{
  "type": "URL",
  "indicator": "http://load.rwbcode.com/index.php",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "http://load.rwbcode.com/index.php",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4147062581,
      "indicator": "http://load.rwbcode.com/index.php",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "6916a9fe746743e69478d360",
          "name": "EbeeNov2025 Pt2",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2025-12-14T03:00:57.826000",
          "created": "2025-11-14T04:03:10.501000",
          "tags": [
            "filehashsha256",
            "filehashsha1",
            "filehashmd5",
            "cve20179805 cve"
          ],
          "references": [],
          "public": 1,
          "adversary": "LANDFALL, GootLoader, EndClient RAT, God RAT, Infrastructure aurologic GmbHUNK, RondoBox, Fantasy Hu",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 207,
            "FileHash-SHA1": 174,
            "FileHash-SHA256": 237,
            "domain": 153,
            "URL": 85,
            "CVE": 5,
            "hostname": 39
          },
          "indicator_count": 900,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 40,
          "modified_text": "170 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "690f3a03eed9bd637c11370b",
          "name": "Malware disguised as a health screening guidance document",
          "description": "In late October 2025, a coordinated attack attributed to the North Korean APT group Kimsuky utilized a JSE file masquerading as a medical examination guidance document to facilitate its initial infection vector. The file, named \"Health Check Guide.pdf.jse,\" is designed to be misleading, enticing victims to interact with it under the pretense of accessing health-related information. Upon execution, it runs obfuscated JavaScript code via WScript.exe, enabling the delivery of malicious payloads.",
          "modified": "2025-12-08T12:03:02.393000",
          "created": "2025-11-08T12:39:31.551000",
          "tags": [
            "kimsuky",
            "javascript",
            "base64",
            "aes128",
            "threat",
            "base640x6c",
            "hello"
          ],
          "references": [
            "https://logpresso.com/en/blog/2025-11-06-healthcheckup-malware"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1204.002",
              "name": "Malicious File",
              "display_name": "T1204.002 - Malicious File"
            },
            {
              "id": "T1566.001",
              "name": "Spearphishing Attachment",
              "display_name": "T1566.001 - Spearphishing Attachment"
            },
            {
              "id": "T1573.001",
              "name": "Symmetric Cryptography",
              "display_name": "T1573.001 - Symmetric Cryptography"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 4,
            "URL": 2,
            "hostname": 9
          },
          "indicator_count": 15,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 540,
          "modified_text": "176 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://logpresso.com/en/blog/2025-11-06-healthcheckup-malware"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "LANDFALL, GootLoader, EndClient RAT, God RAT, Infrastructure aurologic GmbHUNK, RondoBox, Fantasy Hu"
          ],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 962
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/rwbcode.com",
    "whois": "http://whois.domaintools.com/rwbcode.com",
    "domain": "rwbcode.com",
    "hostname": "load.rwbcode.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "6916a9fe746743e69478d360",
      "name": "EbeeNov2025 Pt2",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2025-12-14T03:00:57.826000",
      "created": "2025-11-14T04:03:10.501000",
      "tags": [
        "filehashsha256",
        "filehashsha1",
        "filehashmd5",
        "cve20179805 cve"
      ],
      "references": [],
      "public": 1,
      "adversary": "LANDFALL, GootLoader, EndClient RAT, God RAT, Infrastructure aurologic GmbHUNK, RondoBox, Fantasy Hu",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 207,
        "FileHash-SHA1": 174,
        "FileHash-SHA256": 237,
        "domain": 153,
        "URL": 85,
        "CVE": 5,
        "hostname": 39
      },
      "indicator_count": 900,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 40,
      "modified_text": "170 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "690f3a03eed9bd637c11370b",
      "name": "Malware disguised as a health screening guidance document",
      "description": "In late October 2025, a coordinated attack attributed to the North Korean APT group Kimsuky utilized a JSE file masquerading as a medical examination guidance document to facilitate its initial infection vector. The file, named \"Health Check Guide.pdf.jse,\" is designed to be misleading, enticing victims to interact with it under the pretense of accessing health-related information. Upon execution, it runs obfuscated JavaScript code via WScript.exe, enabling the delivery of malicious payloads.",
      "modified": "2025-12-08T12:03:02.393000",
      "created": "2025-11-08T12:39:31.551000",
      "tags": [
        "kimsuky",
        "javascript",
        "base64",
        "aes128",
        "threat",
        "base640x6c",
        "hello"
      ],
      "references": [
        "https://logpresso.com/en/blog/2025-11-06-healthcheckup-malware"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1204.002",
          "name": "Malicious File",
          "display_name": "T1204.002 - Malicious File"
        },
        {
          "id": "T1566.001",
          "name": "Spearphishing Attachment",
          "display_name": "T1566.001 - Spearphishing Attachment"
        },
        {
          "id": "T1573.001",
          "name": "Symmetric Cryptography",
          "display_name": "T1573.001 - Symmetric Cryptography"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 4,
        "URL": 2,
        "hostname": 9
      },
      "indicator_count": 15,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 540,
      "modified_text": "176 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "http://load.rwbcode.com/index.php",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "http://load.rwbcode.com/index.php",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780405893.7388752
}