{ "type": "URL", "indicator": "https://exoplayer.dev/issues/player-accessed-on-wrong-thread", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://exoplayer.dev/issues/player-accessed-on-wrong-thread", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4247401144, "indicator": "https://exoplayer.dev/issues/player-accessed-on-wrong-thread", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 5, "pulses": [ { "id": "69eb254f17eb4a2a990f07e5", "name": "LevelBlue - Open Threat Exchange", "description": "[ As part of security research, we look at some of the most well-known vulnerabilities in the PDF ecosystem, and how they can be identified and mitigated, with the help of a simple hash.] [64xxxx]", "modified": "2026-05-28T07:10:11.800000", "created": "2026-04-24T08:09:51.488000", "tags": [ "pdfkit", "cve202225765", "exploit script", "github", "unicordev", "cves", "xml external", "entity", "pdfs", "knowledge base", "python", "mozilla", "virustotal", "cisa", "apple", "microsoft", "pdfkit ruby", "remote code", "execution", "urls", "malware", "raid", "caddywiper", "wipes", "cve202543529", "webkit", "february", "cve202620643", "bypass", "march", "webkit bug", "command", "control", "levelblue", "open threat" ], "references": [ "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Wipes", "display_name": "Wipes", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1084, "FileHash-SHA1": 874, "FileHash-SHA256": 3052, "CVE": 36, "domain": 437, "hostname": 1086, "URL": 1411, "CIDR": 15, "email": 13 }, "indicator_count": 8008, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1 day ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d096edd596a1a9e9a0aa92", "name": "VirusTotal report\n for index.html", "description": "The full name of the German domain registrar: COFFEEDESIGNCODE.com, or coffeedesign code, has been published.. and it is not yet known.", "modified": "2026-05-04T04:03:27.972000", "created": "2026-04-04T04:43:25.258000", "tags": [ "date", "server", "registrar abuse", "registrant name", "expiration date", "registry domain", "registrar iana", "registrar url", "registrant city", "ag registrant", "thumbprint", "html document", "unicode text", "utf8 text", "title microsoft", "ms05019", "none", "docs", "betafred ms", "content tocrel", "conceptual", "performs dns", "https", "file type", "tls version", "mitre attack", "network info", "urls", "t1055 process", "layer protocol", "united", "phishing", "malicious", "next", "cache entry", "chrome cache", "entry", "extra info", "process", "nothing", "registry keys", "mutexes nothing", "data", "datacrashpad", "edge", "created", "parent pid", "full path", "command line", "status code", "ssl certificates", "tls certificates", "website security", "signtool", "sectigo", "microsoft", "signtool let", "web site", "rsasha256", "rsasha384", "rsasha512", "signcode", "ssl certificate", "logo", "sxa0", "object", "regexp", "null", "tdfunction", "ddfunction", "array", "string", "dfunction", "iana id", "contact phone", "dnssec", "domain status", "registrar whois", "registrar", "language", "html internet", "doctype", "learn", "seomatic og", "timestamp", "sectigo ssl", "sectigo og", "sectigohq og", "utf8", "crlf line", "text", "ipxw1920", "fwebp", "win32 exe", "pe32", "ms windows", "win16 ne", "icons library", "os2 executable", "generic windos", "executable", "pe64 compiler", "sha256", "pc bitmap", "windows bitmap", "bitmap", "zip archive", "text text", "ascii text", "has permission", "reads", "accesses", "found", "t1413 access", "sensitive data", "device logs", "persistence", "fraud", "cloud" ], "references": [ "http://clients2.google.com/time/1/current?cup2key=8:JROu1MtiAi1ExACtDuYde399VG2TxRqflS_l7p_q0tU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855%0Ahttp://x1.c.lencr.org/%0Ahttp://c.pki.goog/r/r1.crl", "https://vtbehaviour.commondatastorage.googleapis.com/5a28f4a80025385ca11cce22b13e5eed52999965afbe16cccbc5e7165c7a0ac9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775276100&Signature=NczLfuk5dyPFskbtz7UwIjCT2DzeU5uAQP%2FL%2BC5bjk7Ng%2FHccJbUFWcb%2FqpvZaJ%2BWg4tg6aaPKihJzwDyiF7UaJOwdX3172ddwGJAfggvgpJ68YtVBE1nyhHAoFO6KsLL73DjNj58e8Uhq6Bcx4nXa86FETCR%2FzzXDlLDXyQSxf%2FKhG8zuxEsss9vRDCF%2B3TJGvJ5EmQ5HwGvk2ex9wf6H1FrBxEyx6BH5i6txcC9vMG9SXQ6eYR2p", "https://vtbehaviour.commondatastorage.googleapis.com/5a28f4a80025385ca11cce22b13e5eed52999965afbe16cccbc5e7165c7a0ac9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775276177&Signature=iO1RoMLTZsC3s7nBZ8wieXl6wwWrnnCqu%2F5pXBAa2Luk2wKtKTXUyyZEOOhqaCFNbUPjsIfY1v0KxEBxzkumSiDs3XXBs%2FYt49goHGNudddQOKcmLsjbT2GhALTnmmVvl79aLJaLwnMe9B7PkJpSTGuBrutOjF5VJ0yofcbM4XjQQlOIkc8WWi94WMVxXpWAjFK9D5zmoyn9G5w1TahDZjePP%2FfkKNpJe2OqRQ59iXyHcG1nvA%2FUIx", "http://timestamp.sectigo.com/", "https://www.google-analytics.com/analytics.js", "http://clients2.google.com/time/1/current?cup2key=8:JROu1MtiAi1ExACtDuYde399VG2TxRqflS_l7p_q0tU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "https://vtbehaviour.commondatastorage.googleapis.com/5a28f4a80025385ca11cce22b13e5eed52999965afbe16cccbc5e7165c7a0ac9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775277214&Signature=y3%2FkmodrmzpLTVDtkzYvlqSkUTQ8Tri%2FDiLIqIpCBmJ6%2Bwk5p%2FJDSAwE5V8Wdp0vWLWjfA4DvRyS%2FvmNV4kFOr422iVZH2Ap2evf8%2Bq2bp9CW%2BAuBCjgz9K329V4%2B%2B9duUsUhVBqZ%2BNKz%2Fj4z7ZDBI%2BjqPV8XjvTI7pXAfzknmFAfZU%2FjalCNigHCX%2FIOgymeTOfzSOLYLClpNTr%2BYle8VSI%2BHf9TgUWP2WgNF", "https://vtbehaviour.commondatastorage.googleapis.com/028e16744de653383b403efd4b755075deeb7d8ce264d7edd4615725e5b4c4c6_Zenbox%20android.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775277967&Signature=oSvtx7eGCctItNKSDZN4tpJp11yn5QQjCHsLi45z7kUOa9nbuhPdVjh9gBKlXtNuGfXbpItYf6NFI%2B4pKCin266TJQP7FzDSnUzzziJTuqmZwxihDeoZ1RauqVOzGoAmrj9sG8nOYXqbOHNxQ3E6SugSzW3UFbyQJzfKt%2FsqsPsKAvl4su%2FlkWsqTHUR%2FT%2FLTTQV0ZXLwnrLv%2FdBA7DdsiE35g%2FPOiUdzJjkjhSILF%2BR" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1406", "name": "Obfuscated Files or Information", "display_name": "T1406 - Obfuscated Files or Information" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1413", "name": "Access Sensitive Data in Device Logs", "display_name": "T1413 - Access Sensitive Data in Device Logs" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1424", "name": "Process Discovery", "display_name": "T1424 - Process Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1429", "name": "Capture Audio", "display_name": "T1429 - Capture Audio" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 50, "email": 2, "hostname": 196, "FileHash-SHA1": 51, "URL": 234, "FileHash-MD5": 54, "FileHash-SHA256": 715 }, "indicator_count": 1302, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d096edff67896dccb36a4d", "name": "VirusTotal report\n for index.html", "description": "The full name of the German domain registrar: COFFEEDESIGNCODE.com, or coffeedesign code, has been published.. and it is not yet known.", "modified": "2026-05-04T04:03:27.972000", "created": "2026-04-04T04:43:25.967000", "tags": [ "date", "server", "registrar abuse", "registrant name", "expiration date", "registry domain", "registrar iana", "registrar url", "registrant city", "ag registrant", "thumbprint", "html document", "unicode text", "utf8 text", "title microsoft", "ms05019", "none", "docs", "betafred ms", "content tocrel", "conceptual", "performs dns", "https", "file type", "tls version", "mitre attack", "network info", "urls", "t1055 process", "layer protocol", "united", "phishing", "malicious", "next", "cache entry", "chrome cache", "entry", "extra info", "process", "nothing", "registry keys", "mutexes nothing", "data", "datacrashpad", "edge", "created", "parent pid", "full path", "command line", "status code", "ssl certificates", "tls certificates", "website security", "signtool", "sectigo", "microsoft", "signtool let", "web site", "rsasha256", "rsasha384", "rsasha512", "signcode", "ssl certificate", "logo", "sxa0", "object", "regexp", "null", "tdfunction", "ddfunction", "array", "string", "dfunction", "iana id", "contact phone", "dnssec", "domain status", "registrar whois", "registrar", "language", "html internet", "doctype", "learn", "seomatic og", "timestamp", "sectigo ssl", "sectigo og", "sectigohq og", "utf8", "crlf line", "text", "ipxw1920", "fwebp", "win32 exe", "pe32", "ms windows", "win16 ne", "icons library", "os2 executable", "generic windos", "executable", "pe64 compiler", "sha256", "pc bitmap", "windows bitmap", "bitmap", "zip archive", "text text", "ascii text", "has permission", "reads", "accesses", "found", "t1413 access", "sensitive data", "device logs", "persistence", "fraud", "cloud" ], "references": [ "http://clients2.google.com/time/1/current?cup2key=8:JROu1MtiAi1ExACtDuYde399VG2TxRqflS_l7p_q0tU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855%0Ahttp://x1.c.lencr.org/%0Ahttp://c.pki.goog/r/r1.crl", "https://vtbehaviour.commondatastorage.googleapis.com/5a28f4a80025385ca11cce22b13e5eed52999965afbe16cccbc5e7165c7a0ac9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775276100&Signature=NczLfuk5dyPFskbtz7UwIjCT2DzeU5uAQP%2FL%2BC5bjk7Ng%2FHccJbUFWcb%2FqpvZaJ%2BWg4tg6aaPKihJzwDyiF7UaJOwdX3172ddwGJAfggvgpJ68YtVBE1nyhHAoFO6KsLL73DjNj58e8Uhq6Bcx4nXa86FETCR%2FzzXDlLDXyQSxf%2FKhG8zuxEsss9vRDCF%2B3TJGvJ5EmQ5HwGvk2ex9wf6H1FrBxEyx6BH5i6txcC9vMG9SXQ6eYR2p", "https://vtbehaviour.commondatastorage.googleapis.com/5a28f4a80025385ca11cce22b13e5eed52999965afbe16cccbc5e7165c7a0ac9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775276177&Signature=iO1RoMLTZsC3s7nBZ8wieXl6wwWrnnCqu%2F5pXBAa2Luk2wKtKTXUyyZEOOhqaCFNbUPjsIfY1v0KxEBxzkumSiDs3XXBs%2FYt49goHGNudddQOKcmLsjbT2GhALTnmmVvl79aLJaLwnMe9B7PkJpSTGuBrutOjF5VJ0yofcbM4XjQQlOIkc8WWi94WMVxXpWAjFK9D5zmoyn9G5w1TahDZjePP%2FfkKNpJe2OqRQ59iXyHcG1nvA%2FUIx", "http://timestamp.sectigo.com/", "https://www.google-analytics.com/analytics.js", "http://clients2.google.com/time/1/current?cup2key=8:JROu1MtiAi1ExACtDuYde399VG2TxRqflS_l7p_q0tU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "https://vtbehaviour.commondatastorage.googleapis.com/5a28f4a80025385ca11cce22b13e5eed52999965afbe16cccbc5e7165c7a0ac9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775277214&Signature=y3%2FkmodrmzpLTVDtkzYvlqSkUTQ8Tri%2FDiLIqIpCBmJ6%2Bwk5p%2FJDSAwE5V8Wdp0vWLWjfA4DvRyS%2FvmNV4kFOr422iVZH2Ap2evf8%2Bq2bp9CW%2BAuBCjgz9K329V4%2B%2B9duUsUhVBqZ%2BNKz%2Fj4z7ZDBI%2BjqPV8XjvTI7pXAfzknmFAfZU%2FjalCNigHCX%2FIOgymeTOfzSOLYLClpNTr%2BYle8VSI%2BHf9TgUWP2WgNF", "https://vtbehaviour.commondatastorage.googleapis.com/028e16744de653383b403efd4b755075deeb7d8ce264d7edd4615725e5b4c4c6_Zenbox%20android.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775277967&Signature=oSvtx7eGCctItNKSDZN4tpJp11yn5QQjCHsLi45z7kUOa9nbuhPdVjh9gBKlXtNuGfXbpItYf6NFI%2B4pKCin266TJQP7FzDSnUzzziJTuqmZwxihDeoZ1RauqVOzGoAmrj9sG8nOYXqbOHNxQ3E6SugSzW3UFbyQJzfKt%2FsqsPsKAvl4su%2FlkWsqTHUR%2FT%2FLTTQV0ZXLwnrLv%2FdBA7DdsiE35g%2FPOiUdzJjkjhSILF%2BR" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1406", "name": "Obfuscated Files or Information", "display_name": "T1406 - Obfuscated Files or Information" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1413", "name": "Access Sensitive Data in Device Logs", "display_name": "T1413 - Access Sensitive Data in Device Logs" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1424", "name": "Process Discovery", "display_name": "T1424 - Process Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1429", "name": "Capture Audio", "display_name": "T1429 - Capture Audio" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 50, "email": 2, "hostname": 196, "FileHash-SHA1": 51, "URL": 234, "FileHash-MD5": 54, "FileHash-SHA256": 715 }, "indicator_count": 1302, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ad4f70dd8cd3a4bae75670", "name": "krnaver.com- BL! 10 month of no sleep and all i could read was ralph nader #doh", "description": "Pulse\nPulses\n5\nPassive DNS\n39\nURLs\n12\nFiles\n1K\nAnalysis Overview\nIP Address\n104.17.232.29\nLocation\n\nUnited States\nASN\nAS13335 cloudflare\nNameservers\nns36.domaincontrol.com.\n, \nns35.domaincontrol.com.\nWHOIS\nRegistrar:\nXiamen Domains, Inc., \nCreation Date:\nNov 12, 2016\nRelated Pulses\nOTX User-Created Pulses (5)\nRelated Tags\nNone\nIndicator Facts\n1000 malicious files communicating\nHistorical OTX telemetry\nRunning webserver\n2 subdomains\nNumber of malicious files communicating with the domain or subdomains\nAntivirus Detections\nBackdoor:Win32/Venik.E!dha\n, \nBackdoor:Win32/Venik.I\n, \nBackdoor:Win32/Venik.J\n, \nWin.Trojan.Packed-123\nAV Detection Ratio\n1000\n / 1000", "modified": "2026-04-07T10:26:55.912000", "created": "2026-03-08T10:29:04.330000", "tags": [ "backdoor", "pulse", "passive dns", "urls", "files", "ip address", "location united", "asn as13335", "whois registrar", "domains" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 321, "hostname": 85, "URL": 87, "FileHash-MD5": 151, "FileHash-SHA1": 151, "FileHash-SHA256": 152, "email": 6 }, "indicator_count": 953, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "52 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ada442ba9893ca65ae8b87", "name": "VirusTotal report\n for base.apk", "description": "We are going to be the ones leaning on Fury. To win this, I don't need to be heavy, I need to be fast and quick.", "modified": "2026-03-08T16:30:58.152000", "created": "2026-03-08T16:30:58.152000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1406", "name": "Obfuscated Files or Information", "display_name": "T1406 - Obfuscated Files or Information" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1422", "name": "System Network Configuration Discovery", "display_name": "T1422 - System Network Configuration Discovery" }, { "id": "T1424", "name": "Process Discovery", "display_name": "T1424 - Process Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "URL": 47, "domain": 10, "hostname": 21 }, "indicator_count": 81, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "81 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/5a28f4a80025385ca11cce22b13e5eed52999965afbe16cccbc5e7165c7a0ac9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775276100&Signature=NczLfuk5dyPFskbtz7UwIjCT2DzeU5uAQP%2FL%2BC5bjk7Ng%2FHccJbUFWcb%2FqpvZaJ%2BWg4tg6aaPKihJzwDyiF7UaJOwdX3172ddwGJAfggvgpJ68YtVBE1nyhHAoFO6KsLL73DjNj58e8Uhq6Bcx4nXa86FETCR%2FzzXDlLDXyQSxf%2FKhG8zuxEsss9vRDCF%2B3TJGvJ5EmQ5HwGvk2ex9wf6H1FrBxEyx6BH5i6txcC9vMG9SXQ6eYR2p", "https://www.google-analytics.com/analytics.js", "http://clients2.google.com/time/1/current?cup2key=8:JROu1MtiAi1ExACtDuYde399VG2TxRqflS_l7p_q0tU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters.", "http://timestamp.sectigo.com/", "https://vtbehaviour.commondatastorage.googleapis.com/5a28f4a80025385ca11cce22b13e5eed52999965afbe16cccbc5e7165c7a0ac9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775276177&Signature=iO1RoMLTZsC3s7nBZ8wieXl6wwWrnnCqu%2F5pXBAa2Luk2wKtKTXUyyZEOOhqaCFNbUPjsIfY1v0KxEBxzkumSiDs3XXBs%2FYt49goHGNudddQOKcmLsjbT2GhALTnmmVvl79aLJaLwnMe9B7PkJpSTGuBrutOjF5VJ0yofcbM4XjQQlOIkc8WWi94WMVxXpWAjFK9D5zmoyn9G5w1TahDZjePP%2FfkKNpJe2OqRQ59iXyHcG1nvA%2FUIx", "https://vtbehaviour.commondatastorage.googleapis.com/5a28f4a80025385ca11cce22b13e5eed52999965afbe16cccbc5e7165c7a0ac9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775277214&Signature=y3%2FkmodrmzpLTVDtkzYvlqSkUTQ8Tri%2FDiLIqIpCBmJ6%2Bwk5p%2FJDSAwE5V8Wdp0vWLWjfA4DvRyS%2FvmNV4kFOr422iVZH2Ap2evf8%2Bq2bp9CW%2BAuBCjgz9K329V4%2B%2B9duUsUhVBqZ%2BNKz%2Fj4z7ZDBI%2BjqPV8XjvTI7pXAfzknmFAfZU%2FjalCNigHCX%2FIOgymeTOfzSOLYLClpNTr%2BYle8VSI%2BHf9TgUWP2WgNF", "https://vtbehaviour.commondatastorage.googleapis.com/028e16744de653383b403efd4b755075deeb7d8ce264d7edd4615725e5b4c4c6_Zenbox%20android.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775277967&Signature=oSvtx7eGCctItNKSDZN4tpJp11yn5QQjCHsLi45z7kUOa9nbuhPdVjh9gBKlXtNuGfXbpItYf6NFI%2B4pKCin266TJQP7FzDSnUzzziJTuqmZwxihDeoZ1RauqVOzGoAmrj9sG8nOYXqbOHNxQ3E6SugSzW3UFbyQJzfKt%2FsqsPsKAvl4su%2FlkWsqTHUR%2FT%2FLTTQV0ZXLwnrLv%2FdBA7DdsiE35g%2FPOiUdzJjkjhSILF%2BR", "http://clients2.google.com/time/1/current?cup2key=8:JROu1MtiAi1ExACtDuYde399VG2TxRqflS_l7p_q0tU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855%0Ahttp://x1.c.lencr.org/%0Ahttp://c.pki.goog/r/r1.crl" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Wipes" ], "industries": [], "unique_indicators": 5739 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/exoplayer.dev", "whois": "http://whois.domaintools.com/exoplayer.dev", "domain": "exoplayer.dev", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 5, "pulses": [ { "id": "69eb254f17eb4a2a990f07e5", "name": "LevelBlue - Open Threat Exchange", "description": "[ As part of security research, we look at some of the most well-known vulnerabilities in the PDF ecosystem, and how they can be identified and mitigated, with the help of a simple hash.] [64xxxx]", "modified": "2026-05-28T07:10:11.800000", "created": "2026-04-24T08:09:51.488000", "tags": [ "pdfkit", "cve202225765", "exploit script", "github", "unicordev", "cves", "xml external", "entity", "pdfs", "knowledge base", "python", "mozilla", "virustotal", "cisa", "apple", "microsoft", "pdfkit ruby", "remote code", "execution", "urls", "malware", "raid", "caddywiper", "wipes", "cve202543529", "webkit", "february", "cve202620643", "bypass", "march", "webkit bug", "command", "control", "levelblue", "open threat" ], "references": [ "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Wipes", "display_name": "Wipes", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1084, "FileHash-SHA1": 874, "FileHash-SHA256": 3052, "CVE": 36, "domain": 437, "hostname": 1086, "URL": 1411, "CIDR": 15, "email": 13 }, "indicator_count": 8008, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1 day ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d096edd596a1a9e9a0aa92", "name": "VirusTotal report\n for index.html", "description": "The full name of the German domain registrar: COFFEEDESIGNCODE.com, or coffeedesign code, has been published.. and it is not yet known.", "modified": "2026-05-04T04:03:27.972000", "created": "2026-04-04T04:43:25.258000", "tags": [ "date", "server", "registrar abuse", "registrant name", "expiration date", "registry domain", "registrar iana", "registrar url", "registrant city", "ag registrant", "thumbprint", "html document", "unicode text", "utf8 text", "title microsoft", "ms05019", "none", "docs", "betafred ms", "content tocrel", "conceptual", "performs dns", "https", "file type", "tls version", "mitre attack", "network info", "urls", "t1055 process", "layer protocol", "united", "phishing", "malicious", "next", "cache entry", "chrome cache", "entry", "extra info", "process", "nothing", "registry keys", "mutexes nothing", "data", "datacrashpad", "edge", "created", "parent pid", "full path", "command line", "status code", "ssl certificates", "tls certificates", "website security", "signtool", "sectigo", "microsoft", "signtool let", "web site", "rsasha256", "rsasha384", "rsasha512", "signcode", "ssl certificate", "logo", "sxa0", "object", "regexp", "null", "tdfunction", "ddfunction", "array", "string", "dfunction", "iana id", "contact phone", "dnssec", "domain status", "registrar whois", "registrar", "language", "html internet", "doctype", "learn", "seomatic og", "timestamp", "sectigo ssl", "sectigo og", "sectigohq og", "utf8", "crlf line", "text", "ipxw1920", "fwebp", "win32 exe", "pe32", "ms windows", "win16 ne", "icons library", "os2 executable", "generic windos", "executable", "pe64 compiler", "sha256", "pc bitmap", "windows bitmap", "bitmap", "zip archive", "text text", "ascii text", "has permission", "reads", "accesses", "found", "t1413 access", "sensitive data", "device logs", "persistence", "fraud", "cloud" ], "references": [ "http://clients2.google.com/time/1/current?cup2key=8:JROu1MtiAi1ExACtDuYde399VG2TxRqflS_l7p_q0tU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855%0Ahttp://x1.c.lencr.org/%0Ahttp://c.pki.goog/r/r1.crl", "https://vtbehaviour.commondatastorage.googleapis.com/5a28f4a80025385ca11cce22b13e5eed52999965afbe16cccbc5e7165c7a0ac9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775276100&Signature=NczLfuk5dyPFskbtz7UwIjCT2DzeU5uAQP%2FL%2BC5bjk7Ng%2FHccJbUFWcb%2FqpvZaJ%2BWg4tg6aaPKihJzwDyiF7UaJOwdX3172ddwGJAfggvgpJ68YtVBE1nyhHAoFO6KsLL73DjNj58e8Uhq6Bcx4nXa86FETCR%2FzzXDlLDXyQSxf%2FKhG8zuxEsss9vRDCF%2B3TJGvJ5EmQ5HwGvk2ex9wf6H1FrBxEyx6BH5i6txcC9vMG9SXQ6eYR2p", "https://vtbehaviour.commondatastorage.googleapis.com/5a28f4a80025385ca11cce22b13e5eed52999965afbe16cccbc5e7165c7a0ac9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775276177&Signature=iO1RoMLTZsC3s7nBZ8wieXl6wwWrnnCqu%2F5pXBAa2Luk2wKtKTXUyyZEOOhqaCFNbUPjsIfY1v0KxEBxzkumSiDs3XXBs%2FYt49goHGNudddQOKcmLsjbT2GhALTnmmVvl79aLJaLwnMe9B7PkJpSTGuBrutOjF5VJ0yofcbM4XjQQlOIkc8WWi94WMVxXpWAjFK9D5zmoyn9G5w1TahDZjePP%2FfkKNpJe2OqRQ59iXyHcG1nvA%2FUIx", "http://timestamp.sectigo.com/", "https://www.google-analytics.com/analytics.js", "http://clients2.google.com/time/1/current?cup2key=8:JROu1MtiAi1ExACtDuYde399VG2TxRqflS_l7p_q0tU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "https://vtbehaviour.commondatastorage.googleapis.com/5a28f4a80025385ca11cce22b13e5eed52999965afbe16cccbc5e7165c7a0ac9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775277214&Signature=y3%2FkmodrmzpLTVDtkzYvlqSkUTQ8Tri%2FDiLIqIpCBmJ6%2Bwk5p%2FJDSAwE5V8Wdp0vWLWjfA4DvRyS%2FvmNV4kFOr422iVZH2Ap2evf8%2Bq2bp9CW%2BAuBCjgz9K329V4%2B%2B9duUsUhVBqZ%2BNKz%2Fj4z7ZDBI%2BjqPV8XjvTI7pXAfzknmFAfZU%2FjalCNigHCX%2FIOgymeTOfzSOLYLClpNTr%2BYle8VSI%2BHf9TgUWP2WgNF", "https://vtbehaviour.commondatastorage.googleapis.com/028e16744de653383b403efd4b755075deeb7d8ce264d7edd4615725e5b4c4c6_Zenbox%20android.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775277967&Signature=oSvtx7eGCctItNKSDZN4tpJp11yn5QQjCHsLi45z7kUOa9nbuhPdVjh9gBKlXtNuGfXbpItYf6NFI%2B4pKCin266TJQP7FzDSnUzzziJTuqmZwxihDeoZ1RauqVOzGoAmrj9sG8nOYXqbOHNxQ3E6SugSzW3UFbyQJzfKt%2FsqsPsKAvl4su%2FlkWsqTHUR%2FT%2FLTTQV0ZXLwnrLv%2FdBA7DdsiE35g%2FPOiUdzJjkjhSILF%2BR" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1406", "name": "Obfuscated Files or Information", "display_name": "T1406 - Obfuscated Files or Information" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1413", "name": "Access Sensitive Data in Device Logs", "display_name": "T1413 - Access Sensitive Data in Device Logs" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1424", "name": "Process Discovery", "display_name": "T1424 - Process Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1429", "name": "Capture Audio", "display_name": "T1429 - Capture Audio" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 50, "email": 2, "hostname": 196, "FileHash-SHA1": 51, "URL": 234, "FileHash-MD5": 54, "FileHash-SHA256": 715 }, "indicator_count": 1302, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d096edff67896dccb36a4d", "name": "VirusTotal report\n for index.html", "description": "The full name of the German domain registrar: COFFEEDESIGNCODE.com, or coffeedesign code, has been published.. and it is not yet known.", "modified": "2026-05-04T04:03:27.972000", "created": "2026-04-04T04:43:25.967000", "tags": [ "date", "server", "registrar abuse", "registrant name", "expiration date", "registry domain", "registrar iana", "registrar url", "registrant city", "ag registrant", "thumbprint", "html document", "unicode text", "utf8 text", "title microsoft", "ms05019", "none", "docs", "betafred ms", "content tocrel", "conceptual", "performs dns", "https", "file type", "tls version", "mitre attack", "network info", "urls", "t1055 process", "layer protocol", "united", "phishing", "malicious", "next", "cache entry", "chrome cache", "entry", "extra info", "process", "nothing", "registry keys", "mutexes nothing", "data", "datacrashpad", "edge", "created", "parent pid", "full path", "command line", "status code", "ssl certificates", "tls certificates", "website security", "signtool", "sectigo", "microsoft", "signtool let", "web site", "rsasha256", "rsasha384", "rsasha512", "signcode", "ssl certificate", "logo", "sxa0", "object", "regexp", "null", "tdfunction", "ddfunction", "array", "string", "dfunction", "iana id", "contact phone", "dnssec", "domain status", "registrar whois", "registrar", "language", "html internet", "doctype", "learn", "seomatic og", "timestamp", "sectigo ssl", "sectigo og", "sectigohq og", "utf8", "crlf line", "text", "ipxw1920", "fwebp", "win32 exe", "pe32", "ms windows", "win16 ne", "icons library", "os2 executable", "generic windos", "executable", "pe64 compiler", "sha256", "pc bitmap", "windows bitmap", "bitmap", "zip archive", "text text", "ascii text", "has permission", "reads", "accesses", "found", "t1413 access", "sensitive data", "device logs", "persistence", "fraud", "cloud" ], "references": [ "http://clients2.google.com/time/1/current?cup2key=8:JROu1MtiAi1ExACtDuYde399VG2TxRqflS_l7p_q0tU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855%0Ahttp://x1.c.lencr.org/%0Ahttp://c.pki.goog/r/r1.crl", "https://vtbehaviour.commondatastorage.googleapis.com/5a28f4a80025385ca11cce22b13e5eed52999965afbe16cccbc5e7165c7a0ac9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775276100&Signature=NczLfuk5dyPFskbtz7UwIjCT2DzeU5uAQP%2FL%2BC5bjk7Ng%2FHccJbUFWcb%2FqpvZaJ%2BWg4tg6aaPKihJzwDyiF7UaJOwdX3172ddwGJAfggvgpJ68YtVBE1nyhHAoFO6KsLL73DjNj58e8Uhq6Bcx4nXa86FETCR%2FzzXDlLDXyQSxf%2FKhG8zuxEsss9vRDCF%2B3TJGvJ5EmQ5HwGvk2ex9wf6H1FrBxEyx6BH5i6txcC9vMG9SXQ6eYR2p", "https://vtbehaviour.commondatastorage.googleapis.com/5a28f4a80025385ca11cce22b13e5eed52999965afbe16cccbc5e7165c7a0ac9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775276177&Signature=iO1RoMLTZsC3s7nBZ8wieXl6wwWrnnCqu%2F5pXBAa2Luk2wKtKTXUyyZEOOhqaCFNbUPjsIfY1v0KxEBxzkumSiDs3XXBs%2FYt49goHGNudddQOKcmLsjbT2GhALTnmmVvl79aLJaLwnMe9B7PkJpSTGuBrutOjF5VJ0yofcbM4XjQQlOIkc8WWi94WMVxXpWAjFK9D5zmoyn9G5w1TahDZjePP%2FfkKNpJe2OqRQ59iXyHcG1nvA%2FUIx", "http://timestamp.sectigo.com/", "https://www.google-analytics.com/analytics.js", "http://clients2.google.com/time/1/current?cup2key=8:JROu1MtiAi1ExACtDuYde399VG2TxRqflS_l7p_q0tU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "https://vtbehaviour.commondatastorage.googleapis.com/5a28f4a80025385ca11cce22b13e5eed52999965afbe16cccbc5e7165c7a0ac9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775277214&Signature=y3%2FkmodrmzpLTVDtkzYvlqSkUTQ8Tri%2FDiLIqIpCBmJ6%2Bwk5p%2FJDSAwE5V8Wdp0vWLWjfA4DvRyS%2FvmNV4kFOr422iVZH2Ap2evf8%2Bq2bp9CW%2BAuBCjgz9K329V4%2B%2B9duUsUhVBqZ%2BNKz%2Fj4z7ZDBI%2BjqPV8XjvTI7pXAfzknmFAfZU%2FjalCNigHCX%2FIOgymeTOfzSOLYLClpNTr%2BYle8VSI%2BHf9TgUWP2WgNF", "https://vtbehaviour.commondatastorage.googleapis.com/028e16744de653383b403efd4b755075deeb7d8ce264d7edd4615725e5b4c4c6_Zenbox%20android.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775277967&Signature=oSvtx7eGCctItNKSDZN4tpJp11yn5QQjCHsLi45z7kUOa9nbuhPdVjh9gBKlXtNuGfXbpItYf6NFI%2B4pKCin266TJQP7FzDSnUzzziJTuqmZwxihDeoZ1RauqVOzGoAmrj9sG8nOYXqbOHNxQ3E6SugSzW3UFbyQJzfKt%2FsqsPsKAvl4su%2FlkWsqTHUR%2FT%2FLTTQV0ZXLwnrLv%2FdBA7DdsiE35g%2FPOiUdzJjkjhSILF%2BR" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1406", "name": "Obfuscated Files or Information", "display_name": "T1406 - Obfuscated Files or Information" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1413", "name": "Access Sensitive Data in Device Logs", "display_name": "T1413 - Access Sensitive Data in Device Logs" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1424", "name": "Process Discovery", "display_name": "T1424 - Process Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1429", "name": "Capture Audio", "display_name": "T1429 - Capture Audio" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 50, "email": 2, "hostname": 196, "FileHash-SHA1": 51, "URL": 234, "FileHash-MD5": 54, "FileHash-SHA256": 715 }, "indicator_count": 1302, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ad4f70dd8cd3a4bae75670", "name": "krnaver.com- BL! 10 month of no sleep and all i could read was ralph nader #doh", "description": "Pulse\nPulses\n5\nPassive DNS\n39\nURLs\n12\nFiles\n1K\nAnalysis Overview\nIP Address\n104.17.232.29\nLocation\n\nUnited States\nASN\nAS13335 cloudflare\nNameservers\nns36.domaincontrol.com.\n, \nns35.domaincontrol.com.\nWHOIS\nRegistrar:\nXiamen Domains, Inc., \nCreation Date:\nNov 12, 2016\nRelated Pulses\nOTX User-Created Pulses (5)\nRelated Tags\nNone\nIndicator Facts\n1000 malicious files communicating\nHistorical OTX telemetry\nRunning webserver\n2 subdomains\nNumber of malicious files communicating with the domain or subdomains\nAntivirus Detections\nBackdoor:Win32/Venik.E!dha\n, \nBackdoor:Win32/Venik.I\n, \nBackdoor:Win32/Venik.J\n, \nWin.Trojan.Packed-123\nAV Detection Ratio\n1000\n / 1000", "modified": "2026-04-07T10:26:55.912000", "created": "2026-03-08T10:29:04.330000", "tags": [ "backdoor", "pulse", "passive dns", "urls", "files", "ip address", "location united", "asn as13335", "whois registrar", "domains" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 321, "hostname": 85, "URL": 87, "FileHash-MD5": 151, "FileHash-SHA1": 151, "FileHash-SHA256": 152, "email": 6 }, "indicator_count": 953, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "52 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ada442ba9893ca65ae8b87", "name": "VirusTotal report\n for base.apk", "description": "We are going to be the ones leaning on Fury. To win this, I don't need to be heavy, I need to be fast and quick.", "modified": "2026-03-08T16:30:58.152000", "created": "2026-03-08T16:30:58.152000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1406", "name": "Obfuscated Files or Information", "display_name": "T1406 - Obfuscated Files or Information" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1422", "name": "System Network Configuration Discovery", "display_name": "T1422 - System Network Configuration Discovery" }, { "id": "T1424", "name": "Process Discovery", "display_name": "T1424 - Process Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "URL": 47, "domain": 10, "hostname": 21 }, "indicator_count": 81, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "81 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "type": "URL", "indicator": "https://exoplayer.dev/issues/player-accessed-on-wrong-thread", "stats": { "malicious": 0, "suspicious": 0, "harmless": 58, "undetected": 34, "total": 92, "verdict": "clean", "ratio": "0/92" }, "verdict": "clean", "ratio": "0/92", "final_url": "https://exoplayer.dev/issues/player-accessed-on-wrong-thread", "title": "Getting started \u00a0|\u00a0 Android media \u00a0|\u00a0 Android Developers", "reputation": 0, "tags": [ "third-party-cookies", "external-resources", "iframes", "trackers" ], "top_detections": [], "last_analysis": 1779705186, "error": null }, "abuseipdb": null, "urlhaus": { "indicator": "https://exoplayer.dev/issues/player-accessed-on-wrong-thread", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780061477.5253098 }