{ "type": "URL", "indicator": "https://e.l.target", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://e.l.target", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3212244255, "indicator": "https://e.l.target", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 20, "pulses": [ { "id": "663d2869e0f3a42bbddc42ff", "name": "UPX executable packer.", "description": "A new rule has been introduced a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"", "modified": "2024-10-14T00:01:17.069000", "created": "2024-05-09T19:47:53.786000", "tags": [ "cioch adrian", "centrum usug", "sieciowych", "elf binary", "upx compression", "roth", "nextron", "info", "javascript", "html", "office open", "xml document", "network capture", "win32 exe", "xml pakietu", "pdf zestawy", "przechwytywanie", "office", "filehashsha1", "url https", "cve cve20201070", "cve cve20203153", "cve cve20201048", "cve cve20211732", "cve20201048 apr", "filehashmd5", "cve cve20010901", "cve cve20021841", "cve20153202 apr", "cve cve20160728", "cve cve20161807", "cve cve20175123", "cve20185407 apr", "cve cve20054605", "cve cve20060745", "cve cve20070452", "cve cve20070453", "cve cve20070454", "cve cve20071355", "cve cve20071358", "cve cve20071871", "cve20149614 apr", "cve cve20151503", "cve cve20152080", "cve cve20157377", "cve cve20170131", "cve20200796 may", "cve cve20113403" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6861, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5771, "domain": 3139, "URL": 14525, "FileHash-SHA1": 2610, "IPv4": 108, "CIDR": 40, "FileHash-SHA256": 10705, "FileHash-MD5": 3373, "YARA": 2, "CVE": 148, "Mutex": 7, "FilePath": 3, "SSLCertFingerprint": 3, "email": 23, "JA3": 1, "IPv6": 2 }, "indicator_count": 40460, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "595 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708eb824dc4c51811f6de9", "name": "Indusface - in YOUR face ;)", "description": "", "modified": "2023-12-06T15:09:44.273000", "created": "2023-12-06T15:09:44.273000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 307, "hostname": 333, "domain": 192, "URL": 1143, "FileHash-MD5": 1 }, "indicator_count": 1976, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708d657f0895a860febf8f", "name": "SafeFrame Container", "description": "", "modified": "2023-12-06T15:04:05.932000", "created": "2023-12-06T15:04:05.932000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1416, "domain": 2979, "URL": 8250, "hostname": 2262 }, "indicator_count": 14907, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708cca842536f1582636be", "name": "apeiron.global", "description": "", "modified": "2023-12-06T15:01:30.558000", "created": "2023-12-06T15:01:30.558000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 498, "hostname": 388, "domain": 242, "CVE": 1, "URL": 1203, "FileHash-MD5": 1 }, "indicator_count": 2333, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657080735501c11ddbb7a988", "name": "Dominionvoting.com 03.03.22", "description": "", "modified": "2023-12-06T14:08:51.329000", "created": "2023-12-06T14:08:51.329000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 663, "hostname": 588, "domain": 413, "URL": 2183, "FileHash-MD5": 7 }, "indicator_count": 3854, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570805953274b32ec1f981b", "name": "Votebuilder.com", "description": "", "modified": "2023-12-06T14:08:25.588000", "created": "2023-12-06T14:08:25.588000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 869, "domain": 834, "URL": 4755, "hostname": 1559, "CIDR": 2, "FileHash-MD5": 10 }, "indicator_count": 8029, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62e80d56fba248bac0744780", "name": "\ud83e\udd14\ud83d\udea8 Could this be the source of all Evil? \ud83d\udea8\ud83e\udd14 Nubotnet - Team:KU Leuven/test2 - 2021.igem.org", "description": "", "modified": "2022-08-31T00:01:05.509000", "created": "2022-08-01T17:28:54.991000", "tags": [ "apt", "runtime data", "decrypted ssl", "pcap", "windows nt", "tops", "cookie", "typeof t", "element", "error", "matrix", "typeerror", "bmfloor", "frameelement", "null", "skew", "parade" ], "references": [ "https://2021.igem.org/Team:KU_Leuven/test2", "https://hybrid-analysis.com/sample/e126ff94aac3340dc05a27f062c4267cbfeaa998248bef0e72f000bba711aa76/62e6fb475edc950b894aa7b0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1696, "domain": 586, "hostname": 613, "FileHash-SHA256": 533, "FileHash-MD5": 34, "FileHash-SHA1": 33, "email": 1 }, "indicator_count": 3496, "is_author": false, "is_subscribing": null, "subscriber_count": 394, "modified_text": "1370 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62752a3d78ce35783bfc85cc", "name": "SafeFrame Container", "description": "If you want to know what is going to happen when you create a non-iterable object, try these three pieces of code in the form of a new \"word\" or \"phrase\".", "modified": "2022-06-05T00:03:45.266000", "created": "2022-05-06T14:01:33.267000", "tags": [ "public", "typeof", "typeof define", "array", "typeerror", "typeof symbol", "error", "typeof enulle", "sdkversion", "internal", "date", "cnzzdata", "czuuid", "umdistinctid", "typeof e", "typeof t", "version", "swiper", "most", "copyright", "mit license", "april", "trident", "win32", "class", "lh", "vd", "function", "overlaylevel", "zdhxiong", "customevent", "symbol", "object", "string", "number", "null", "uint8array", "typeof b", "iframe", "android", "embed", "meta", "0x14a", "0x104", "0x97", "0xe1", "0x228", "0x12b", "0x14e", "0xf5", "0x11a", "0xc6", "sxa0", "typeof d", "closure library", "array int8array", "b1342177279", "regexp", "typeof r", "pseudo", "child", "typeof n", "template", "void", "this", "ienew ca", "quota", "aafunction", "dafunction", "gc", "trackpageview", "trackevent", "gtmmdcvhgd", "node", "element", "path", "reduceright", "p420", "gc3w7t6h5qw", "kafunction", "fafafa", "xlfunction", "kkfunction", "nkfunction", "qkfunction", "rkfunction", "skfunction", "span", "edge", "bad idp", "bad event", "crios", "invalid attempt", "afunction", "ufunction", "kfunction" ], "references": [ "xfe-URL-himado.com-stix2-2.1-export.json", "xfe-IP-146.148.236.187-stix2-2.1-export.json", "xfe-URL-Psychz.net-stix2-2.1-export.json", "https://cdn.ampproject.org/rtv/012204221712000/amp4ads-host-v0.js", "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_0?le=scs", "https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022050201.js", "https://www.googletagmanager.com/gtag/js?id=G-C3W7T6H5QW&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtm.js?id=GTM-MDCVHGD", "https://www.googletagmanager.com/gtag/js?id=UA-122335014-2", "https://himado.com/heihei/layui/layui.all.js", "https://securepubads.g.doubleclick.net/tag/js/gpt.js", "https://himado.com/cdn-cgi/challenge-platform/h/g/scripts/invisible.js?ts=1651842000", "https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050201.js", "https://himado.com/heihei/node_modules/mdui/dist/js/mdui.min.js", "https://himado.com/heihei/js/swiper.min.js", "https://cdn.onesignal.com/sdks/OneSignalSDK.js", "https://c.cnzz.com/core.php?web_id=1280305902&t=z", "https://s4.cnzz.com/z_stat.php?id=1280305902&web_id=1280305902", "https://www.gstatic.com/firebasejs/8.1.2/firebase-app.js", "https://281cecd8ae73dff542e13679e60d5fb9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html", "xfe-URL-Cnzz.com-stix2-2.1-export.json", "xfe-URL-Aliyun.com-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Lh", "display_name": "Lh", "target": null }, { "id": "Gc", "display_name": "Gc", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null }, { "id": "Vd", "display_name": "Vd", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2262, "URL": 8251, "FileHash-SHA256": 1416, "domain": 2979 }, "indicator_count": 14908, "is_author": false, "is_subscribing": null, "subscriber_count": 71, "modified_text": "1457 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62756a0d14664003affb0555", "name": "hush.com 301 to hushmail.com", "description": "var b[f, gw.b, \"dust\" - a.g - has been added to an Array by the end of the year, if there is any chance of it being added.", "modified": "2022-06-05T00:03:45.266000", "created": "2022-05-06T18:33:49.161000", "tags": [ "widget", "null", "regexp", "array", "copyright", "license", "calltrkswap", "date", "typeof s", "xmlhttprequest", "typeof r", "script", "vd", "number", "string", "ienew ca", "closure library", "error", "quota", "aafunction", "dafunction", "function", "typeof o", "reduceright", "aw1070742489", "uint8array", "void", "code", "typeof symbol", "wickedclientid", "wickedemail", "wickedurl", "wickednullurl", "typeof e", "direct", "typeof require", "modulenotfound", "mini", "cnull", "anull", "nl50", "pnull", "okcancel", "compiled", "true", "android", "trident", "form", "window", "false", "acronym", "body", "canvas", "embed", "footer", "iframe", "keygen", "legend", "mark", "meta", "ruby", "small", "span", "template", "blank", "twitter", "typeof t", "class", "attr", "pseudo", "child", "js foundation", "typeof module", "width", "object", "this", "accept", "fnumber", "gtmmf25krh", "host", "path" ], "references": [ "xfe-URL-Hush.com-stix2-2.1-export.json", "https://www.googletagmanager.com/gtag/js?id=AW-1070742489&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtm.js?id=GTM-MF25KRH", "https://www.hushmail.com/shared/javascript/jquery-3.5.1.min.js", "https://www.hushmail.com/javascriptinclude/eNrLKC3OyE3MzIkvT00qzixJtSpITE_V98lPz8xzyy_K1csqtjI0MzK2MDcwsbS0ysCq2qkov7w4tSi4JLGkGFUDAF_tIM0,.en_US.68448bd8190f2f2bae9633f547bbbbbe.0.js", "https://www.hushmail.com/javascriptinclude/eNpNzEEOQDAQQNEbtVoM7Sks7GXopB0pkQ5xfWJl-5P3JWGh4AvukSRzoKKtqlWlf0Wt4k3rnG2g641Pl6QNOU83zcIn-QMj6ZHpHQ2FF97jiHOmj0ED4FxfwQOf9yPU.en_US.68448bd8190f2f2bae9633f547bbbbbe.0.js", "https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js", "https://widget.wickedreports.com/widget.js", "https://www.googletagmanager.com/gtag/js?id=AW-1070742489", "https://www.hushmail.com/status/", "https://script.tapfiliate.com/tapfiliate.js", "https://www.googletagmanager.com/gtag/js?id=UA-1837381-13", "https://widget.wickedreports.com/v2/3469/wr-dafa9fae816c2f65d24d1eb593b58626.js", "https://cdn.callrail.com/companies/431115301/7c8f964bc12313c75ad2/12/swap.js", "https://js.callrail.com/group/0/7c8f964bc12313c75ad2/06ababf0-8852-4eef-95e1-285ae467a93a/poll.js?t=1651861725881&ids%5B%5D=431115301", "https://js.callrail.com/group/0/7c8f964bc12313c75ad2/06ababf0-8852-4eef-95e1-285ae467a93a/poll.js?t=1651861793229&ids%5B%5D=431115301", "https://widget.trustpilot.com/trustboxes/5406e65db0d04a09e042d5fc/index.html?templateId=5406e65db0d04a09e042d5fc&businessunitId=4bdc496b000064000505a89d#locale=en-US&styleHeight=28px&styleWidth=100%25&theme=light" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Vd", "display_name": "Vd", "target": null }, { "id": "OkCancel", "display_name": "OkCancel", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1531", "name": "Account Access Removal", "display_name": "T1531 - Account Access Removal" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1917, "hostname": 698, "FileHash-SHA256": 116, "domain": 263 }, "indicator_count": 2994, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1457 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62751d6e20ce7971fe122760", "name": "layerhost.com", "description": "function ra(a,b,c,d,e,f, a new type of node, which can only be defined by its own type, is the same as its current type.", "modified": "2022-06-05T00:03:45.266000", "created": "2022-05-06T13:06:54.626000", "tags": [ "typeerror", "function", "string", "urlsearchparams", "array", "object", "typeof t", "incorrect", "boolean", "iterator", "target", "error", "typeof o", "date", "typeof symbol", "window", "promise", "iere", "typeof ne", "null", "body", "this", "regexp", "please", "blob", "matomo", "post", "javascript", "link", "license", "info", "campaigns", "storagetest", "typeof json", "sufeffxa0", "typeof c", "document", "invalid attempt", "chat", "search", "language", "feel", "file", "call", "strongstart", "address", "again", "attrs", "cparseint", "dparseint", "bparseint", "9999px", "fparseint", "eparseint", "bnull", "gparseint", "iparseint", "blank", "trident", "fixedpos", "fixedheader", "click", "rotate", "dataslider", "eventtarget", "basicstructure", "moztransition", "gthis", "preventdefault", "bthis", "regexcss", "xthis", "true", "filterizr api", "filterizr", "value", "ease", "steps", "idle", "classcallcheck", "reveal", "init", "drilldown", "dropdown", "dropdownmenu", "orbit", "slider", "burn", "sticky", "keyboard", "eventkey", "apple cmd", "mapping", "mouse", "input", "cache", "button", "checkbox", "shift", "typeof b", "pseudo", "child", "class", "attr", "void", "secure", "result" ], "references": [ "xfe-IP-134.73.11.118-stix2-2.1-export.json", "xfe-URL-Powr.io-stix2-2.1-export 2.json", "xfe-URL-Layerhost.com-stix2-2.1-export.json", "xfe-URL-https___www.gandi.net-stix2-2.1-export.json", "https://www.powr.io/powr.js?platform=html", "https://www.layerhost.com/assets/js/vendor/jquery.min.js", "https://www.layerhost.com/assets/js/vendor/what-input.js", "https://www.layerhost.com/assets/js/vendor/foundation.min.js", "https://www.layerhost.com/assets/js/jquery.filterizr.min.js", "https://www.layerhost.com/assets/js/yui.js", "https://www.layerhost.com/assets/js/app.js", "https://www.layerhost.com/assets/js/slider.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/languages/en.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/js/twk-chunk-2d0d2b7c.js", "https://tag.aticdn.net/616708/smarttag.js", "https://analytics.gandi.net/piwik.js", "https://www.gandi.net/static/js/modern.27ee934b0dc5.js", "https://www.gandi.net/static/js/legacy.7cc648e3ff7a.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "EventTarget", "display_name": "EventTarget", "target": null }, { "id": "Filterizr API", "display_name": "Filterizr API", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 350, "URL": 2035, "hostname": 718, "FileHash-SHA256": 355, "CVE": 1, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 3461, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1457 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "626a8a564da0d5b27dc02619", "name": "App By Web", "description": "Israeli malware hosting", "modified": "2022-05-28T00:03:46.141000", "created": "2022-04-28T12:36:38.103000", "tags": [ "hebrew", "truetype", "woff2", "woff", "body", "fh5cooffcanvas", "function", "click", "main menu", "superfish var", "parallax", "offcanvas", "mobile menu", "animations var", "mstouchaction", "superfish menu", "plugin", "copyright", "joel birch", "dual", "fill", "touchaction", "y position", "hoverintent", "brian cherne", "param", "threshold", "mit license", "or selector", "author", "1parseint", "mark dalgleish", "http", "webkitopacity", "webkit", "khtmlopacity", "khtml", "typeof d", "error", "this", "caleb troughton", "typeof f", "adapter", "bootstrap", "javascript", "typeof c", "twitter", "focus", "azaz", "including", "this software", "but not", "limited to", "terms of", "open", "bsd license", "redistribution", "redistributions", "neither", "direct", "gc", "regexp", "typeof b", "pseudo", "child", "array", "width", "sufeffxa0", "class", "null", "date", "accept", "boolean", "modernizr", "custom build", "build", "afunction", "cfunction", "typeerror", "object", "documenttouch", "websocket", "string", "silk", "script", "arial", "edge", "iframe", "promise", "void", "android", "trident", "embed", "meta", "roboto", "term", "\u05d4\u05d6\u05de\u05e0\u05ea \u05de\u05d5\u05e0\u05d9\u05ea", "wtaxi", "wapp", "app by web ltd", "03-5115656", "03-5109109", "+97235115656", "\u05de\u05e2\u05e8\u05db\u05d5\u05ea \u05d4\u05e1\u05e2\u05d9\u05dd", "\u05db\u05e8\u05d8\u05d9\u05e1 \u05d0\u05e9\u05e8\u05d0\u05d9 \u05d1\u05de\u05d5\u05e0\u05d9\u05ea", "web ltd", "reserved" ], "references": [ "xfe-URL-appbyweb.net-stix2-2.1-export.json", "http://appbyweb.net/AppByWeb", "https://partner.googleadservices.com/gampad/cookie.js?domain=appbyweb.net&callback=_gfp_s_&client=ca-pub-2581829468247892", "https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_fy2019.js", "http://appbyweb.net/AppByWeb/js/modernizr-2.6.2.min.js", "http://appbyweb.net/AppByWeb/js/jquery.min.js", "http://appbyweb.net/AppByWeb/js/jquery.easing.1.3.js", "http://appbyweb.net/AppByWeb/js/bootstrap.min.js", "http://appbyweb.net/AppByWeb/js/jquery.waypoints.min.js", "http://appbyweb.net/AppByWeb/js/jquery.stellar.min.js", "http://appbyweb.net/AppByWeb/js/hoverIntent.js", "http://appbyweb.net/AppByWeb/js/superfish.js", "http://appbyweb.net/AppByWeb/js/main.js", "https://files.appbyweb.net/Fonts/OpenSansHebrew/font.css", "https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2581829468247892&output=html&adk=1812271804&adf=3025194257&lmt=1651149220&plat=16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C32%3A32&format=0x0&url=http%3A%2F%2Fappbyweb.net%2FAppByWeb%2F&ea=0&pra=5&wgl=1&dt=1651149220376&bpp=1&bdt=121&idt=18&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3De83d6067a4dac5b6-229192c549d200d1%3AT%3D1651148802%3ART%3D1651148802%3AS%3DALNI_MZSt9utXhYBHAIH9xwQp72WuxQxTw&nras=1&correlator=1655793633284&" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1554, "hostname": 533, "domain": 211, "FileHash-SHA256": 199 }, "indicator_count": 2497, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1465 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6269a10ba1925979929dc566", "name": "apeiron.global", "description": "New RegExp(M) is a new type, and it will change any of the elements to the same type if you want to add them to your HTML page or add a third element.", "modified": "2022-05-27T00:00:15.468000", "created": "2022-04-27T20:01:15.714000", "tags": [ "click", "getclicktarget", "date", "contexttrack", "view", "installtrigger", "processlink", "typeof blog", "msie", "image", "nonce", "script", "please do", "not copy", "and paste", "this code", "cgrecaptchacfg", "ngrecaptcha", "recaptchaapi", "render", "typeerror", "symbol", "error", "generator", "typeof e", "addtoany", "span", "facebook", "button", "helvetica neue", "subscribe", "email", "share", "arial", "helvetica", "light", "path", "discord", "find", "twitter", "push", "buttons", "typetext", "typeof intl", "intl", "event", "uefunction", "typeof define", "typeof module", "html tags", "ox20trnf", "dom element", "gc", "regexp", "typeof t", "class", "attr", "pseudo", "child", "function", "select", "string", "strong", "uint8array", "number", "edge", "null", "this", "iframe", "verify", "trident", "void", "next", "android", "stop", "enterprise", "form" ], "references": [ "xfe-IP-103.136.42.186-stix2-2.1-export.json", "https://www.gstatic.com/recaptcha/releases/2W_gRz39xX8G13fM-OdyQPlc/recaptcha__en.js", "https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery.min.js", "https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery-migrate.min.js", "https://static.addtoany.com/menu/page.js", "https://c0.wp.com/p/jetpack/10.7/_inc/build/photon/photon.min.js", "https://c0.wp.com/c/5.9.3/wp-includes/js/dist/vendor/regenerator-runtime.min.js", "https://stats.wp.com/e-202217.js", "https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdNytsaAAAAANS6DW8pofQamH4toQAAgfF7Q8qW&co=aHR0cHM6Ly93d3cuYXBlaXJvbi5nbG9iYWw6NDQz&hl=en&v=2W_gRz39xX8G13fM-OdyQPlc&size=invisible&cb=ghnkw160kgfd", "https://static.addtoany.com/menu/sm.23.html#type=core&event=load&url=https%3A%2F%2Fwww.apeiron.global%2F&referrer=", "xfe-URL-https___c0.wp.com_-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "GC", "display_name": "GC", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 498, "domain": 242, "URL": 1203, "hostname": 388, "CVE": 1, "FileHash-MD5": 1 }, "indicator_count": 2333, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1466 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6266c416c4598fa139868c64", "name": "\u05de\u05e9\u05e8\u05d3 \u05e4\u05e8\u05e1\u05d5\u05dd \u05d5\u05d1\u05e0\u05d9\u05d9\u05ea \u05d0\u05ea\u05e8\u05d9\u05dd | TOPWEB - \u05d8\u05d5\u05e4 \u05d5\u05d5\u05d1- \u05d4\u05d5\u05e4\u05db\u05d9\u05dd \u05e2\u05e1\u05e7\u05d9\u05dd \u05dc\u05de\u05d5\u05ea\u05d2\u05d9\u05dd \u05d1\u05d3\u05d9\u05d2\u05d9\u05d8\u05dc", "description": "New RegExp(M) is a new type, and it will change any of the elements to the same type if you want to add them to your HTML page or add a third element.", "modified": "2022-05-25T00:04:03.622000", "created": "2022-04-25T15:53:58.206000", "tags": [ "init", "803911410135716", "pageview", "date", "datalayer", "gtmnqnvc6k", "copyright", "closure library", "facebook", "google", "linkedin", "reddit", "tumblr", "digg", "stumbleupon", "telegram", "whatsapp", "email", "kfunction", "u05deu05dcu05d0", "aw363516812", "error", "promise", "inull", "webfontconfig", "webfont", "gc", "number", "string", "uint8array", "regexp", "xhfunction", "yhfunction", "host", "path", "code", "topweb", "top web", "beyond", "forex", "hackeru", "one stop", "shop", "bgroup", "typesubmit", "datasecret", "shape", "html", "span", "false", "scrl", "haschildren", "zoomindown", "show hide", "dark", "checkbox", "back", "light", "typeof e", "formdata", "typeof symbol", "customevent", "post", "refill", "wpcf7", "wpcf7locale", "wpcf7unittag", "reflect", "math", "array", "object", "typeerror", "symbol", "function", "null", "title", "body", "click", "lecount", "count", "typeof define", "typeof t", "this", "close", "twitter", "open", "next", "blank", "xpercent0", "failure", "xpercent50", "essential grid", "blackberry", "author", "themepunch", "android", "typeof module", "tweenlite", "version", "onull", "updates and", "tools", "linear", "ticker", "bounce", "alpha", "fancybox", "plugin", "janis skarnelis", "100n", "right", "bottom", "left", "html tags", "ox20trnf", "dom element", "class", "attr", "pseudo", "child", "js foundation", "udc66udc67", "ud83d", "ufe0f", "ud83e", "udc68udc69", "udfcbudfcc", "u2640u2642", "source", "image", "ud83dudc6cud83c" ], "references": [ "xfe-URL-anyweb.co.il-stix2-2.1-export.json", "https://anyweb.co.il/wp-includes/js/wp-emoji-release.min.js?ver=5.7.3", "https://anyweb.co.il/wp-includes/js/jquery/jquery.min.js?ver=3.5.1", "https://anyweb.co.il/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2", "https://anyweb.co.il/wp-content/plugins/essential-grid/public/assets/js/lightbox.js?ver=2.0.9.1", "https://anyweb.co.il/wp-content/plugins/essential-grid/public/assets/js/jquery.themepunch.tools.min.js?ver=2.0.9.1", "https://anyweb.co.il/wp-content/plugins/essential-grid/public/assets/js/jquery.themepunch.essential.min.js?ver=2.0.9.1", "https://anyweb.co.il/wp-content/themes/superfine/assets/js/assets.js?ver=5.7.3", "https://anyweb.co.il/wp-content/themes/superfine/assets/js/post-like.min.js?ver=1.0", "https://anyweb.co.il/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4", "https://anyweb.co.il/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.4.1", "https://anyweb.co.il/wp-content/themes/superfine/assets/js/script.js", "https://anyweb.co.il/wp-includes/js/wp-embed.min.js?ver=5.7.3", "https://anyweb.co.il/wp-includes/css/dist/block-library/style.min.css?ver=5.7.3", "https://topweb.co.il/", "https://www.googletagmanager.com/gtm.js?id=GTM-NQNVC6K", "https://topweb.co.il/wp-content/plugins/litespeed-cache/assets/js/webfontloader.min.js", "https://topweb.co.il/wp-content/litespeed/js/c3a18f91ebd798da3e120a12aec7c615.js?ver=7c615", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/363516812/?random=1650901467024&cv=9&fst=1650901467024&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2oa4k0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Ftopweb.co.il%2F&tiba=%D7%9E%D7%A9%D7%A8%D7%93%20%D7%A4%D7%A8%D7%A1%D7%95%D7%9D%20%D7%95%D7%91%D7%A0%D7%99%D7%99%D7%AA%20%D7%90%D7%AA%D7%A8%D7%99%D7%9D%20%7C%20TOPWEB%20-%20%D7%98%D" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1158, "FileHash-SHA256": 671, "hostname": 304, "domain": 329, "email": 2 }, "indicator_count": 2464, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1468 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "628c310ac9ae8e3e8f352e3d", "name": "Indusface - in YOUR face ;)", "description": "function D(t,e,n), as well as window.com, has been frozen by a single function, as part of a series of \"snoopers' checks\"...", "modified": "2022-05-24T01:12:42.216000", "created": "2022-05-24T01:12:42.216000", "tags": [ "fontawesome", "font awesome", "free", "license", "cc by", "sil ofl", "code", "mit license", "uf007", "uf017", "segoe ui", "emoji", "woff2", "roboto", "helvetica neue", "arial", "apple color", "symbol", "noto color", "type", "getcookie", "mxqueryparams", "samesitenone", "secure", "mxcookie", "date", "null", "domain", "orgcode", "message", "apino", "allow", "close", "safari", "large safari", "subscribe", "segment1", "segment2", "pushengage", "click", "scroll", "body", "iframe", "false", "typeof e", "array", "typeof t", "swiper", "most", "copyright", "july", "android", "win32", "version", "typeof n", "typeerror", "startr", "endr", "default", "typeof", "defaulttype", "function", "error", "shown", "flip", "regexp", "mozt", "mstransitionend", "webkitt", "dom element", "ua83948896", "gtmpf7h94q", "vendor site", "widget id", "page url", "write", "message api", "february", "april", "june", "august", "fbcd", "398410357733708", "prop", "init", "autoconfig", "protocol", "adnxsdomain", "aoldomain", "adrolltpc", "26015787", "reduceright", "tracking file", "number", "string", "aw827450946", "uint8array", "fnumber", "dustmap", "void", "class", "attr", "pseudo", "child", "typeof module", "trackevent", "trackpageview", "register", "path", "download", "verify", "xsnull", "script", "closure library", "xdfunction", "typeof window", "syntaxerror", "xmlhttprequest", "samesitelax", "innull", "ennull", "typeof symbol", "boolean", "circular", "customevent", "cuxref", "new r", "infinity", "image", "pnull", "html", "style", "ctnull", "post", "uint32array", "fanull", "ynull", "config", "meta", "accept" ], "references": [ "https://k.clarity.ms/s/0.6.34/clarity.js", "https://www.clarity.ms/tag/uet/26015787", "https://dc.cux.io/analyzer.js", "https://sc.lfeeder.com/lftracker_v1_kn9Eq4R1l2K7RlvP.js", "https://www.google-analytics.com/gtm/js?id=GTM-PF7H94Q&t=gartner&cid=559436367.1653353775", "https://www.googletagmanager.com/gtm.js?id=GTM-PMC6JX", "https://www.indusface.com/js/fontawesome.js.pagespeed.jm.X4kSHwBNxI.js", "https://www.indusface.com/js/jquery.3.5.1.min.js.pagespeed.jm.A8biqtTJrt.js", "https://www.googletagmanager.com/gtag/js?id=AW-827450946", "https://tracking.g2crowd.com/attribution_tracking/conversions/2226.js?p=https://www.indusface.com/&e=", "https://bat.bing.com/p/action/26015787.js", "https://s.adroll.com/j/pre/Q7CW4G7ZJJGWDLUB76P5IV/WH2M5MREOVC4HNKNZPPJZR/index.js", "https://d.adroll.com/consent/check/Q7CW4G7ZJJGWDLUB76P5IV?adroll_fpc=7c06a492879ac231294c1fe2e6e394f3-1653353535991&arrfrr=https%3A%2F%2Fwww.indusface.com%2F&_s=1316674c131c34cc157a9ad9119512a2&_b=2", "https://d.adroll.com/pixel/Q7CW4G7ZJJGWDLUB76P5IV/WH2M5MREOVC4HNKNZPPJZR?adroll_fpc=7c06a492879ac231294c1fe2e6e394f3-1653353535991&arrfrr=https%3A%2F%2Fwww.indusface.com%2F&pv=54603716107.79724&cookie=BIJ6M3OZKNCW7OIMIJSZED%3A2%7CWH2M5MREOVC4HNKNZPPJZR%3A2%7CQ7CW4G7ZJJGWDLUB76P5IV%3A2&adroll_s_ref=&keyw=&adroll_external_data=", "https://s.adroll.com/j/sendrolling.js", "https://web.mxradon.com/t/WebTracker.aspx?p1=18917&p2=Web%20Application%20Security%2C%20WAF%2C%20SSL%20Certificates&p3=-1&p4=&p5=1&p6=8415a029-248f-4eeb-bc18-338560430ff7&p7=&p8=&p9=0", "https://trackcmp.net/visit?actid=223422163&e=&r=&u=https%3A%2F%2Fwww.indusface.com%2F", "https://www.gartner.com/reviews/public/Widget/js/widget.js", "https://www.indusface.com/js/cookieconsent.min.js.pagespeed.jm.FCA-2RWV9s.js", "https://www.indusface.com/js/popper.min.js+bootstrap.min.js+modernizr-custom.js+menu.js.pagespeed.jc.WlixBHq4Fv.js", "https://www.indusface.com/js/swiper.min.js.pagespeed.jm.47RtcloJQ-.js", "https://clientcdn.pushengage.com/core/80780b73b5a3f4655fee62041e51f1be.js", "https://web.mxradon.com/t/Tracker.js", "https://www.indusface.com/css/A.font-styles1.css+bootstrap.css+skin.css+responsive.css+menu.css+swiper.min.css,Mcc.nAV12exFII.css.pagespeed.cf.a_yWJedOjY.css", "https://kit-free.fontawesome.com/releases/latest/css/free-v4-font-face.min.css", "https://www.indusface.com/css/A.cookieconsent.min.css.pagespeed.cf.t1fRd9Ouvj.css" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1144, "hostname": 333, "FileHash-SHA256": 307, "domain": 192, "FileHash-MD5": 1 }, "indicator_count": 1977, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1469 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62634f4db80546374654f4c4", "name": "frantech.ca - malware", "description": "T,t.F, t.f, is written in the same place as the following:t, d. F, has been added to the end of the document, as well as its own propertyDescriptor.", "modified": "2022-05-22T00:01:01.264000", "created": "2022-04-23T00:58:53.444000", "tags": [ "overview", "typeof symbol", "error", "typeerror", "object", "typeof t", "string", "typeof e", "function", "array", "promise", "date", "target", "class", "path", "back", "bounce", "this", "iframe", "null", "0x105684", "0xb66229", "0xb9b329", "0x3eed40", "0x2923e0", "cookie", "0x1d2d25", "0x2d6b", "0x538ea5", "0x240c1a", "push", "shift", "open" ], "references": [ "xfe-URL-https___my.frantech.ca_-stix2-2.1-export.json", "xfe-URL-frantech.ca-stix2-2.1-export.json", "https://my.frantech.ca/templates/lagom/assets/js/lagom-app.min.js?v=1.4.3", "https://my.frantech.ca/templates/lagom/assets/js/whmcs-custom.min.js?v=1.4.3" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 757, "hostname": 498, "domain": 311, "FileHash-SHA256": 21 }, "indicator_count": 1587, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1471 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624fff22683106d256390a89", "name": "'Chinese botnet", "description": "\u00c2\u00a31.3m (838m euros) - that is the amount of money the Chinese government has to spend on upgrading the country's economy - but how much is it going to cost?", "modified": "2022-05-08T09:06:05.710000", "created": "2022-04-08T09:23:46.746000", "tags": [ "datav7a53b450", "microsoft yahei", "label", "arial", "verdana", "simsun", "simhei", "stheiti", "helvetica", "aba8a8", "font awesome", "license", "font", "sil ofl", "mit license", "woff2", "woff", "truetype", "fontawesome", "0xb6f109", "0x9e4f21", "0x464801", "0x21c094", "object", "0x54da69", "0x28e5ab", "promise", "0x3aef82", "0x12d16a", "this", "push", "window", "code", "date", "bind", "error", "path", "target", "middle", "null", "open", "download", "blank", "refresh", "config", "span", "mark", "canvas", "mask", "9999", "close", "shift", "android", "encrypt", "getclass", "checker", "agent", "4328", "trim", "service", "slice", "crypto", "stop", "7910", "zero", "checkbox", "format", "model", "spinner", "clickdownload", "meta", "sport", "click", "next", "class", "hammer", "body", "boolean", "number", "string", "array", "typeof t", "function", "regexp", "typeof e", "generator", "4096", "ping", "f6cf32", "modulenotfound", "n noticecontent", "typeerror", "circular", "infinite", "mouseevent", "dommousescroll", "lotteryhallhome", "void", "bubble", "vnode", "vuessrcontext", "swiper", "typeof o", "mozperspective", "msperspective", "tridentg", "event", "bscroll", "u200", "typeof s", "newatchman", "fetch", "timeout", "ofunction", "zfunction", "watchman", "dfunction", "domutils", "typeof n", "4294967295", "parseint", "utf8", "utils", "post", "channelcode", "0xa60881", "0x1e0610", "0x489cca", "0x4d5bd1", "0x1a7a9a", "0x3145fc", "0x2d9acb", "0xbf1b3e", "0x47699d", "cookie", "info", "jb3tu", "0x1d9131", "0x180bcc", "0x4b6177", "0x13f349", "0x3bcb54", "0xbbe80d", "0x57b7de", "0x2ea74e", "0x4fb0f2", "0x25f113", "tencent", "barrio", "\u77ed\u89c6\u9891", "\u641e\u7b11\u89c6\u9891", "\u89c6\u9891\u5206\u4eab", "\u514d\u8d39\u89c6\u9891", "\u5728\u7ebf\u89c6\u9891", "\u9884\u544a\u7247", "yuwvm", "g 18", "720p", "hd luna", "hd 99", "ktvp", "part", "hd h", "dykthr", "jquery", "titlestr", "viewport" ], "references": [ "xfe-IP-154.36.230.14-stix2-2.0-export.json", "http://www.jxhykj1210.com/common.js", "http://www.jxhykj1210.com/tj.js", "https://17se.xyz/", "https://www.bibo18.app:2171/?agent=2207259251", "https://www.bibo18.app:2171/js/xinstall_inner_e.min.js?v=1004", "https://cstaticdun.126.net/load.min.js?v=2203141811", "https://www.shareinstall.com.cn/js/page/jshareinstall.min.js", "https://acstatic-dun.126.net/tool.min.js?t=1647252792143", "https://9755w.com:2188/m/js/2203141811-HomeLogin~LotteryHall~VnsLogin~activity~amhgLogin~aqvnsLogin~betnewLocgin~blrLogin~blushLogin~cLogin~6995ba01.js", "https://9755w.com:2188/m/js/2203141811-LotteryHall~agent-doc~cpxpjLogin~download~game~home~member~sports~vnsoLogin~vnstLogin2.js", "https://9755w.com:2188/m/js/2203141811-JieBei~YuEBao~agent-center-modec~agent-center-new~bet~game~home~invite~member.js", "https://9755w.com:2188/m/js/2203141811-LotteryHall~home.js", "https://9755w.com:2188/m/js/2203141811-home.js", "https://9755w.com:2188/m/js/2203141811-fhcpLogin.js", "https://9755w.com:2188/m/js/2203141811-view-page.js", "https://9755w.com:2188/m/js/2203141811-chunk-vendors.js", "https://9755w.com:2188/m/js/2203141811-index.js", "https://netdna.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css", "https://9755w.com:2188/m/css/fhcpLogin.css?v=2203141811" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 306, "URL": 1135, "FileHash-SHA256": 122, "domain": 172, "FileHash-MD5": 4 }, "indicator_count": 1739, "is_author": false, "is_subscribing": null, "subscriber_count": 71, "modified_text": "1485 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "625088e80292028d4e82311c", "name": "Botnet-malware -lgmhgjm.com", "description": "The full list of names and names of people who have taken part in the 2016 Olympics and Paralympics in Rio de Janeiro, Brazil, as part of the Rio Games, and as well as the 2017 Olympics in Brazil.", "modified": "2022-05-08T00:03:14.586000", "created": "2022-04-08T19:11:36.165000", "tags": [ "function", "param", "object", "return", "webpackrequire", "constructor", "clipboard", "typeof", "symbol", "typeerror", "error", "click", "null", "copy", "factory", "super", "date", "target", "mustflag", "html", "applewebkit", "ipad", "mqqbrowser", "base", "trident", "presto", "gecko", "khtml", "ios android", "android", "array", "2f2f2i2i0f", "eh0g", "exptable", "logtable", "typeof h", "typeof e", "regexp", "typeof n", "typeof t", "width", "typeof r", "pseudo", "class", "this", "accept", "false", "https", "zeno rocha", "typeof define", "select", "input", "textarea", "0x455d", "0x34260b", "0x4ce9d1", "avge", "tung", "3ctz", "n33m", "0x514351", "hn4d", "0x70c2f4", "push", "shift", "baidu", "instanceof", "adjust", "body", "nulli", "windowi", "typeof jquery", "tthis", "mspointerdown", "child", "sfunction", "microsoft yahei", "arial", "x20trnf", "version", "swiper", "most", "copyright", "mit license", "october", "win32", "meta", "parsefloat", "androidgi", "iphonegi", "\u77ed\u89c6\u9891", "\u641e\u7b11\u89c6\u9891", "\u89c6\u9891\u5206\u4eab", "\u514d\u8d39\u89c6\u9891", "\u5728\u7ebf\u89c6\u9891", "\u9884\u544a\u7247", "wifi", "saol", "fc2ppv12518005", "oretd633riana01", "hodv sex", "orec37502", "06inn01", "siro2661ol2401", "garea742kou01", "175cm9av", "attr", "typeof symbol", "root", "length", "indexof", "x0ax20x20x20x20", "location", "math", "0x10", "0x18", "history", "config", "slice", "cookie", "open", "onload", "adunit", "refresh", "style", "position", "creativetplid", "show", "tcmod", "tcheight", "height", "yahei", "truetype", "f8f8f8", "typeof module", "reserved", "18hdxxxx\u4e2d\u56fd", "\u5973\u4e3b\u7a7f\u8d8a\u88ab\u8089\u6765\u8089\u53bbnp", "\u7537\u753718\u7981\u6c61\u8089\u56fe\u65e0\u7801", "\u65e0\u7801\u4e9a\u6d32\u6210a\u4eba\u7247\u5728\u7ebf\u89c2\u770b", "ore572s04", "ore572s03", "ore572s02", "ore572s01", "fc2ppv117430501", "cmi1513707", "cmi1513706", "cmi1513705", "cmi1513704", "cmi1513703", "\u514d\u8d39\u89c6\u9891\u7231\u7231\u592a\u723d\u4e86\u7f51\u7ad9_\u8001\u8272\u9b3c\u5728\u7ebf\u7cbe\u54c1\u89c6\u9891\u5728\u7ebf\u89c2\u770b_\u767d\u6d01\u4e00\u591c\u88ab\u723d\u4e86\u4e03\u6b21_\u5fd8\u4e86\u6234\u80f8\u7f69\u88ab\u540c\u5b66\u6478\u4e86\u4e00\u8282\u8bfe", "viewport" ], "references": [ "xfe-URL-lgmhgjm.com-stix2-2.0-export.json", "http://www.lgmhgjm.com/common.js", "http://www.lgmhgjm.com/tj.js", "http://www.sp385.com/", "http://avtv10.com", "http://9766.tv", "https://xc.6xc.tv/?channelCode=xiaosu03_8", "https://app.okoockec.xyz:8443/apps/v2/index1/0c1d6cd4e9634a3d?m=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoiZzByUjNpMUczaEt0Sk5sZmVNSE44NEhjVDlDOVFTM2xEcm5pM1dIWG9UM1FBSklpR1phN01teTZOcjFxVVJIWVlhZnJPQkE9IiwiZXhwIjoxNjQ5NDQ0NDcyfQ.utSNnRI7C9FuWMUxhY4cufCJBIuHUk5vdk8Dj6WnXYs", "https://xc.6xc.tv/js/jquery-3.6.0.min.js", "https://xc.6xc.tv/css/index.css", "https://xctg07.cc/?channelCode=xiaosu03_8", "https://ad.abilm.info/bid?url=http%3A%2F%2Fkniveb.info%2F&frm=0&ref=http%3A%2F%2Fwww.sp385.com%2F&ic=1&pl=0&ml=0&sid=105:80:104:111:110:101:58:50:53:48:50:50:51:49:53:54:58:51:58:51:57:48:46:56:52:52&ps=20030107&lgs=0&zo=240&ws=390x844&gdm=0&iw=1&cpn=0&fid=5d80d32079e9fdb035e4886c32c6612e&hl=2&ihn=0&md=1&ns=undefined&np=undefined&pj=0&top=650&left=0&id=47&rid=ec5a07ef8f3e3f2c25ba75c7da106dcc&dcc=&dcl=&gvd=Apple%20Inc.&grr=Apple%20GPU&ct=unknown&diit=&dit=&cmn=", "http://sdk.51.la/js-sdk-pro.min.js", "http://sdk.51.la/event/js-sdk-event.min.js?u=JYWHYgTN1B6iZ5P2", "http://kniveb.info/template/9c/ads/gonggao.js", "http://kniveb.info/", "https://koban360.com/ky/?shareName=1736.com", "https://koban360.com/ky/js/flexible.js", "https://koban360.com/ky/js/swiper.min.js", "https://koban360.com/ky/js/jquery.min.js", "https://koban360.com/ky/css/m.css?vs=1.7", "https://libs.baidu.com/jquery/2.0.0/jquery.min.js", "https://xbt.0lunwen.com/3/js/flexible.js", "https://xbt.0lunwen.com/boinstall.js", "https://miaouuuc.com/?channelCode=852890&aid=852890", "https://miaouuuc.com/template/static/js/clipborad.min.js", "https://am96.vip/", "https://unpkg.com/jquery-1.10.2@1.10.2/jquery-1.10.2.min.js", "https://unpkg.com/jquery.qrcode@1.0.3/jquery.qrcode.min.js", "https://www.gootft.com/js/app.base.js;jsessionid=20F7490B81FBD25B0DE24EE1076D230D", "https://www.gootft.com/js/poplayer.js;jsessionid=20F7490B81FBD25B0DE24EE1076D230D", "https://unpkg.com/clipboard@2.0.8/dist/clipboard.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 482, "URL": 1383, "FileHash-SHA256": 104, "domain": 199, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 2171, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1485 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6221c71f88d90939c45bbddb", "name": "Votebuilder.com", "description": "", "modified": "2022-04-08T00:05:40.239000", "created": "2022-03-04T08:00:31.017000", "tags": [], "references": [ "votebuilder3df.pdf", "votebuilder2df.pdf", "votebuilder5df.pdf", "votebuilder7df.pdf", "votebuilder.com apidf.pdf", "Votebuilder.com.pdf", "votebuilder4df.pdf", "votebuilder6df.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 869, "hostname": 1559, "URL": 4755, "CIDR": 2, "FileHash-MD5": 10, "domain": 834 }, "indicator_count": 8029, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1515 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62497a9c72edc277fb20e52f", "name": "'+titlestr+'", "description": "If you want to see what is going on at this time of year, spare a thought for T.t.m.T.g.ts.com; T-t=t,", "modified": "2022-04-03T10:44:44.074000", "created": "2022-04-03T10:44:44.074000", "tags": [ "typeof t", "typeof symbol", "nthis", "msger", "typeof e", "image", "error", "typeerror", "new date", "codeverify", "0xa60881", "0x1e0610", "0x489cca", "0x4d5bd1", "0x1a7a9a", "0x3145fc", "0x2d9acb", "0xbf1b3e", "0x47699d", "push", "shift", "date", "cookie", "slice", "open", "code", "path", "info", "null", "this", "webpackrequire", "othis", "object", "array", "executor", "canvas", "function", "slidercaptcha", "createelement", "textdanger", "plugin", "rgba", "imagedata", "false", "touchstart", "trident", "click", "typeof", "typeof define", "typeof c", "copyright", "twitter", "bootstrap", "rolemenu", "typeof f", "typeof g", "james levine", "udid", "x61x70x70x6cx79", "azaz", "0x5372", "0x19", "0x3de55b", "0x24a5d4", "0x5c", "0x19c89f", "0x2f1b4a", "0x4d1e1f", "0x1a", "0x29", "window", "honor", "root", "length", "indexof", "x0ax20x20x20x20", "location", "math", "0x10", "0x18", "history", "config", "onload", "android", "regexp", "x20trnf", "class", "attr", "pseudo", "child", "swiper", "most", "mit license", "january", "typeof b", "sufeffxa0", "void", "typeof n", "appappapp", "next", "toh5", "channelcode", "androidos", "linux", "ipad", "macintosh", "promise", "xmlhttprequest", "0x1d9131", "0x180bcc", "0x4b6177", "0x13f349", "0x3bcb54", "0xbbe80d", "0x57b7de", "0x2ea74e", "0x4fb0f2", "0x25f113", "tencent", "barrio", "width", "accept", "cnzzdata", "czuuid", "umdistinctid", "version", "october", "win32", "name", "html", "meta", "viewport" ], "references": [ "http://www.laijcm.com/common.js", "http://www.laijcm.com/tj.js", "http://kk164.xyz/", "https://x4707.com:5443/?register=1", "https://6112.hnsstjc.com/a002/xpjtz.php", "https://6112.hnsstjc.com/a002/js/fontSize.js", "https://6112.hnsstjc.com/a002/js/jquery-1.8.3.min.js", "https://6112.hnsstjc.com/a002/js/swiper.min.js", "https://6112.hnsstjc.com/a002/xpj.php", "https://www.xvsgwa.com/qz1IJUpc.html", "https://c.cnzz.com/core.php?web_id=1280875449&t=z", "https://s9.cnzz.com/z_stat.php?id=1280875449&web_id=1280875449", "https://www.bibo14.app:2611/js/jquery-1.11.3.min.js", "https://www.bibo14.app:2611/js/cncc.js", "https://www.bibo14.app:2611/js/xinstall_inner_e.min.js?v=1004", "https://www.bibo14.app:2611/js/down.js?v=1022", "https://www.bibo14.app:2611/css/h5/reset.css", "https://www.dongtiankuangye.com/a002/config.js", "https://www.dongtiankuangye.com/a002/js/plugins/swiper/swiper.min.js", "https://www.dongtiankuangye.com/a002/js/libs/jquery-1.12.4/jquery-1.12.4.min.js", "https://www.dongtiankuangye.com/a002/js/plugins/swiper/swiper.min.css", "https://pojd783.cc:8443/index.html?shareName=pojd783.cc", "https://sdk.51.la/event/js-sdk-event.min.js?u=Je0ztO5GuwfJ6eip", "https://sdk.51.la/js-sdk-pro.min.js", "https://pojd783.cc:8443/js/sharetrace.min.js", "https://js112.oss-accelerate.aliyuncs.com/os.js", "https://ty66as.jxdysw.cn/1whpv", "https://ty66as.jxdysw.cn/dist/vendors/bootstrap/js/bootstrap.min.js", "https://ty66as.jxdysw.cn/dist/vendors/clipboard/clipboard.min.js", "https://ty66as.jxdysw.cn/dist/captcha/disk/slidercaptcha.js", "https://ssl.captcha.qq.com/TCaptcha.js", "https://cstaticdun.126.net/load.min.js?t=202007291602", "https://t.captcha.qq.com/template/drag_ele.html?t=1648982190651", "https://captcha.gtimg.com/1/tcaptcha-frame.db8b9289.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1528, "hostname": 543, "domain": 209, "FileHash-SHA256": 127, "email": 1, "FileHash-MD5": 4 }, "indicator_count": 2412, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1519 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62223e385f1cfc8916db66fb", "name": "Dominionvoting.com 03.03.22", "description": "", "modified": "2022-04-03T00:00:55.161000", "created": "2022-03-04T16:28:40.422000", "tags": [], "references": [ "dominion voting1f", "dominion2", "dominion3", "dominion4", "dominion5" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 413, "URL": 2183, "FileHash-SHA256": 663, "hostname": 588, "FileHash-MD5": 7 }, "indicator_count": 3854, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1520 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://6112.hnsstjc.com/a002/xpj.php", "https://kit-free.fontawesome.com/releases/latest/css/free-v4-font-face.min.css", "https://www.indusface.com/js/fontawesome.js.pagespeed.jm.X4kSHwBNxI.js", "http://www.sp385.com/", "https://topweb.co.il/wp-content/plugins/litespeed-cache/assets/js/webfontloader.min.js", "https://topweb.co.il/", "xfe-URL-anyweb.co.il-stix2-2.1-export.json", "https://www.gandi.net/static/js/legacy.7cc648e3ff7a.js", "https://koban360.com/ky/?shareName=1736.com", "http://appbyweb.net/AppByWeb", "https://cdn.callrail.com/companies/431115301/7c8f964bc12313c75ad2/12/swap.js", "https://9755w.com:2188/m/js/2203141811-HomeLogin~LotteryHall~VnsLogin~activity~amhgLogin~aqvnsLogin~betnewLocgin~blrLogin~blushLogin~cLogin~6995ba01.js", "https://widget.wickedreports.com/widget.js", "https://www.hushmail.com/javascriptinclude/eNpNzEEOQDAQQNEbtVoM7Sks7GXopB0pkQ5xfWJl-5P3JWGh4AvukSRzoKKtqlWlf0Wt4k3rnG2g641Pl6QNOU83zcIn-QMj6ZHpHQ2FF97jiHOmj0ED4FxfwQOf9yPU.en_US.68448bd8190f2f2bae9633f547bbbbbe.0.js", "https://tracking.g2crowd.com/attribution_tracking/conversions/2226.js?p=https://www.indusface.com/&e=", "https://www.google-analytics.com/gtm/js?id=GTM-PF7H94Q&t=gartner&cid=559436367.1653353775", "dominion4", "https://anyweb.co.il/wp-includes/js/wp-embed.min.js?ver=5.7.3", "https://anyweb.co.il/wp-content/plugins/essential-grid/public/assets/js/jquery.themepunch.tools.min.js?ver=2.0.9.1", "https://anyweb.co.il/wp-content/themes/superfine/assets/js/post-like.min.js?ver=1.0", "https://www.gstatic.com/firebasejs/8.1.2/firebase-app.js", "http://appbyweb.net/AppByWeb/js/main.js", "http://appbyweb.net/AppByWeb/js/bootstrap.min.js", "votebuilder6df.pdf", "https://xc.6xc.tv/js/jquery-3.6.0.min.js", "dominion voting1f", "https://widget.trustpilot.com/trustboxes/5406e65db0d04a09e042d5fc/index.html?templateId=5406e65db0d04a09e042d5fc&businessunitId=4bdc496b000064000505a89d#locale=en-US&styleHeight=28px&styleWidth=100%25&theme=light", "https://www.googletagmanager.com/gtm.js?id=GTM-MDCVHGD", "https://9755w.com:2188/m/js/2203141811-home.js", "https://himado.com/heihei/node_modules/mdui/dist/js/mdui.min.js", "https://9755w.com:2188/m/js/2203141811-LotteryHall~home.js", "https://17se.xyz/", "https://www.googletagmanager.com/gtag/js?id=AW-827450946", "votebuilder5df.pdf", "https://www.layerhost.com/assets/js/vendor/what-input.js", "https://xbt.0lunwen.com/3/js/flexible.js", "https://www.bibo14.app:2611/js/cncc.js", "https://www.layerhost.com/assets/js/slider.js", "http://sdk.51.la/event/js-sdk-event.min.js?u=JYWHYgTN1B6iZ5P2", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/363516812/?random=1650901467024&cv=9&fst=1650901467024&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2oa4k0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Ftopweb.co.il%2F&tiba=%D7%9E%D7%A9%D7%A8%D7%93%20%D7%A4%D7%A8%D7%A1%D7%95%D7%9D%20%D7%95%D7%91%D7%A0%D7%99%D7%99%D7%AA%20%D7%90%D7%AA%D7%A8%D7%99%D7%9D%20%7C%20TOPWEB%20-%20%D7%98%D", "https://www.indusface.com/js/cookieconsent.min.js.pagespeed.jm.FCA-2RWV9s.js", "https://miaouuuc.com/template/static/js/clipborad.min.js", "https://anyweb.co.il/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.4.1", "https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050201.js", "http://www.laijcm.com/tj.js", "https://www.bibo18.app:2171/?agent=2207259251", "https://9755w.com:2188/m/js/2203141811-JieBei~YuEBao~agent-center-modec~agent-center-new~bet~game~home~invite~member.js", "https://ssl.captcha.qq.com/TCaptcha.js", "http://www.lgmhgjm.com/tj.js", "https://cdn.ampproject.org/rtv/012204221712000/amp4ads-host-v0.js", "http://appbyweb.net/AppByWeb/js/superfish.js", "https://www.layerhost.com/assets/js/jquery.filterizr.min.js", "https://ty66as.jxdysw.cn/dist/vendors/clipboard/clipboard.min.js", "https://www.bibo14.app:2611/js/xinstall_inner_e.min.js?v=1004", "https://www.dongtiankuangye.com/a002/js/plugins/swiper/swiper.min.css", "https://my.frantech.ca/templates/lagom/assets/js/whmcs-custom.min.js?v=1.4.3", "https://www.gootft.com/js/app.base.js;jsessionid=20F7490B81FBD25B0DE24EE1076D230D", "https://clientcdn.pushengage.com/core/80780b73b5a3f4655fee62041e51f1be.js", "https://anyweb.co.il/wp-content/plugins/essential-grid/public/assets/js/jquery.themepunch.essential.min.js?ver=2.0.9.1", "https://www.xvsgwa.com/qz1IJUpc.html", "http://www.jxhykj1210.com/tj.js", "https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022050201.js", "https://www.googletagmanager.com/gtag/js?id=AW-1070742489&l=dataLayer&cx=c", "https://ty66as.jxdysw.cn/1whpv", "https://tag.aticdn.net/616708/smarttag.js", "https://d.adroll.com/pixel/Q7CW4G7ZJJGWDLUB76P5IV/WH2M5MREOVC4HNKNZPPJZR?adroll_fpc=7c06a492879ac231294c1fe2e6e394f3-1653353535991&arrfrr=https%3A%2F%2Fwww.indusface.com%2F&pv=54603716107.79724&cookie=BIJ6M3OZKNCW7OIMIJSZED%3A2%7CWH2M5MREOVC4HNKNZPPJZR%3A2%7CQ7CW4G7ZJJGWDLUB76P5IV%3A2&adroll_s_ref=&keyw=&adroll_external_data=", "https://s4.cnzz.com/z_stat.php?id=1280305902&web_id=1280305902", "https://www.indusface.com/js/swiper.min.js.pagespeed.jm.47RtcloJQ-.js", "http://appbyweb.net/AppByWeb/js/jquery.min.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/languages/en.js", "https://koban360.com/ky/js/flexible.js", "https://s.adroll.com/j/sendrolling.js", "https://koban360.com/ky/js/jquery.min.js", "http://appbyweb.net/AppByWeb/js/modernizr-2.6.2.min.js", "https://6112.hnsstjc.com/a002/js/jquery-1.8.3.min.js", "xfe-URL-https___www.gandi.net-stix2-2.1-export.json", "https://koban360.com/ky/css/m.css?vs=1.7", "https://cstaticdun.126.net/load.min.js?v=2203141811", "xfe-IP-103.136.42.186-stix2-2.1-export.json", "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_0?le=scs", "http://appbyweb.net/AppByWeb/js/jquery.stellar.min.js", "http://sdk.51.la/js-sdk-pro.min.js", "https://9755w.com:2188/m/css/fhcpLogin.css?v=2203141811", "https://anyweb.co.il/wp-includes/js/wp-emoji-release.min.js?ver=5.7.3", "https://js.callrail.com/group/0/7c8f964bc12313c75ad2/06ababf0-8852-4eef-95e1-285ae467a93a/poll.js?t=1651861793229&ids%5B%5D=431115301", "https://www.shareinstall.com.cn/js/page/jshareinstall.min.js", "http://www.lgmhgjm.com/common.js", "https://script.tapfiliate.com/tapfiliate.js", "https://sdk.51.la/js-sdk-pro.min.js", "xfe-URL-lgmhgjm.com-stix2-2.0-export.json", "https://www.indusface.com/js/popper.min.js+bootstrap.min.js+modernizr-custom.js+menu.js.pagespeed.jc.WlixBHq4Fv.js", "https://www.hushmail.com/shared/javascript/jquery-3.5.1.min.js", "https://js112.oss-accelerate.aliyuncs.com/os.js", "https://281cecd8ae73dff542e13679e60d5fb9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html", "https://ad.abilm.info/bid?url=http%3A%2F%2Fkniveb.info%2F&frm=0&ref=http%3A%2F%2Fwww.sp385.com%2F&ic=1&pl=0&ml=0&sid=105:80:104:111:110:101:58:50:53:48:50:50:51:49:53:54:58:51:58:51:57:48:46:56:52:52&ps=20030107&lgs=0&zo=240&ws=390x844&gdm=0&iw=1&cpn=0&fid=5d80d32079e9fdb035e4886c32c6612e&hl=2&ihn=0&md=1&ns=undefined&np=undefined&pj=0&top=650&left=0&id=47&rid=ec5a07ef8f3e3f2c25ba75c7da106dcc&dcc=&dcl=&gvd=Apple%20Inc.&grr=Apple%20GPU&ct=unknown&diit=&dit=&cmn=", "votebuilder.com apidf.pdf", "https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_fy2019.js", "https://himado.com/heihei/js/swiper.min.js", "https://netdna.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css", "https://6112.hnsstjc.com/a002/xpjtz.php", "xfe-URL-Powr.io-stix2-2.1-export 2.json", "https://9755w.com:2188/m/js/2203141811-fhcpLogin.js", "https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js", "https://app.okoockec.xyz:8443/apps/v2/index1/0c1d6cd4e9634a3d?m=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoiZzByUjNpMUczaEt0Sk5sZmVNSE44NEhjVDlDOVFTM2xEcm5pM1dIWG9UM1FBSklpR1phN01teTZOcjFxVVJIWVlhZnJPQkE9IiwiZXhwIjoxNjQ5NDQ0NDcyfQ.utSNnRI7C9FuWMUxhY4cufCJBIuHUk5vdk8Dj6WnXYs", "https://widget.wickedreports.com/v2/3469/wr-dafa9fae816c2f65d24d1eb593b58626.js", "https://2021.igem.org/Team:KU_Leuven/test2", "xfe-URL-Aliyun.com-stix2-2.1-export.json", "https://trackcmp.net/visit?actid=223422163&e=&r=&u=https%3A%2F%2Fwww.indusface.com%2F", "http://kniveb.info/", "https://unpkg.com/jquery.qrcode@1.0.3/jquery.qrcode.min.js", "dominion3", "https://www.dongtiankuangye.com/a002/js/plugins/swiper/swiper.min.js", "https://c.cnzz.com/core.php?web_id=1280875449&t=z", "xfe-URL-Hush.com-stix2-2.1-export.json", "https://xc.6xc.tv/?channelCode=xiaosu03_8", "https://www.gootft.com/js/poplayer.js;jsessionid=20F7490B81FBD25B0DE24EE1076D230D", "https://www.bibo14.app:2611/js/down.js?v=1022", "http://9766.tv", "https://t.captcha.qq.com/template/drag_ele.html?t=1648982190651", "xfe-IP-154.36.230.14-stix2-2.0-export.json", "votebuilder4df.pdf", "https://d.adroll.com/consent/check/Q7CW4G7ZJJGWDLUB76P5IV?adroll_fpc=7c06a492879ac231294c1fe2e6e394f3-1653353535991&arrfrr=https%3A%2F%2Fwww.indusface.com%2F&_s=1316674c131c34cc157a9ad9119512a2&_b=2", "https://www.googletagmanager.com/gtm.js?id=GTM-PMC6JX", "xfe-URL-https___c0.wp.com_-stix2-2.1-export.json", "https://www.gartner.com/reviews/public/Widget/js/widget.js", "xfe-URL-frantech.ca-stix2-2.1-export.json", "https://www.powr.io/powr.js?platform=html", "xfe-URL-https___my.frantech.ca_-stix2-2.1-export.json", "http://www.jxhykj1210.com/common.js", "https://c.cnzz.com/core.php?web_id=1280305902&t=z", "https://anyweb.co.il/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2", "https://xc.6xc.tv/css/index.css", "https://www.hushmail.com/status/", "https://sc.lfeeder.com/lftracker_v1_kn9Eq4R1l2K7RlvP.js", "https://www.layerhost.com/assets/js/yui.js", "https://k.clarity.ms/s/0.6.34/clarity.js", "https://www.bibo18.app:2171/js/xinstall_inner_e.min.js?v=1004", "https://www.indusface.com/js/jquery.3.5.1.min.js.pagespeed.jm.A8biqtTJrt.js", "https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2581829468247892&output=html&adk=1812271804&adf=3025194257&lmt=1651149220&plat=16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C32%3A32&format=0x0&url=http%3A%2F%2Fappbyweb.net%2FAppByWeb%2F&ea=0&pra=5&wgl=1&dt=1651149220376&bpp=1&bdt=121&idt=18&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3De83d6067a4dac5b6-229192c549d200d1%3AT%3D1651148802%3ART%3D1651148802%3AS%3DALNI_MZSt9utXhYBHAIH9xwQp72WuxQxTw&nras=1&correlator=1655793633284&", "https://himado.com/heihei/layui/layui.all.js", "https://www.hushmail.com/javascriptinclude/eNrLKC3OyE3MzIkvT00qzixJtSpITE_V98lPz8xzyy_K1csqtjI0MzK2MDcwsbS0ysCq2qkov7w4tSi4JLGkGFUDAF_tIM0,.en_US.68448bd8190f2f2bae9633f547bbbbbe.0.js", "https://files.appbyweb.net/Fonts/OpenSansHebrew/font.css", "https://anyweb.co.il/wp-content/themes/superfine/assets/js/script.js", "https://www.googletagmanager.com/gtag/js?id=UA-122335014-2", "https://www.googletagmanager.com/gtag/js?id=AW-1070742489", "http://appbyweb.net/AppByWeb/js/jquery.easing.1.3.js", "https://www.indusface.com/css/A.font-styles1.css+bootstrap.css+skin.css+responsive.css+menu.css+swiper.min.css,Mcc.nAV12exFII.css.pagespeed.cf.a_yWJedOjY.css", "https://cdn.onesignal.com/sdks/OneSignalSDK.js", "https://anyweb.co.il/wp-includes/js/jquery/jquery.min.js?ver=3.5.1", "xfe-IP-134.73.11.118-stix2-2.1-export.json", "https://c0.wp.com/c/5.9.3/wp-includes/js/dist/vendor/regenerator-runtime.min.js", "https://www.googletagmanager.com/gtm.js?id=GTM-NQNVC6K", "https://miaouuuc.com/?channelCode=852890&aid=852890", "https://securepubads.g.doubleclick.net/tag/js/gpt.js", "https://anyweb.co.il/wp-content/plugins/essential-grid/public/assets/js/lightbox.js?ver=2.0.9.1", "https://6112.hnsstjc.com/a002/js/swiper.min.js", "https://web.mxradon.com/t/Tracker.js", "https://xbt.0lunwen.com/boinstall.js", "dominion2", "https://pojd783.cc:8443/index.html?shareName=pojd783.cc", "https://unpkg.com/clipboard@2.0.8/dist/clipboard.js", "https://www.dongtiankuangye.com/a002/config.js", "Votebuilder.com.pdf", "https://static.addtoany.com/menu/page.js", "https://www.layerhost.com/assets/js/app.js", "https://www.layerhost.com/assets/js/vendor/foundation.min.js", "https://anyweb.co.il/wp-content/themes/superfine/assets/js/assets.js?ver=5.7.3", "xfe-IP-146.148.236.187-stix2-2.1-export.json", "https://js.callrail.com/group/0/7c8f964bc12313c75ad2/06ababf0-8852-4eef-95e1-285ae467a93a/poll.js?t=1651861725881&ids%5B%5D=431115301", "votebuilder2df.pdf", "https://www.googletagmanager.com/gtag/js?id=UA-1837381-13", "https://koban360.com/ky/js/swiper.min.js", "http://kk164.xyz/", "https://www.bibo14.app:2611/css/h5/reset.css", "https://www.gandi.net/static/js/modern.27ee934b0dc5.js", "https://web.mxradon.com/t/WebTracker.aspx?p1=18917&p2=Web%20Application%20Security%2C%20WAF%2C%20SSL%20Certificates&p3=-1&p4=&p5=1&p6=8415a029-248f-4eeb-bc18-338560430ff7&p7=&p8=&p9=0", "https://am96.vip/", "https://sdk.51.la/event/js-sdk-event.min.js?u=Je0ztO5GuwfJ6eip", "https://embed.tawk.to/_s/v4/app/625d36b405c/js/twk-chunk-2d0d2b7c.js", "https://c0.wp.com/p/jetpack/10.7/_inc/build/photon/photon.min.js", "http://appbyweb.net/AppByWeb/js/hoverIntent.js", "https://xctg07.cc/?channelCode=xiaosu03_8", "http://www.laijcm.com/common.js", "https://static.addtoany.com/menu/sm.23.html#type=core&event=load&url=https%3A%2F%2Fwww.apeiron.global%2F&referrer=", "https://topweb.co.il/wp-content/litespeed/js/c3a18f91ebd798da3e120a12aec7c615.js?ver=7c615", "https://www.indusface.com/css/A.cookieconsent.min.css.pagespeed.cf.t1fRd9Ouvj.css", "https://9755w.com:2188/m/js/2203141811-chunk-vendors.js", "https://s.adroll.com/j/pre/Q7CW4G7ZJJGWDLUB76P5IV/WH2M5MREOVC4HNKNZPPJZR/index.js", "https://www.dongtiankuangye.com/a002/js/libs/jquery-1.12.4/jquery-1.12.4.min.js", "https://anyweb.co.il/wp-includes/css/dist/block-library/style.min.css?ver=5.7.3", "https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery.min.js", "https://himado.com/cdn-cgi/challenge-platform/h/g/scripts/invisible.js?ts=1651842000", "votebuilder3df.pdf", "xfe-URL-himado.com-stix2-2.1-export.json", "https://anyweb.co.il/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4", "https://9755w.com:2188/m/js/2203141811-LotteryHall~agent-doc~cpxpjLogin~download~game~home~member~sports~vnsoLogin~vnstLogin2.js", "https://hybrid-analysis.com/sample/e126ff94aac3340dc05a27f062c4267cbfeaa998248bef0e72f000bba711aa76/62e6fb475edc950b894aa7b0", "https://ty66as.jxdysw.cn/dist/vendors/bootstrap/js/bootstrap.min.js", "https://stats.wp.com/e-202217.js", "https://pojd783.cc:8443/js/sharetrace.min.js", "https://ty66as.jxdysw.cn/dist/captcha/disk/slidercaptcha.js", "https://www.gstatic.com/recaptcha/releases/2W_gRz39xX8G13fM-OdyQPlc/recaptcha__en.js", "https://9755w.com:2188/m/js/2203141811-view-page.js", "https://s9.cnzz.com/z_stat.php?id=1280875449&web_id=1280875449", "https://www.bibo14.app:2611/js/jquery-1.11.3.min.js", "https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdNytsaAAAAANS6DW8pofQamH4toQAAgfF7Q8qW&co=aHR0cHM6Ly93d3cuYXBlaXJvbi5nbG9iYWw6NDQz&hl=en&v=2W_gRz39xX8G13fM-OdyQPlc&size=invisible&cb=ghnkw160kgfd", "https://www.clarity.ms/tag/uet/26015787", "votebuilder7df.pdf", "https://9755w.com:2188/m/js/2203141811-index.js", "https://libs.baidu.com/jquery/2.0.0/jquery.min.js", "https://unpkg.com/jquery-1.10.2@1.10.2/jquery-1.10.2.min.js", "https://x4707.com:5443/?register=1", "https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery-migrate.min.js", "xfe-URL-Layerhost.com-stix2-2.1-export.json", "https://dc.cux.io/analyzer.js", "https://analytics.gandi.net/piwik.js", "https://www.googletagmanager.com/gtm.js?id=GTM-MF25KRH", "http://appbyweb.net/AppByWeb/js/jquery.waypoints.min.js", "https://acstatic-dun.126.net/tool.min.js?t=1647252792143", "xfe-URL-Cnzz.com-stix2-2.1-export.json", "https://6112.hnsstjc.com/a002/js/fontSize.js", "dominion5", "xfe-URL-appbyweb.net-stix2-2.1-export.json", "https://partner.googleadservices.com/gampad/cookie.js?domain=appbyweb.net&callback=_gfp_s_&client=ca-pub-2581829468247892", "http://avtv10.com", "https://www.googletagmanager.com/gtag/js?id=G-C3W7T6H5QW&l=dataLayer&cx=c", "https://bat.bing.com/p/action/26015787.js", "https://captcha.gtimg.com/1/tcaptcha-frame.db8b9289.js", "https://www.layerhost.com/assets/js/vendor/jquery.min.js", "https://cstaticdun.126.net/load.min.js?t=202007291602", "xfe-URL-Psychz.net-stix2-2.1-export.json", "http://kniveb.info/template/9c/ads/gonggao.js", "https://my.frantech.ca/templates/lagom/assets/js/lagom-app.min.js?v=1.4.3" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Lh", "Okcancel", "Gc", "Reduceright", "Eventtarget", "Filterizr api", "Vd" ], "industries": [], "unique_indicators": 64655 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/l.target", "whois": "http://whois.domaintools.com/l.target", "domain": "l.target", "hostname": "e.l.target" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 20, "pulses": [ { "id": "663d2869e0f3a42bbddc42ff", "name": "UPX executable packer.", "description": "A new rule has been introduced a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"", "modified": "2024-10-14T00:01:17.069000", "created": "2024-05-09T19:47:53.786000", "tags": [ "cioch adrian", "centrum usug", "sieciowych", "elf binary", "upx compression", "roth", "nextron", "info", "javascript", "html", "office open", "xml document", "network capture", "win32 exe", "xml pakietu", "pdf zestawy", "przechwytywanie", "office", "filehashsha1", "url https", "cve cve20201070", "cve cve20203153", "cve cve20201048", "cve cve20211732", "cve20201048 apr", "filehashmd5", "cve cve20010901", "cve cve20021841", "cve20153202 apr", "cve cve20160728", "cve cve20161807", "cve cve20175123", "cve20185407 apr", "cve cve20054605", "cve cve20060745", "cve cve20070452", "cve cve20070453", "cve cve20070454", "cve cve20071355", "cve cve20071358", "cve cve20071871", "cve20149614 apr", "cve cve20151503", "cve cve20152080", "cve cve20157377", "cve cve20170131", "cve20200796 may", "cve cve20113403" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6861, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5771, "domain": 3139, "URL": 14525, "FileHash-SHA1": 2610, "IPv4": 108, "CIDR": 40, "FileHash-SHA256": 10705, "FileHash-MD5": 3373, "YARA": 2, "CVE": 148, "Mutex": 7, "FilePath": 3, "SSLCertFingerprint": 3, "email": 23, "JA3": 1, "IPv6": 2 }, "indicator_count": 40460, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "595 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708eb824dc4c51811f6de9", "name": "Indusface - in YOUR face ;)", "description": "", "modified": "2023-12-06T15:09:44.273000", "created": "2023-12-06T15:09:44.273000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 307, "hostname": 333, "domain": 192, "URL": 1143, "FileHash-MD5": 1 }, "indicator_count": 1976, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708d657f0895a860febf8f", "name": "SafeFrame Container", "description": "", "modified": "2023-12-06T15:04:05.932000", "created": "2023-12-06T15:04:05.932000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1416, "domain": 2979, "URL": 8250, "hostname": 2262 }, "indicator_count": 14907, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708cca842536f1582636be", "name": "apeiron.global", "description": "", "modified": "2023-12-06T15:01:30.558000", "created": "2023-12-06T15:01:30.558000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 498, "hostname": 388, "domain": 242, "CVE": 1, "URL": 1203, "FileHash-MD5": 1 }, "indicator_count": 2333, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657080735501c11ddbb7a988", "name": "Dominionvoting.com 03.03.22", "description": "", "modified": "2023-12-06T14:08:51.329000", "created": "2023-12-06T14:08:51.329000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 663, "hostname": 588, "domain": 413, "URL": 2183, "FileHash-MD5": 7 }, "indicator_count": 3854, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570805953274b32ec1f981b", "name": "Votebuilder.com", "description": "", "modified": "2023-12-06T14:08:25.588000", "created": "2023-12-06T14:08:25.588000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 869, "domain": 834, "URL": 4755, "hostname": 1559, "CIDR": 2, "FileHash-MD5": 10 }, "indicator_count": 8029, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62e80d56fba248bac0744780", "name": "\ud83e\udd14\ud83d\udea8 Could this be the source of all Evil? \ud83d\udea8\ud83e\udd14 Nubotnet - Team:KU Leuven/test2 - 2021.igem.org", "description": "", "modified": "2022-08-31T00:01:05.509000", "created": "2022-08-01T17:28:54.991000", "tags": [ "apt", "runtime data", "decrypted ssl", "pcap", "windows nt", "tops", "cookie", "typeof t", "element", "error", "matrix", "typeerror", "bmfloor", "frameelement", "null", "skew", "parade" ], "references": [ "https://2021.igem.org/Team:KU_Leuven/test2", "https://hybrid-analysis.com/sample/e126ff94aac3340dc05a27f062c4267cbfeaa998248bef0e72f000bba711aa76/62e6fb475edc950b894aa7b0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1696, "domain": 586, "hostname": 613, "FileHash-SHA256": 533, "FileHash-MD5": 34, "FileHash-SHA1": 33, "email": 1 }, "indicator_count": 3496, "is_author": false, "is_subscribing": null, "subscriber_count": 394, "modified_text": "1370 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62752a3d78ce35783bfc85cc", "name": "SafeFrame Container", "description": "If you want to know what is going to happen when you create a non-iterable object, try these three pieces of code in the form of a new \"word\" or \"phrase\".", "modified": "2022-06-05T00:03:45.266000", "created": "2022-05-06T14:01:33.267000", "tags": [ "public", "typeof", "typeof define", "array", "typeerror", "typeof symbol", "error", "typeof enulle", "sdkversion", "internal", "date", "cnzzdata", "czuuid", "umdistinctid", "typeof e", "typeof t", "version", "swiper", "most", "copyright", "mit license", "april", "trident", "win32", "class", "lh", "vd", "function", "overlaylevel", "zdhxiong", "customevent", "symbol", "object", "string", "number", "null", "uint8array", "typeof b", "iframe", "android", "embed", "meta", "0x14a", "0x104", "0x97", "0xe1", "0x228", "0x12b", "0x14e", "0xf5", "0x11a", "0xc6", "sxa0", "typeof d", "closure library", "array int8array", "b1342177279", "regexp", "typeof r", "pseudo", "child", "typeof n", "template", "void", "this", "ienew ca", "quota", "aafunction", "dafunction", "gc", "trackpageview", "trackevent", "gtmmdcvhgd", "node", "element", "path", "reduceright", "p420", "gc3w7t6h5qw", "kafunction", "fafafa", "xlfunction", "kkfunction", "nkfunction", "qkfunction", "rkfunction", "skfunction", "span", "edge", "bad idp", "bad event", "crios", "invalid attempt", "afunction", "ufunction", "kfunction" ], "references": [ "xfe-URL-himado.com-stix2-2.1-export.json", "xfe-IP-146.148.236.187-stix2-2.1-export.json", "xfe-URL-Psychz.net-stix2-2.1-export.json", "https://cdn.ampproject.org/rtv/012204221712000/amp4ads-host-v0.js", "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_0?le=scs", "https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022050201.js", "https://www.googletagmanager.com/gtag/js?id=G-C3W7T6H5QW&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtm.js?id=GTM-MDCVHGD", "https://www.googletagmanager.com/gtag/js?id=UA-122335014-2", "https://himado.com/heihei/layui/layui.all.js", "https://securepubads.g.doubleclick.net/tag/js/gpt.js", "https://himado.com/cdn-cgi/challenge-platform/h/g/scripts/invisible.js?ts=1651842000", "https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050201.js", "https://himado.com/heihei/node_modules/mdui/dist/js/mdui.min.js", "https://himado.com/heihei/js/swiper.min.js", "https://cdn.onesignal.com/sdks/OneSignalSDK.js", "https://c.cnzz.com/core.php?web_id=1280305902&t=z", "https://s4.cnzz.com/z_stat.php?id=1280305902&web_id=1280305902", "https://www.gstatic.com/firebasejs/8.1.2/firebase-app.js", "https://281cecd8ae73dff542e13679e60d5fb9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html", "xfe-URL-Cnzz.com-stix2-2.1-export.json", "xfe-URL-Aliyun.com-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Lh", "display_name": "Lh", "target": null }, { "id": "Gc", "display_name": "Gc", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null }, { "id": "Vd", "display_name": "Vd", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2262, "URL": 8251, "FileHash-SHA256": 1416, "domain": 2979 }, "indicator_count": 14908, "is_author": false, "is_subscribing": null, "subscriber_count": 71, "modified_text": "1457 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62756a0d14664003affb0555", "name": "hush.com 301 to hushmail.com", "description": "var b[f, gw.b, \"dust\" - a.g - has been added to an Array by the end of the year, if there is any chance of it being added.", "modified": "2022-06-05T00:03:45.266000", "created": "2022-05-06T18:33:49.161000", "tags": [ "widget", "null", "regexp", "array", "copyright", "license", "calltrkswap", "date", "typeof s", "xmlhttprequest", "typeof r", "script", "vd", "number", "string", "ienew ca", "closure library", "error", "quota", "aafunction", "dafunction", "function", "typeof o", "reduceright", "aw1070742489", "uint8array", "void", "code", "typeof symbol", "wickedclientid", "wickedemail", "wickedurl", "wickednullurl", "typeof e", "direct", "typeof require", "modulenotfound", "mini", "cnull", "anull", "nl50", "pnull", "okcancel", "compiled", "true", "android", "trident", "form", "window", "false", "acronym", "body", "canvas", "embed", "footer", "iframe", "keygen", "legend", "mark", "meta", "ruby", "small", "span", "template", "blank", "twitter", "typeof t", "class", "attr", "pseudo", "child", "js foundation", "typeof module", "width", "object", "this", "accept", "fnumber", "gtmmf25krh", "host", "path" ], "references": [ "xfe-URL-Hush.com-stix2-2.1-export.json", "https://www.googletagmanager.com/gtag/js?id=AW-1070742489&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtm.js?id=GTM-MF25KRH", "https://www.hushmail.com/shared/javascript/jquery-3.5.1.min.js", "https://www.hushmail.com/javascriptinclude/eNrLKC3OyE3MzIkvT00qzixJtSpITE_V98lPz8xzyy_K1csqtjI0MzK2MDcwsbS0ysCq2qkov7w4tSi4JLGkGFUDAF_tIM0,.en_US.68448bd8190f2f2bae9633f547bbbbbe.0.js", "https://www.hushmail.com/javascriptinclude/eNpNzEEOQDAQQNEbtVoM7Sks7GXopB0pkQ5xfWJl-5P3JWGh4AvukSRzoKKtqlWlf0Wt4k3rnG2g641Pl6QNOU83zcIn-QMj6ZHpHQ2FF97jiHOmj0ED4FxfwQOf9yPU.en_US.68448bd8190f2f2bae9633f547bbbbbe.0.js", "https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js", "https://widget.wickedreports.com/widget.js", "https://www.googletagmanager.com/gtag/js?id=AW-1070742489", "https://www.hushmail.com/status/", "https://script.tapfiliate.com/tapfiliate.js", "https://www.googletagmanager.com/gtag/js?id=UA-1837381-13", "https://widget.wickedreports.com/v2/3469/wr-dafa9fae816c2f65d24d1eb593b58626.js", "https://cdn.callrail.com/companies/431115301/7c8f964bc12313c75ad2/12/swap.js", "https://js.callrail.com/group/0/7c8f964bc12313c75ad2/06ababf0-8852-4eef-95e1-285ae467a93a/poll.js?t=1651861725881&ids%5B%5D=431115301", "https://js.callrail.com/group/0/7c8f964bc12313c75ad2/06ababf0-8852-4eef-95e1-285ae467a93a/poll.js?t=1651861793229&ids%5B%5D=431115301", "https://widget.trustpilot.com/trustboxes/5406e65db0d04a09e042d5fc/index.html?templateId=5406e65db0d04a09e042d5fc&businessunitId=4bdc496b000064000505a89d#locale=en-US&styleHeight=28px&styleWidth=100%25&theme=light" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Vd", "display_name": "Vd", "target": null }, { "id": "OkCancel", "display_name": "OkCancel", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1531", "name": "Account Access Removal", "display_name": "T1531 - Account Access Removal" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1917, "hostname": 698, "FileHash-SHA256": 116, "domain": 263 }, "indicator_count": 2994, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1457 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62751d6e20ce7971fe122760", "name": "layerhost.com", "description": "function ra(a,b,c,d,e,f, a new type of node, which can only be defined by its own type, is the same as its current type.", "modified": "2022-06-05T00:03:45.266000", "created": "2022-05-06T13:06:54.626000", "tags": [ "typeerror", "function", "string", "urlsearchparams", "array", "object", "typeof t", "incorrect", "boolean", "iterator", "target", "error", "typeof o", "date", "typeof symbol", "window", "promise", "iere", "typeof ne", "null", "body", "this", "regexp", "please", "blob", "matomo", "post", "javascript", "link", "license", "info", "campaigns", "storagetest", "typeof json", "sufeffxa0", "typeof c", "document", "invalid attempt", "chat", "search", "language", "feel", "file", "call", "strongstart", "address", "again", "attrs", "cparseint", "dparseint", "bparseint", "9999px", "fparseint", "eparseint", "bnull", "gparseint", "iparseint", "blank", "trident", "fixedpos", "fixedheader", "click", "rotate", "dataslider", "eventtarget", "basicstructure", "moztransition", "gthis", "preventdefault", "bthis", "regexcss", "xthis", "true", "filterizr api", "filterizr", "value", "ease", "steps", "idle", "classcallcheck", "reveal", "init", "drilldown", "dropdown", "dropdownmenu", "orbit", "slider", "burn", "sticky", "keyboard", "eventkey", "apple cmd", "mapping", "mouse", "input", "cache", "button", "checkbox", "shift", "typeof b", "pseudo", "child", "class", "attr", "void", "secure", "result" ], "references": [ "xfe-IP-134.73.11.118-stix2-2.1-export.json", "xfe-URL-Powr.io-stix2-2.1-export 2.json", "xfe-URL-Layerhost.com-stix2-2.1-export.json", "xfe-URL-https___www.gandi.net-stix2-2.1-export.json", "https://www.powr.io/powr.js?platform=html", "https://www.layerhost.com/assets/js/vendor/jquery.min.js", "https://www.layerhost.com/assets/js/vendor/what-input.js", "https://www.layerhost.com/assets/js/vendor/foundation.min.js", "https://www.layerhost.com/assets/js/jquery.filterizr.min.js", "https://www.layerhost.com/assets/js/yui.js", "https://www.layerhost.com/assets/js/app.js", "https://www.layerhost.com/assets/js/slider.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/languages/en.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/js/twk-chunk-2d0d2b7c.js", "https://tag.aticdn.net/616708/smarttag.js", "https://analytics.gandi.net/piwik.js", "https://www.gandi.net/static/js/modern.27ee934b0dc5.js", "https://www.gandi.net/static/js/legacy.7cc648e3ff7a.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "EventTarget", "display_name": "EventTarget", "target": null }, { "id": "Filterizr API", "display_name": "Filterizr API", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 350, "URL": 2035, "hostname": 718, "FileHash-SHA256": 355, "CVE": 1, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 3461, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1457 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://e.l.target", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://e.l.target", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780307799.9701905 }