desert Falcons targeted attacks.pdf",
        "2015-02-18 - Sexually Explicit Material Used as Lures in Recent Cyber Attacks.pdf",
        "2015-02-05 - Anatomy of a Brute Force Campaign- The Story of Hee Thai Limited.pdf",
        "2015-02-18 - Meet Babar, a New Malware Almost Certainly Created by France.pdf",
        "2015-02-25 - KINS Banking Trojan Source Code.pdf",
        "2015-02-19 - Arid Viper \u2013 Israel entities targeted by malware packaged with sex video.pdf",
        "2015-02-23 - Cyber Kung-Fu- The Great Firewall Art of DNS Poisoning.pdf",
        "2015-02-27 - ScanBox Framework.pdf",
        "2015-02-25 - Pony Sourcecode.pdf",
        "2015-02-20 - The DGAs of Necurs.pdf",
        "2015-03-03 - C99Shell not dead.pdf",
        "2015-03-03 - PwnPOS- Old Undetected PoS Malware Still Causing Havoc.pdf",
        "2015-03-04 - New crypto ransomware in town - CryptoFortress.pdf",
        "2015-03-04 - And you get a POS malware name...and you get a POS malware name....and you get a POS malware name.....pdf",
        "2015-03-06 - Animals in the APT Farm.pdf",
        "2015-03-07 - Slave, Banatrix and ransomware.pdf",
        "2015-02-27 - The Anthem Hack- All Roads Lead to China.pdf",
        "2015-03-05 - Casper Malware- After Babar and Bunny, Another Espionage Cartoon.pdf",
        "2015-03-09 - CryptoFortress mimics TorrentLocker but is a different ransomware.pdf",
        "2015-03-04 - Who\u2019s Really Spreading through the Bright Star-.pdf",
        "2015-03-10 - The DGA of Pykspa.pdf",
        "2015-03-11 - Malvertising Targeting European Transit Users.pdf",
        "2015-03-19 - Analyzing a Backdoor-Bot forthe MIPS Platform.pdf",
        "2015-03-11 - Inside the EquationDrug Espionage Platform.pdf",
        "2015-02-27 - VB2014 paper- The pluginer - Caphaw.pdf",
        "2015-03-19 - Rocket Kitten Showing Its Claws- Operation Woolen-GoldFish and the GHOLE campaign.pdf",
        "2015-03-30 - Fake Judicial Spam Leads to Backdoor with Fake Certificate Authority.pdf",
        "2015-03-19 - FindPOS- New POS Malware Family Discovered.pdf",
        "2015-03-31 - Volatile Cedar - Analysis of a Global Cyber Espionage Campaign.pdf",
        "2015-03-20 - Threat Spotlight- PoSeidon, A Deep Dive Into Point of Sale Malware.pdf",
        "2015-03-30 - New reconnaissance threat Trojan.Laziok targets the energy sector.pdf",
        "2015-03-31 - Sinkholing Volatile Cedar DGA Infrastructure.pdf",
        "2015-04-01 - NewPosThings Has New PoS Things.pdf",
        "2015-04-09 - Beebone Botnet Takedown- Trend Micro Solutions.pdf",
        "2015-03-28 - UACME.pdf",
        "2015-04-09 - Operation Buhtrap, the trap for Russian accountants.pdf",
        "2015-04-13 - Cyber Deterrence in Action- A story of one long HURRICANE PANDA campaign.pdf",
        "2015-04-15 - Elite cyber crime group strikes back after attack by rival APT gang.pdf",
        "2015-04-13 - Analyzing Gootkit's persistence mechanism (new ASEP inside!).pdf",
        "2015-04-14 - Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets.pdf",
        "2015-04-15 - Betabot retrospective.pdf",
        "2015-04-12 - SIMDA- A Botnet Takedown.pdf",
        "2015-04-15 - Knowledge Fragment- Bruteforcing Andromeda Configuration Buffers.pdf",
        "2015-04-13 - sqlconnt1.exe.pdf",
        "2015-04-18 - Operation RussianDoll- Adobe & Windows Zero-Day Exploits Likely Leveraged by Russia\u2019s APT28 in Highly-Targeted Attack.pdf",
        "2015-04-15 - New POS Malware Emerges - Punkey.pdf",
        "2015-04-15 - The Chronicles of the Hellsing APT- the Empire Strikes Back.pdf",
        "2015-04-21 - Bedep\u2019s DGA- Trading Foreign Exchange for Malware Domains.pdf",
        "2015-04-17 - Andromeda-Gamarue bot loves JSON too (new versions details).pdf",
        "2015-04-27 - Attacks against Israeli & Palestinian interests.pdf",
        "2015-05-04 - Threat Spotlight- Rombertik \u2013 Gazing Past the Smoke, Mirrors, and Trapdoors.pdf",
        "2015-04-15 - The Chronicles of the Hellsing APT_the Empire Strikes Back.pdf",
        "2015-05-10 - Third-Party Software Was Entry Point for Background-Check System Hack.pdf",
        "2015-04-29 - Unboxing Linux-Mumblehard- Muttering spam from your servers.pdf",
        "2015-05-15 - Carefirst Blue Cross Breach Hits 1.1M.pdf",
        "2015-05-14 - The Naikon APT.pdf",
        "2015-05-07 - Dissecting the \u201cKraken\u201d.pdf",
        "2015-05-18 - Cmstar Downloader- Lurid and Enfal\u2019s New Cousin.pdf",
        "2015-05-17 - Newest addition to a happy family- KBOT.pdf",
        "2015-05-22 - The DGA of Ranbyus.pdf",
        "2015-04-27 - Threat Spotlight- TeslaCrypt \u2013 Decrypt It Yourself.pdf",
        "2015-05-20 - Bedep Ad-Fraud Botnet Analysis \u2013 Exposing the Mechanics Behind 153.6M Defrauded Ad Impressions A Day.pdf",
        "2015-05-23 - NitlovePOS- Another New POS Malware.pdf",
        "2015-05-26 - Moose \u2013 the router worm with an appetite for social networks.pdf",
        "2015-05-18 - TT Malware Log.pdf",
        "2015-06-01 - Rhetoric Foreshadows Cyber Activity in the South China Sea.pdf",
        "2015-05-28 - Unusual Exploit Kit Targets Chinese Users (Part 1).pdf",
        "2015-06-03 - Thamar Reservoir \u2013 An Iranian cyber-attack campaign against targets in the Middle East.pdf",
        "2015-06-01 - \u201cTroldesh\u201d \u2013 New Ransomware from Russia.pdf",
        "2015-06-04 - KeyBase Keylogger Malware Family Exposed.pdf",
        "2015-06-12 - Unusual Exploit Kit Targets Chinese Users (Part 2).pdf",
        "2015-06-15 - Stegoloader- A Stealthy Information Stealer.pdf",
        "2015-06-15 - Catching Up on the OPM Breach.pdf",
        "2015-06-10 - The Mystery of Duqu 2.0- a sophisticated cyberespionage actor returns.pdf",
        "2015-06-16 - Operation Lotus Blossom- A New Nation-State Cyberthreat-.pdf",
        "2015-06-09 - New Data- Volatile Cedar Malware Campaign.pdf",
        "2015-05-29 -The MsnMM Campaigns - The Earliest Naikon APT Campaigns.pdf",
        "2015-06-22 - Games are over- Winnti is now targeting pharmaceutical companies.pdf",
        "2015-06-19 - Digital Attack on German Parliament- Investigative Report on the Hack of the Left Party Infrastructure in Bundestag.pdf",
        "2015-06-23 - Operation Clandestine Wolf \u2013 Adobe Flash Zero-Day in APT3 Phishing Campaign.pdf",
        "2015-06-18 - So Long, and Thanks for All the Domains.pdf",
        "2015-06-17 - The Spring Dragon APT.pdf",
        "2015-06-25 - Sundown EK Spreads LuminosityLink RAT- Light After Dark.pdf",
        "2015-06-24 - Stealthy Cyberespionage Campaign Attacks With Social Engineering.pdf",
        "2015-06-24 - UnFIN4ished Business.pdf",
        "2015-07-08 - Wild Neutron \u2013 Economic espionage threat actor returns with new tricks.pdf",
        "2015-07-02 - Win32-Lethic Botnet Analysis.pdf",
        "2015-07-10 - Sednit APT Group Meets Hacking Team.pdf",
        "2015-06-24 - Elusive HanJuan EK Drops New Tinba Version (updated).pdf",
        "2015-07-07 - Dyre Banking Trojan Exploits CVE-2015-0057.pdf",
        "2015-07-13 - Revisiting The Bunitu Trojan.pdf",
        "2015-07-14 - BernhardPOS.pdf",
        "2015-07-14 - TeslaCrypt 2.0 disguised as CryptoWall.pdf",
        "2015-07-08 - Butterfly- Profiting from high-level corporate attacks.pdf",
        "2015-07-05 - Spy Tech Company 'Hacking Team' Gets Hacked.pdf",
        "2015-07-08 - Animal Farm APT and the Shadow of French Intelligence.pdf",
        "2015-07-16 - Github Repo with source code of cd00r.c.pdf",
        "2015-07-19 - The Faulty Precursor of Pykspa's DGA.pdf",
        "2015-07-31 - OTX Pulse on PlugX.pdf",
        "2015-08 - Uncovering the Seven Pointed Dagger.pdf",
        "2015-07-27 - UPS- Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload.pdf",
        "2015-07-13 - \u201cForkmeiamfamous\u201d- Seaduke, latest weapon in the Duke armory.pdf",
        "2015-07-20 - Watering Hole Attack on Aerospace Firm Exploits CVE-2015-5122 to Install IsSpace Backdoor.pdf",
        "2015-07-22 - Duke APT group's latest tools- cloud services and Linux support.pdf",
        "2015-07-30 - Sakula Malware Family.pdf",
        "2015-08-10 - Darkhotel\u2019s attacks in 2015.pdf",
        "2015-08-05 - Newly discovered Chinese hacking group hacked 100+ websites to use as \u201cwatering holes\u201d.pdf",
        "2015-07-31 - OTX- FBI Flash 68 (PlugX).pdf",
        "2015-07-30 - Operation Potao Express- Analysis of a cyber?espionage toolkit.pdf",
        "2015-08-18 - Knowledge Fragment- Unwrapping Fobber.pdf",
        "2015-08-12 - Islamic State Hacking Division.pdf",
        "2015-08-19 - Antak WebShell.pdf",
        "2015-08-12 - Tinba Trojan Sets Its Sights on Romania.pdf",
        "2015-08-05 - Newly discovered Chinese hacking group hacked over 100 websites to use as \u201cwatering holes\u201d.pdf",
        "2015-08-18 - ransomware open-sources.pdf",
        "2015-08-26 - Sphinx, a new variant of Zeus available for sale in the underground.pdf",
        "2015-08-19 - Inside Neutrino botnet builder.pdf",
        "2015-08-05 - Threat Group 3390 Cyberespionage.pdf",
        "2015-08-24 - Sphinx- New Zeus Variant for Sale on the Black Market.pdf",
        "2015-08-05 - Who\u2019s Behind Your Proxy- Uncovering Bunitu\u2019s Secrets.pdf",
        "2015-08-20 - Retefe Banking Trojan Targets Sweden, Switzerland and Japan.pdf",
        "2015-09-09 - Pony Stealer Malware.pdf",
        "2015-09-16 - Operation Iron Tiger- Attackers Shift from East Asia to the United States.pdf",
        "2015-08-27 - London Calling- Two-Factor Authentication Phishing From Iran.pdf",
        "2015-09-11 - CSI MacMark- Janicab.pdf",
        "2015-09-12 - Stuxnet code.pdf",
        "2015-09-23 - Chinese Actors Use \u20183102\u2019 Malware in Attacks on US Government and EU Media.pdf",
        "2015-08-27 - New Spear Phishing Campaign Pretends to be EFF.pdf",
        "2015-09-08 - Carbanak gang is back and packing new guns.pdf",
        "2015-09-03 - Three Variants of Murofet's DGA.pdf",
        "2015-09-01 - Attackers Target Organizations in Japan; Transform Local Sites into C&C Servers for EMDIVI Backdoor.pdf",
        "2015-08-31 - Shifu- \u2018Masterful\u2019 New Banking Trojan Is Attacking 14 Japanese Banks.pdf",
        "2015-09-14 - The Shade Encryptor- a Double Threat.pdf",
        "2015-09-11 - SUCEFUL- Next Generation ATM Malware.pdf",
        "2015-09-09 - Satellite Turla- APT Command and Control in the Sky.pdf",
        "2015-09-17 - The Dukes- 7 Years Of Russian Cyber-Espionage.pdf",
        "2015-09-24 - Credit Card-Scraping Kasidet Builder Leads to Spike in Detections.pdf",
        "2015-09-24 - Kovter malware learns from Poweliks with persistent fileless registry update.pdf",
        "2015-09-18 - Operation Arid Viper Slithers Back into View.pdf",
        "2015-09-01 - Fancy Bear.pdf",
        "2015-09-25 - Notes on Linux-Xor.DDoS.pdf",
        "2015-09-23 - Ranbyus's DGA, Revisited.pdf",
        "2015-09-29 - Andromeda Bot Analysis part 1.pdf",
        "2015-10-06 - I am HDRoot! Part 1.pdf",
        "2015-10-06 - Ticked Off- Upatre Malware\u2019s Simple Anti-analysis Trick to Defeat Sandboxes.pdf",
        "2015-10-01 - Linux.Rekoobe.1.pdf",
        "2015-10-06 - MOKER- A NEW APT DISCOVERED WITHIN A SENSITIVE NETWORK.pdf",
        "2015-10-06 - Targeted Attack Exposes OWA Weakness.pdf",
        "2015-09-28 - Gaza cybergang, where\u2019s your IR team-.pdf",
        "2015-10-12 - Keybase Logger-Clipboard-CredsStealer campaign.pdf",
        "2015-10-07 - Hacker Group Creates Network of Fake LinkedIn Profiles.pdf",
        "2015-10-09 - Latest TeslaCrypt Ransomware Borrows Code From Carberp Trojan.pdf",
        "2015-10-09 - Beta Bot Analysis- Part 1.pdf",
        "2015-10-13 - I am HDRoot! Part 2.pdf",
        "2015-09-28 - Two New PoS Malware Affecting US SMBs.pdf",
        "2015-10-13 - Dridex (Bugat v5) Botnet Takeover Operation.pdf",
        "2015-10-19 - Github Repository for AllaKore.pdf",
        "2015-10-16 - Surveillance Malware Trends- Tracking Predator Pain and HawkEye.pdf",
        "2015-10-13 - New Adobe Flash Zero-Day Used in Pawn Storm Campaign Targeting Foreign Affairs Ministries.pdf",
        "2015-09-24 - Meet GreenDispenser- A New Breed of ATM Malware.pdf",
        "2015-10-17 - How to Write Simple but Sound Yara Rules \u2013 Part 2.pdf",
        "2015-10-13 - Prolific Cybercrime Gang Favors Legit Login Credentials.pdf",
        "2015-10-15 - Archivist.pdf",
        "2015-09-23 - Quaverse RAT- Remote-Access-as-a-Service.pdf",
        "2015-10-26 - Duuzer back door Trojan targets South Korea to take over computers.pdf",
        "2015-10-22 - Pawn Storm Targets MH17 Investigation Team.pdf",
        "2015-11-02 - Troj-Cryakl-B.pdf",
        "2015-09-29 - Andromeda Bot Analysis part 2.pdf",
        "2015-10-28 - Reversing the C2C HTTP Emmental communication.pdf",
        "2015-11-02 - Modular trojan for hidden access to a computer.pdf",
        "2015-11-03 - Reversing the SMS C&C protocol of Emmental (1st part - understanding the code).pdf",
        "2015-11-05 - Sphinx Moth- Expanding our knowledge of the \u201cWild Neutron\u201d - \u201cMorpho\u201d APT.pdf",
        "2015-09-28 - Hammertoss- What, Me Worry-.pdf",
        "2015-10-08 - Dyre Malware Campaigners Innovate with Distribution Techniques.pdf",
        "2015-11-04 - \u201cOffline\u201d Ransomware Encrypts Your Data without C&C Communication.pdf",
        "2015-11-10 - Bookworm Trojan- A Model of Modular Architecture.pdf",
        "2015-11-11 - Operation Buhtrap malware distributed via ammyy.com.pdf",
        "2015-11-02 - Shifu \u2013 the rise of a self-destructive banking trojan.pdf",
        "2015-11-04 - DroidJack isn\u2019t the only spying software out there- Avast discovers OmniRat.pdf",
        "2015-11-17 - New Memory Scraping Technique in Cherry Picker PoS Malware.pdf",
        "2015-11-11 - AbaddonPOS- A new point of sale threat linked to Vawtrak.pdf",
        "2015-12-01 - China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets.pdf",
        "2015-11-16 - Shining the Spotlight on Cherry Picker PoS Malware.pdf",
        "2015-12-03 - Colombians major target of email campaigns delivering Xtreme RAT.pdf",
        "2015-11-04 - A Technical Look At Dyreza.pdf",
        "2015-12-04 - Sofacy APT hits high profile targets with updated toolset.pdf",
        "2015-12-16 - Nemucod malware spreads ransomware Teslacrypt around the world.pdf",
        "2015-12-08 - VT Report for SmartEyes.pdf",
        "2015-12-09 - Inside Chimera Ransomware - the first 'doxingware' in wild.pdf",
        "2015-12-18 - Attack on French Diplomat Linked to Operation Lotus Blossom.pdf",
        "2015-12-17 - SlemBunk- An Evolving Android Trojan Family Targeting Users of Worldwide Banking Apps.pdf",
        "2015-12-26 - Backdoor- Win32-Hesetox.A- vSkimmer POS Malware Analysis _.pdf",
        "2015-11-20 - A king's ransom- an analysis of the CTB-locker ransomware.pdf",
        "2015-11-16 - Introducing LogPOS.pdf",
        "2015-12-22 - Kraken's two Domain Generation Algorithms.pdf",
        "2015-12-07 - Iran-based attackers use back door threats to spy on Middle Eastern targets.pdf",
        "2015-11-06 - OmniRAT Takes Over Android Devices Through Social Engineering Tricks.pdf",
        "2015-12-11 - LATENTBOT- Trace Me If You Can.pdf",
        "2015-11-30 - Inside Braviax-FakeRean- An analysis and history of a FakeAV family.pdf",
        "2015-12-01 - Operation Black Atlas Endangers In-Store Card Payments and SMBs Worldwide; Switches between BlackPOS and Other Tools.pdf",
        "2015-12-22 - BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger.pdf",
        "Agent.BTZ to ComRAT.pdf",
        "2015-11-25 - Detecting GlassRAT using Security Analytics and ECAT.pdf",
        "2015-12-08 - Packrat- Seven Years of a South American Threat Actor.pdf",
        "Afghan Government Compromise - Browser Beware.pdf",
        "Anthem hack all roads lead to China.pdf",
        "ANALYSIS ON APT TO BE ATTACK THAT FOCUSING ON CHINAS GOVERNMENT AGENCY.pdf",
        "Animals in the APT Farm.pdf",
        "APT CVE-2015-5119.pdf",
        "APT 28 (1).pdf",
        "Attacks against Israeli & Palestinian interests.pdf",
        "APT group ups targets us gov.pdf",
        "Black Energy.pdf",
        "blog.pdf",
        "APT 28.pdf",
        "Babar.pdf",
        "Black Vine.pdf",
        "Behind the syria conflict.pdf",
        "Attacks on France TV5 Monde.pdf",
        "Casper Malware.pdf",
        "2015-12-31 - Overseas -Dark Inn- organization launched an APT attack on executives of domestic enterprises.pdf",
        "Demonstrating Hustle.pdf",
        "Cmstar Downloader.pdf",
        "Apt 28 (2).pdf",
        "Bookworm Trojan (1).pdf",
        "ANALYSIS ON APT-TO-BE ATTACK THAT FOCUSING ON CHINAS GOVERNMENT AGENCY.pdf",
        "Duke cloud Linux.pdf",
        "Dukes.pdf",
        "Duqu 2.0 Yara rules.pdf",
        "Duqu 2.0 Win32K Exploit.pdf",
        "Dino.pdf",
        "Duke cloud Linux (1).pdf",
        "Goldfish Phishing.pdf",
        "Indicators of Compormise Hellsing.pdf",
        "Rocket Kitten.pdf",
        "Trojan Skelky.pdf",
        "Wild Neutron.pdf",
        "2015-04-09 - The Banking Trojan Emotet- Detailed Analysis.pdf",
        "2015-07-23 - An Analysis of the Qadars Banking Trojan.pdf",
        "Babar or Bunny.pdf",
        "BBSRAT Roaming Tiger.pdf",
        "Blue termite (1).pdf",
        "China Peace Palace.pdf",
        "Copy Kittens.pdf",
        "Emdivi.pdf"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "kikinumpav",
        "id": "385742",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1032,
        "FileHash-SHA1": 544,
        "IPv4": 487,
        "FileHash-MD5": 1665,
        "URL": 673,
        "hostname": 959,
        "CVE": 45,
        "FileHash-SHA256": 411,
        "email": 11,
        "CIDR": 4,
        "BitcoinAddress": 2,
        "YARA": 7
      },
      "indicator_count": 5840,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 13,
      "modified_text": "29 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "FileHash-MD5",
      "related_indicator_is_active": 1
    },
    {
      "id": "69bf64e1d5e06aa6207f78de",
      "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos",
      "description": "",
      "modified": "2026-03-27T00:30:39.055000",
      "created": "2026-03-22T03:41:21.863000",
      "tags": [
        "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi",
        "9698f46495ce9401c8bcaf9a2afe1598",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)",
        "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71",
        "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link",
        "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)"
      ],
      "references": [
        "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
        "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
        "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
        "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
        "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
        "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
        "Verification failure observed in automated verification handlers during sandbox replay.",
        "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
        "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
        "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
        "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
        "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
        "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
        "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
        "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
        "",
        "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "China",
        "United States of America",
        "Spain",
        "Japan",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In"
      ],
      "TLP": "green",
      "cloned_from": "698e93e1ab02db8c49e8c3ed",
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 27572,
        "FileHash-SHA256": 46076,
        "FileHash-MD5": 42177,
        "FileHash-SHA1": 22874,
        "hostname": 33438,
        "URL": 74810,
        "SSLCertFingerprint": 21,
        "CVE": 7579,
        "email": 297,
        "FileHash-IMPHASH": 8,
        "CIDR": 26203,
        "JA3": 1
      },
      "indicator_count": 281056,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 149,
      "modified_text": "64 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "FileHash-MD5",
      "related_indicator_is_active": 1
    },
    {
      "id": "69bf64eccb5d39a90a3c391e",
      "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos",
      "description": "",
      "modified": "2026-03-27T00:30:39.055000",
      "created": "2026-03-22T03:41:32.565000",
      "tags": [
        "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi",
        "9698f46495ce9401c8bcaf9a2afe1598",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)",
        "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71",
        "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link",
        "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)"
      ],
      "references": [
        "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
        "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
        "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
        "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
        "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
        "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
        "Verification failure observed in automated verification handlers during sandbox replay.",
        "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
        "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
        "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
        "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
        "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
        "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
        "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
        "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
        "",
        "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "China",
        "United States of America",
        "Spain",
        "Japan",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In"
      ],
      "TLP": "green",
      "cloned_from": "698e93e1ab02db8c49e8c3ed",
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 27572,
        "FileHash-SHA256": 46076,
        "FileHash-MD5": 42177,
        "FileHash-SHA1": 22874,
        "hostname": 33438,
        "URL": 74810,
        "SSLCertFingerprint": 21,
        "CVE": 7579,
        "email": 297,
        "FileHash-IMPHASH": 8,
        "CIDR": 26203,
        "JA3": 1
      },
      "indicator_count": 281056,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 152,
      "modified_text": "64 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "FileHash-MD5",
      "related_indicator_is_active": 1
    },
    {
      "id": "69b211200d2561de69baba7d",
      "name": "equation drug clone AV",
      "description": "",
      "modified": "2026-03-12T01:04:32.845000",
      "created": "2026-03-12T01:04:32.845000",
      "tags": [],
      "references": [
        "https://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
      ],
      "public": 1,
      "adversary": null,
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "55006e5d13432a032406d7b3",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1,
        "hostname": 1,
        "FileHash-MD5": 24
      },
      "indicator_count": 26,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 65,
      "modified_text": "79 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "FileHash-MD5",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "b3487fdd1efd2d1ea1550fef5b749037",
    "type": "Hash"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "b3487fdd1efd2d1ea1550fef5b749037",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780177644.8144937
}