{ "type": "URL", "indicator": "https://support.apple.com/en-us/103272", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://support.apple.com/en-us/103272", "type": "url", "type_title": "URL", "validation": [ { "source": "alexa", "message": "Alexa rank: #45", "name": "Listed on Alexa" }, { "source": "akamai", "message": "Akamai rank: #2", "name": "Akamai Popular Domain" }, { "source": "whitelist", "message": "Whitelisted domain apple.com", "name": "Whitelisted domain" }, { "source": "majestic", "message": "Whitelisted domain apple.com", "name": "Whitelisted domain" }, { "source": "newssite", "message": "Whitelisted news domain apple.com", "name": "Whitelisted newssite network domain" } ], "base_indicator": { "id": 4188110413, "indicator": "https://support.apple.com/en-us/103272", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 9, "pulses": [ { "id": "69ada9e03dfe3f81c5cd894c", "name": "VirusTotal Box of Apples Sandbox report", "description": "I cannot stress enough the degree of interpretation this requires and *if malicious* could damage. Please use dilligance in vetting.", "modified": "2026-04-07T16:31:49.011000", "created": "2026-03-08T16:54:56.051000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 6, "FileHash-SHA256": 2, "domain": 5, "hostname": 10, "FileHash-MD5": 2, "URL": 1 }, "indicator_count": 26, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "54 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ad96c73b3e5e2606e80c55", "name": "CAPE Sandbox - intel/apple intersect", "description": "Intel- this ones for you stay safe. Look at the GUI indicators.", "modified": "2026-04-07T15:29:29.427000", "created": "2026-03-08T15:33:27.411000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 264, "FileHash-SHA1": 21, "FileHash-SHA256": 21, "URL": 13, "hostname": 38, "domain": 2 }, "indicator_count": 359, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "54 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ad7b0cc162742bd7357fdd", "name": "Control & Command", "description": "ind. security researcher / USA supporter&assisting in IOCs / whistleblower preservation", "modified": "2026-04-07T13:38:32.759000", "created": "2026-03-08T13:35:08.036000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 293, "domain": 29, "FileHash-MD5": 537, "FileHash-SHA1": 95, "FileHash-SHA256": 636, "URL": 88, "email": 620, "CIDR": 1 }, "indicator_count": 2299, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "54 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ad9422422d5502b5ed1511", "name": "Boardman US. RAT", "description": "92d12cfd54e3dc208dc384fe4099c698\n9af3719b3f61095537e5e7497c65e2a3144440f7\n004adf62746e56b097d3f5885006bd185ffc002bcd960e3eea1ce652fb1893f4\n9efc148da7a2b8658acadc68062b6a1f\n49152:7M2Z3k7U1Q6dBI2G77X351G840RVvdfa67APb7mOjgKmqWEa:Q21k7ZV36EjAPnEKmqWEa\nT13AF58C13A7806C55C2C7E078278F5766D321FE349BB0B6EB62A1E1725FF1E854B26702\ne425830dfabd452ff9f90e4fda33e1aeca03f048\n7c79cbe223cd707653c3c852b7f39260\nMach-O \nexecutable\nmac\nmacho\nMach-O 64-bit x86_64 executable, flags:\nMac OS X Mach-O 64-bit Intel executable (100%)\nMach-O64 Operation system: macOS [EXECUTE64]\nMACHO\n3.22 MB (3378336 bytes)", "modified": "2026-04-07T00:35:09.118000", "created": "2026-03-08T15:22:10.713000", "tags": [ "macho", "macho 64bit", "x8664", "mac os", "x macho", "execute64" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 5, "FileHash-SHA1": 4, "FileHash-SHA256": 3, "URL": 10, "domain": 1, "hostname": 5 }, "indicator_count": 28, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "55 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ad9532e4cd4d1ef34bd416", "name": "VirusTotal Box of Apples Sandbox report", "description": "creep.", "modified": "2026-04-07T00:35:09.118000", "created": "2026-03-08T15:26:42.277000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 3, "domain": 24, "URL": 5, "hostname": 3 }, "indicator_count": 35, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "55 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ad849bc4a9645caea2fc8f", "name": "Compiler: Microsoft Visual C/C++ (16.00) Linker: Microsoft Linker", "description": "file not signed -eecedb98e78f45084c8bee1c27d0433f\nebc706d07e75ae5fb3edc35a100299753dee9c1b\nd5909a0b142656fd2543560c88e3cc50909890554d7f11c9b5014596d6867770\n038106656d157d061d1d14z1b2zff2z11jz3001f346z5\ne34edbfb9adaa0a6270942765754b79cafb0ce9b375ee3fd3a19c1381583dc39\nfc1b4cc5a756f054a943d6d1ec76a37c\n1572864:SqufgchDAiQy34zGOar6U0OZ4rn7cBSqYhaqH9Im9cFS0rwVLdnZlKUz5cFW33Eh:SqJ3srw/KUmZ2AGK\nT13EE85A03E29651D8D06DD0B997579232FAB1BC084B256A", "modified": "2026-03-09T04:33:06.452000", "created": "2026-03-08T14:15:55.253000", "tags": [ "win32 exe", "pe32 executable", "ms windows", "intel", "win16 ne", "os2 executable", "generic windos", "executable", "history" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 109, "FileHash-SHA1": 106, "FileHash-SHA256": 495, "hostname": 12, "URL": 1 }, "indicator_count": 723, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "84 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ad89e41aedbfa93989a563", "name": "MIDI HUB . EVE", "description": "VT IOC, 1/69 security vendor flagged this file as malicious\n1\n/ 69\nCommunity Score\n\u2022\n1dfe376d020b3bd6cb46920f0cae4185004cc5073eb015c0d2e916f50923ca6e", "modified": "2026-03-09T04:33:04.656000", "created": "2026-03-08T14:38:28.489000", "tags": [ "community score" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1, "hostname": 2, "URL": 1 }, "indicator_count": 4, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "84 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "698548fdc5e1b22b45457eb4", "name": "http://support[.]apple[.]com/kb/HT5012 - 02.05.26", "description": "\"Learn more about trusted certificates\" -> http://support[.]apple[.]com/kb/HT5012\nTrust Store Version 2025082000\nTrust Asset Version 1012", "modified": "2026-03-08T02:01:42.135000", "created": "2026-02-06T01:50:53.485000", "tags": [ "vhash", "ssdeep", "html internet", "magic html", "unicode text", "utf8", "trid text", "magika html", "file size", "please", "javascript", "malware", "virus", "trojan", "ransomware", "static", "analysis", "indicator of compromise", "ioc", "extraction", "emulation", "online", "submit", "sample", "download", "platform", "url", "sandbox", "scanner", "reputation", "phishing", "warning icon", "share report", "domain", "apple mapkit", "java", "manager", "report", "home search", "insights", "login check", "android", "write", "login report", "overview", "tags submit", "tags url", "finishing url", "asn norway", "title available", "apple", "static analyzer", "analyzer", "type", "website title", "apple support", "date", "security", "access control", "plan search", "submission", "february", "error", "vxstream", "apt", "hybrid analysis", "api key", "vetting process", "please note", "prefetch8 ansi", "ansi", "show process", "hash seen", "programfiles", "ck id", "command decode", "mitre att", "suricata ipv4", "windir", "suspicious", "comspec", "hybrid", "model", "close", "click", "hosts", "general", "path", "form", "strings", "contact", "p2404", "attrdataver186", "p11770919978", "processorcores6", "tpmversion0", "telemetrylevel1", "oemmodeldell", "osuilocaleenus", "osskuid48", "osnamewin", "main", "sha1", "Apple", "iPadOS", "Freedom" ], "references": [ "https://www.virustotal.com/gui/url/aec932cd6ff44a6b8a13e3573f47d7e543cc0e1cc25f6d4fa2e0b0f1b8c44603/details", "https://www.virustotal.com/gui/file/3447d0e0dce83b163308c04dffeb52afb9f22d756b57d516fb1930d60303278d/details", "https://www.filescan.io/uploads/69853e76930564ff3c8e3576/reports/132722cc-526c-428b-85d8-bb863204ec6f/ioc", "https://urlquery.net/report/f7f1fb29-f7fb-4aec-be06-978b4bb296ab", "https://app.threat.zone/submission/f373032a-49fe-46f2-be28-a4636cbeb3c2/url-analysis-report", "https://hybrid-analysis.com/sample/04fcf10162401756459d90569bdda9bd3f264efc7ce75e2ca96a8fc93e159bdb", "http://hybrid-analysis.com/sample/04fcf10162401756459d90569bdda9bd3f264efc7ce75e2ca96a8fc93e159bdb/698522a0b8d0f8b6c404b7b4", "https://app.any.run/tasks/40ac99f3-0bf0-4455-996b-01e9ba0aaf79", "https://www.virustotal.com/gui/collection/fc2724a35b1672bcbcbb1af5a8e77d1e6095818a9db880a18661208aa9e9f1ed", "https://www.virustotal.com/gui/collection/fc2724a35b1672bcbcbb1af5a8e77d1e6095818a9db880a18661208aa9e9f1ed/iocs", "https://www.virustotal.com/graph/embed/g70516ab17e6a482eb6641c8d15f795a9d0fbc493ae9d4c3ca0e0617754ba679c?theme=dark", "https://viz.greynoise.io/ip/analysis/66ca01e5-ac9a-4baf-b088-901cfbe72cac" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" } ], "industries": [ "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 29, "FileHash-SHA1": 24, "FileHash-SHA256": 126, "URL": 323, "SSLCertFingerprint": 8, "domain": 14, "email": 4, "hostname": 138 }, "indicator_count": 666, "is_author": false, "is_subscribing": null, "subscriber_count": 132, "modified_text": "85 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "697931b0ee201182f970bc33", "name": "https://support[.]apple[.]com/en-ca/", "description": "Apple iPadOS Update\nhttps://support[.]apple[.]com/en-ca/126047\nCertificate Trust Settings:\nTrust Store Version: 2025082000\nTrust Asset Version: 1011", "modified": "2026-02-26T21:03:49.546000", "created": "2026-01-27T21:44:16.421000", "tags": [ "Apple" ], "references": [ "https://www.virustotal.com/gui/collection/49dc173bbaf3c632d46d614106ac72d2fba72444f14c618995b797757815d5b4", "https://www.virustotal.com/gui/collection/49dc173bbaf3c632d46d614106ac72d2fba72444f14c618995b797757815d5b4/iocs", "https://www.virustotal.com/graph/embed/g67beb17fa38042baaa378cde359bbf4ba510be6f4d5c4f40b2d39917c7f7b67c?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada", "Germany", "Netherlands", "Poland" ], "malware_families": [], "attack_ids": [], "industries": [ "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "URL": 438, "domain": 18, "hostname": 9, "FileHash-SHA256": 102 }, "indicator_count": 571, "is_author": false, "is_subscribing": null, "subscriber_count": 133, "modified_text": "94 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://www.virustotal.com/gui/collection/49dc173bbaf3c632d46d614106ac72d2fba72444f14c618995b797757815d5b4/iocs", "https://www.filescan.io/uploads/69853e76930564ff3c8e3576/reports/132722cc-526c-428b-85d8-bb863204ec6f/ioc", "https://hybrid-analysis.com/sample/04fcf10162401756459d90569bdda9bd3f264efc7ce75e2ca96a8fc93e159bdb", "https://www.virustotal.com/gui/file/3447d0e0dce83b163308c04dffeb52afb9f22d756b57d516fb1930d60303278d/details", "https://app.threat.zone/submission/f373032a-49fe-46f2-be28-a4636cbeb3c2/url-analysis-report", "https://urlquery.net/report/f7f1fb29-f7fb-4aec-be06-978b4bb296ab", "https://www.virustotal.com/graph/embed/g70516ab17e6a482eb6641c8d15f795a9d0fbc493ae9d4c3ca0e0617754ba679c?theme=dark", "https://viz.greynoise.io/ip/analysis/66ca01e5-ac9a-4baf-b088-901cfbe72cac", "https://app.any.run/tasks/40ac99f3-0bf0-4455-996b-01e9ba0aaf79", "https://www.virustotal.com/gui/collection/49dc173bbaf3c632d46d614106ac72d2fba72444f14c618995b797757815d5b4", "https://www.virustotal.com/gui/url/aec932cd6ff44a6b8a13e3573f47d7e543cc0e1cc25f6d4fa2e0b0f1b8c44603/details", "https://www.virustotal.com/graph/embed/g67beb17fa38042baaa378cde359bbf4ba510be6f4d5c4f40b2d39917c7f7b67c?theme=dark", "http://hybrid-analysis.com/sample/04fcf10162401756459d90569bdda9bd3f264efc7ce75e2ca96a8fc93e159bdb/698522a0b8d0f8b6c404b7b4", "https://www.virustotal.com/gui/collection/fc2724a35b1672bcbcbb1af5a8e77d1e6095818a9db880a18661208aa9e9f1ed/iocs", "https://www.virustotal.com/gui/collection/fc2724a35b1672bcbcbb1af5a8e77d1e6095818a9db880a18661208aa9e9f1ed" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [ "Technology" ], "unique_indicators": 3024 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/apple.com", "whois": "http://whois.domaintools.com/apple.com", "domain": "apple.com", "hostname": "support.apple.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 9, "pulses": [ { "id": "69ada9e03dfe3f81c5cd894c", "name": "VirusTotal Box of Apples Sandbox report", "description": "I cannot stress enough the degree of interpretation this requires and *if malicious* could damage. Please use dilligance in vetting.", "modified": "2026-04-07T16:31:49.011000", "created": "2026-03-08T16:54:56.051000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 6, "FileHash-SHA256": 2, "domain": 5, "hostname": 10, "FileHash-MD5": 2, "URL": 1 }, "indicator_count": 26, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "54 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ad96c73b3e5e2606e80c55", "name": "CAPE Sandbox - intel/apple intersect", "description": "Intel- this ones for you stay safe. Look at the GUI indicators.", "modified": "2026-04-07T15:29:29.427000", "created": "2026-03-08T15:33:27.411000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 264, "FileHash-SHA1": 21, "FileHash-SHA256": 21, "URL": 13, "hostname": 38, "domain": 2 }, "indicator_count": 359, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "54 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ad7b0cc162742bd7357fdd", "name": "Control & Command", "description": "ind. security researcher / USA supporter&assisting in IOCs / whistleblower preservation", "modified": "2026-04-07T13:38:32.759000", "created": "2026-03-08T13:35:08.036000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 293, "domain": 29, "FileHash-MD5": 537, "FileHash-SHA1": 95, "FileHash-SHA256": 636, "URL": 88, "email": 620, "CIDR": 1 }, "indicator_count": 2299, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "54 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ad9422422d5502b5ed1511", "name": "Boardman US. RAT", "description": "92d12cfd54e3dc208dc384fe4099c698\n9af3719b3f61095537e5e7497c65e2a3144440f7\n004adf62746e56b097d3f5885006bd185ffc002bcd960e3eea1ce652fb1893f4\n9efc148da7a2b8658acadc68062b6a1f\n49152:7M2Z3k7U1Q6dBI2G77X351G840RVvdfa67APb7mOjgKmqWEa:Q21k7ZV36EjAPnEKmqWEa\nT13AF58C13A7806C55C2C7E078278F5766D321FE349BB0B6EB62A1E1725FF1E854B26702\ne425830dfabd452ff9f90e4fda33e1aeca03f048\n7c79cbe223cd707653c3c852b7f39260\nMach-O \nexecutable\nmac\nmacho\nMach-O 64-bit x86_64 executable, flags:\nMac OS X Mach-O 64-bit Intel executable (100%)\nMach-O64 Operation system: macOS [EXECUTE64]\nMACHO\n3.22 MB (3378336 bytes)", "modified": "2026-04-07T00:35:09.118000", "created": "2026-03-08T15:22:10.713000", "tags": [ "macho", "macho 64bit", "x8664", "mac os", "x macho", "execute64" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 5, "FileHash-SHA1": 4, "FileHash-SHA256": 3, "URL": 10, "domain": 1, "hostname": 5 }, "indicator_count": 28, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "55 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ad9532e4cd4d1ef34bd416", "name": "VirusTotal Box of Apples Sandbox report", "description": "creep.", "modified": "2026-04-07T00:35:09.118000", "created": "2026-03-08T15:26:42.277000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 3, "domain": 24, "URL": 5, "hostname": 3 }, "indicator_count": 35, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "55 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ad849bc4a9645caea2fc8f", "name": "Compiler: Microsoft Visual C/C++ (16.00) Linker: Microsoft Linker", "description": "file not signed -eecedb98e78f45084c8bee1c27d0433f\nebc706d07e75ae5fb3edc35a100299753dee9c1b\nd5909a0b142656fd2543560c88e3cc50909890554d7f11c9b5014596d6867770\n038106656d157d061d1d14z1b2zff2z11jz3001f346z5\ne34edbfb9adaa0a6270942765754b79cafb0ce9b375ee3fd3a19c1381583dc39\nfc1b4cc5a756f054a943d6d1ec76a37c\n1572864:SqufgchDAiQy34zGOar6U0OZ4rn7cBSqYhaqH9Im9cFS0rwVLdnZlKUz5cFW33Eh:SqJ3srw/KUmZ2AGK\nT13EE85A03E29651D8D06DD0B997579232FAB1BC084B256A", "modified": "2026-03-09T04:33:06.452000", "created": "2026-03-08T14:15:55.253000", "tags": [ "win32 exe", "pe32 executable", "ms windows", "intel", "win16 ne", "os2 executable", "generic windos", "executable", "history" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 109, "FileHash-SHA1": 106, "FileHash-SHA256": 495, "hostname": 12, "URL": 1 }, "indicator_count": 723, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "84 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ad89e41aedbfa93989a563", "name": "MIDI HUB . EVE", "description": "VT IOC, 1/69 security vendor flagged this file as malicious\n1\n/ 69\nCommunity Score\n\u2022\n1dfe376d020b3bd6cb46920f0cae4185004cc5073eb015c0d2e916f50923ca6e", "modified": "2026-03-09T04:33:04.656000", "created": "2026-03-08T14:38:28.489000", "tags": [ "community score" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1, "hostname": 2, "URL": 1 }, "indicator_count": 4, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "84 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "698548fdc5e1b22b45457eb4", "name": "http://support[.]apple[.]com/kb/HT5012 - 02.05.26", "description": "\"Learn more about trusted certificates\" -> http://support[.]apple[.]com/kb/HT5012\nTrust Store Version 2025082000\nTrust Asset Version 1012", "modified": "2026-03-08T02:01:42.135000", "created": "2026-02-06T01:50:53.485000", "tags": [ "vhash", "ssdeep", "html internet", "magic html", "unicode text", "utf8", "trid text", "magika html", "file size", "please", "javascript", "malware", "virus", "trojan", "ransomware", "static", "analysis", "indicator of compromise", "ioc", "extraction", "emulation", "online", "submit", "sample", "download", "platform", "url", "sandbox", "scanner", "reputation", "phishing", "warning icon", "share report", "domain", "apple mapkit", "java", "manager", "report", "home search", "insights", "login check", "android", "write", "login report", "overview", "tags submit", "tags url", "finishing url", "asn norway", "title available", "apple", "static analyzer", "analyzer", "type", "website title", "apple support", "date", "security", "access control", "plan search", "submission", "february", "error", "vxstream", "apt", "hybrid analysis", "api key", "vetting process", "please note", "prefetch8 ansi", "ansi", "show process", "hash seen", "programfiles", "ck id", "command decode", "mitre att", "suricata ipv4", "windir", "suspicious", "comspec", "hybrid", "model", "close", "click", "hosts", "general", "path", "form", "strings", "contact", "p2404", "attrdataver186", "p11770919978", "processorcores6", "tpmversion0", "telemetrylevel1", "oemmodeldell", "osuilocaleenus", "osskuid48", "osnamewin", "main", "sha1", "Apple", "iPadOS", "Freedom" ], "references": [ "https://www.virustotal.com/gui/url/aec932cd6ff44a6b8a13e3573f47d7e543cc0e1cc25f6d4fa2e0b0f1b8c44603/details", "https://www.virustotal.com/gui/file/3447d0e0dce83b163308c04dffeb52afb9f22d756b57d516fb1930d60303278d/details", "https://www.filescan.io/uploads/69853e76930564ff3c8e3576/reports/132722cc-526c-428b-85d8-bb863204ec6f/ioc", "https://urlquery.net/report/f7f1fb29-f7fb-4aec-be06-978b4bb296ab", "https://app.threat.zone/submission/f373032a-49fe-46f2-be28-a4636cbeb3c2/url-analysis-report", "https://hybrid-analysis.com/sample/04fcf10162401756459d90569bdda9bd3f264efc7ce75e2ca96a8fc93e159bdb", "http://hybrid-analysis.com/sample/04fcf10162401756459d90569bdda9bd3f264efc7ce75e2ca96a8fc93e159bdb/698522a0b8d0f8b6c404b7b4", "https://app.any.run/tasks/40ac99f3-0bf0-4455-996b-01e9ba0aaf79", "https://www.virustotal.com/gui/collection/fc2724a35b1672bcbcbb1af5a8e77d1e6095818a9db880a18661208aa9e9f1ed", "https://www.virustotal.com/gui/collection/fc2724a35b1672bcbcbb1af5a8e77d1e6095818a9db880a18661208aa9e9f1ed/iocs", "https://www.virustotal.com/graph/embed/g70516ab17e6a482eb6641c8d15f795a9d0fbc493ae9d4c3ca0e0617754ba679c?theme=dark", "https://viz.greynoise.io/ip/analysis/66ca01e5-ac9a-4baf-b088-901cfbe72cac" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" } ], "industries": [ "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 29, "FileHash-SHA1": 24, "FileHash-SHA256": 126, "URL": 323, "SSLCertFingerprint": 8, "domain": 14, "email": 4, "hostname": 138 }, "indicator_count": 666, "is_author": false, "is_subscribing": null, "subscriber_count": 132, "modified_text": "85 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "697931b0ee201182f970bc33", "name": "https://support[.]apple[.]com/en-ca/", "description": "Apple iPadOS Update\nhttps://support[.]apple[.]com/en-ca/126047\nCertificate Trust Settings:\nTrust Store Version: 2025082000\nTrust Asset Version: 1011", "modified": "2026-02-26T21:03:49.546000", "created": "2026-01-27T21:44:16.421000", "tags": [ "Apple" ], "references": [ "https://www.virustotal.com/gui/collection/49dc173bbaf3c632d46d614106ac72d2fba72444f14c618995b797757815d5b4", "https://www.virustotal.com/gui/collection/49dc173bbaf3c632d46d614106ac72d2fba72444f14c618995b797757815d5b4/iocs", "https://www.virustotal.com/graph/embed/g67beb17fa38042baaa378cde359bbf4ba510be6f4d5c4f40b2d39917c7f7b67c?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada", "Germany", "Netherlands", "Poland" ], "malware_families": [], "attack_ids": [], "industries": [ "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "URL": 438, "domain": 18, "hostname": 9, "FileHash-SHA256": 102 }, "indicator_count": 571, "is_author": false, "is_subscribing": null, "subscriber_count": 133, "modified_text": "94 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://support.apple.com/en-us/103272", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://support.apple.com/en-us/103272", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780299641.1738253 }