{
  "type": "URL",
  "indicator": "https://server2.evocterm.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://server2.evocterm.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4116182648,
      "indicator": "https://server2.evocterm.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "68beb866c8ed898ed0ece438",
          "name": "BlackieVirus . Expanded- Apple",
          "description": "",
          "modified": "2025-10-08T10:00:30.227000",
          "created": "2025-09-08T11:05:10.064000",
          "tags": [
            "present may",
            "present apr",
            "unknown ns",
            "present sep",
            "unknown aaaa",
            "present jun",
            "present dec",
            "passive dns",
            "ip address",
            "virtool",
            "win32cve sep",
            "trojan",
            "mtb sep",
            "ipv4",
            "urls",
            "trojanspy",
            "united states",
            "dynamicloader",
            "ms windows",
            "observed dns",
            "query",
            "windows nt",
            "wow64",
            "khtml",
            "gecko",
            "pe32",
            "write",
            "media",
            "malware",
            "suspicious",
            "learn",
            "ck id",
            "name tactics",
            "informative",
            "command",
            "defense evasion",
            "adversaries",
            "spawns",
            "t1204 user",
            "mitre att",
            "ck matrix",
            "null",
            "error",
            "click",
            "general",
            "local",
            "path",
            "strings",
            "refresh",
            "tools",
            "meta",
            "onload",
            "span",
            "apple",
            "entries",
            "write c",
            "defender",
            "tencent",
            "hostname add",
            "pulse submit",
            "url analysis",
            "present jul",
            "present mar",
            "present oct",
            "saudi arabia",
            "united",
            "present feb",
            "creation date",
            "search",
            "title",
            "date",
            "botnet"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "#VirTool:Win32/Obfuscator.ADB",
              "display_name": "#VirTool:Win32/Obfuscator.ADB",
              "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
            },
            {
              "id": "Win.Trojan.Filerepmalware-10008115-0",
              "display_name": "Win.Trojan.Filerepmalware-10008115-0",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Ransom:Win32/CVE",
              "display_name": "ALF:HeraklezEval:Ransom:Win32/CVE",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 951,
            "hostname": 1766,
            "URL": 4969,
            "FileHash-MD5": 337,
            "FileHash-SHA1": 317,
            "FileHash-SHA256": 4296,
            "CVE": 1,
            "SSLCertFingerprint": 1,
            "email": 1
          },
          "indicator_count": 12639,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "193 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6894fd48178a2cc0c287af71",
          "name": "Polymorphic | Worm & Trojan:Win32/Mydoom. IoC\u2019s +  | Device local *Remowted.com",
          "description": "",
          "modified": "2025-09-06T19:01:20.165000",
          "created": "2025-08-07T19:23:52.346000",
          "tags": [
            "filehashmd5",
            "indicator role",
            "title added",
            "active related",
            "filehashsha256",
            "t1105",
            "tool transfer",
            "t1480",
            "guardrails",
            "t1566",
            "t1568",
            "t1012",
            "t1023",
            "t1031",
            "service",
            "filehashsha1",
            "iocs",
            "learn more",
            "hostname",
            "types of",
            "netherlands",
            "united",
            "denmark",
            "belgium",
            "dynamicloader",
            "yara rule",
            "vmdetect",
            "write c",
            "search",
            "medium",
            "show",
            "entries",
            "high",
            "worm",
            "copy",
            "write",
            "unknown",
            "markus",
            "malware",
            "suspicious",
            "crlf line",
            "unicode text",
            "utf8",
            "ascii text",
            "trojan",
            "music",
            "next",
            "autorun"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 221,
            "FileHash-SHA1": 129,
            "FileHash-SHA256": 713,
            "URL": 2616,
            "domain": 338,
            "hostname": 598,
            "email": 7
          },
          "indicator_count": 4622,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "225 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Alf:heraklezeval:ransom:win32/cve",
            "#virtool:win32/obfuscator.adb",
            "Win.trojan.filerepmalware-10008115-0"
          ],
          "industries": [],
          "unique_indicators": 17166
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/evocterm.com",
    "whois": "http://whois.domaintools.com/evocterm.com",
    "domain": "evocterm.com",
    "hostname": "server2.evocterm.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "68beb866c8ed898ed0ece438",
      "name": "BlackieVirus . Expanded- Apple",
      "description": "",
      "modified": "2025-10-08T10:00:30.227000",
      "created": "2025-09-08T11:05:10.064000",
      "tags": [
        "present may",
        "present apr",
        "unknown ns",
        "present sep",
        "unknown aaaa",
        "present jun",
        "present dec",
        "passive dns",
        "ip address",
        "virtool",
        "win32cve sep",
        "trojan",
        "mtb sep",
        "ipv4",
        "urls",
        "trojanspy",
        "united states",
        "dynamicloader",
        "ms windows",
        "observed dns",
        "query",
        "windows nt",
        "wow64",
        "khtml",
        "gecko",
        "pe32",
        "write",
        "media",
        "malware",
        "suspicious",
        "learn",
        "ck id",
        "name tactics",
        "informative",
        "command",
        "defense evasion",
        "adversaries",
        "spawns",
        "t1204 user",
        "mitre att",
        "ck matrix",
        "null",
        "error",
        "click",
        "general",
        "local",
        "path",
        "strings",
        "refresh",
        "tools",
        "meta",
        "onload",
        "span",
        "apple",
        "entries",
        "write c",
        "defender",
        "tencent",
        "hostname add",
        "pulse submit",
        "url analysis",
        "present jul",
        "present mar",
        "present oct",
        "saudi arabia",
        "united",
        "present feb",
        "creation date",
        "search",
        "title",
        "date",
        "botnet"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "#VirTool:Win32/Obfuscator.ADB",
          "display_name": "#VirTool:Win32/Obfuscator.ADB",
          "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
        },
        {
          "id": "Win.Trojan.Filerepmalware-10008115-0",
          "display_name": "Win.Trojan.Filerepmalware-10008115-0",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Ransom:Win32/CVE",
          "display_name": "ALF:HeraklezEval:Ransom:Win32/CVE",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 951,
        "hostname": 1766,
        "URL": 4969,
        "FileHash-MD5": 337,
        "FileHash-SHA1": 317,
        "FileHash-SHA256": 4296,
        "CVE": 1,
        "SSLCertFingerprint": 1,
        "email": 1
      },
      "indicator_count": 12639,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "193 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6894fd48178a2cc0c287af71",
      "name": "Polymorphic | Worm & Trojan:Win32/Mydoom. IoC\u2019s +  | Device local *Remowted.com",
      "description": "",
      "modified": "2025-09-06T19:01:20.165000",
      "created": "2025-08-07T19:23:52.346000",
      "tags": [
        "filehashmd5",
        "indicator role",
        "title added",
        "active related",
        "filehashsha256",
        "t1105",
        "tool transfer",
        "t1480",
        "guardrails",
        "t1566",
        "t1568",
        "t1012",
        "t1023",
        "t1031",
        "service",
        "filehashsha1",
        "iocs",
        "learn more",
        "hostname",
        "types of",
        "netherlands",
        "united",
        "denmark",
        "belgium",
        "dynamicloader",
        "yara rule",
        "vmdetect",
        "write c",
        "search",
        "medium",
        "show",
        "entries",
        "high",
        "worm",
        "copy",
        "write",
        "unknown",
        "markus",
        "malware",
        "suspicious",
        "crlf line",
        "unicode text",
        "utf8",
        "ascii text",
        "trojan",
        "music",
        "next",
        "autorun"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 221,
        "FileHash-SHA1": 129,
        "FileHash-SHA256": 713,
        "URL": 2616,
        "domain": 338,
        "hostname": 598,
        "email": 7
      },
      "indicator_count": 4622,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "225 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://server2.evocterm.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://server2.evocterm.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776631613.8383927
}