{ "type": "URL", "indicator": "https://www.dcaa.mil/Content/Documents/small_business/Accounting_System.pdf", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://www.dcaa.mil/Content/Documents/small_business/Accounting_System.pdf", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3014519547, "indicator": "https://www.dcaa.mil/Content/Documents/small_business/Accounting_System.pdf", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "66ca35f7202c88b2bf667c66", "name": "Ploprolo | Unix.Trojan.DarkNexus-7679166-0 | U.S. Department of Defense", "description": "Why not question suspect instead of threaten smear name in all types distasteful content. US DoD auto populated as did all tags. Link found in Adult website documented in court records. Investigate victim? Bryan Counts of upper management in Concentra telling victim Jeffrey Scott Reimer was a professional assaulter, believes there are other victims and he could be a killer. Counts back pedals they kept Reimer employed but from treating females, stating everything checked out. They are very sorry. Asked victim for hacked w'away recordings and told her 'Thank you for not pursuing our therapist.' 'You are no longer able to receive care here. I'm a public figure and I can't have this. My best friend is going to be the Sheriff. Hey yourselves a bunch of lawyers and hide. Surround yourself with people you can trust.' Mark Montano MD.\n@Kailula4 has an emptied graph of same custom Trojan. I have trouble believing it's the actual US Government. If it is, it's very sad.", "modified": "2024-09-23T18:04:30.948000", "created": "2024-08-24T19:35:19.416000", "tags": [ "asn as16625", "akamai", "link", "a domains", "as20940", "aaaa", "meta", "script", "input", "passive dns", "general", "united states", "as2914 ntt", "as721 dod", "as3257 gtt", "domain", "as2828 verizon", "as16625 akamai", "united", "as15169 google", "as44273 host", "search otx", "read c", "create c", "high", "memcommit", "delete", "write c", "module load", "dock", "write", "execution", "sample hash", "Injection", "inject", "analyzer threat", "ip summary", "detection list", "cisco umbrella", "alexa top", "million", "safe site", "cl0p ransomware", "maltiverse safe", "zbot", "malware", "ip address", "secretary", "defense", "defense lloyd", "strong", "support", "value", "joint chiefs", "minister", "ukraine", "service", "live", "honor", "department", "america", "defense og", "defense meta", "joint chief", "military", "government", "trackers", "external_resources", "third_party_cookies", "iframes", "today", "document file", "v2 document", "canada unknown", "canada", "invalid url", "scan endpoints", "all scoreblue", "ipv4", "url analysis", "creation date", "entries", "hostname", "date", "hostnames", "urls http", "mail spammer", "autorunmacro.d", "penalties", "army", "afghanistan", "journal julyaug", "stovl promises", "uas road", "cheers", "way ahead", "mor pdf", "armed forces", "copy", "format", "core", "createdate", "producer gimp", "navy", "title navy", "filehash", "av detections", "ids detections", "nxscspu", "zsextbzusbrvsk", "pxnzj", "jwxkrhdlrivprs", "qxrfnjuodik", "mncau", "csqvrkwsqka", "testpath path", "else", "xszcgdvlhymmww", "exploit", "win64", "null", "suspicious", "hotkey", "yara detections", "alerts", "analysis date", "file score", "brian sabey" ], "references": [ "http://analytics.com/track?id=54 | http://analytics.com/track?id=55", "IP\u2019s Contacted 104.123.122.11 204.79.197.200 | Domains Contacted www.defense.gov www.bing.com", "'http'://www.defense.gov/?date=2019-11-21 | http'://www.defense.gov ?", "Executed Commands: iexplore.exe \"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" http://www.defense.gov/?date=2019-11-21", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/0d34445978515452930712687a2b969955852dbbeb91011b3382e0efc1e4b13a", "AutorunMacro.D", "Yara Detections is__elf , LZMA , ELFHighEntropy , elf_empty_sections", "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", "@Kailula4 Pulse wiped? https://otx.alienvault.com/pulse/61b8f5afd7c432928006610d", "Prolexic (Parent organization?): Akamai Technologies: prolexicprotected.com | akaetp.net | akamai-trials.com | prolexic.net", "Unknown frontdoor.com A | test.unsubscribe.tapp.dpgmedia.cloud", "Tell your dog I said 'hi'" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [ { "id": "Unix.Trojan.DarkNexus-7679166-0", "display_name": "Unix.Trojan.DarkNexus-7679166-0", "target": null }, { "id": "Malware-gen\\ [Trj]", "display_name": "Malware-gen\\ [Trj]", "target": null }, { "id": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "display_name": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4572, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 448, "FileHash-MD5": 935, "URL": 267, "domain": 176, "FileHash-SHA256": 1504, "FileHash-SHA1": 616, "email": 3, "CVE": 1 }, "indicator_count": 3950, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "616 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a0d760557004620f409f", "name": "Kelowna Mental Health", "description": "", "modified": "2023-12-06T16:27:03.467000", "created": "2023-12-06T16:27:03.467000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 715, "CVE": 20, "FileHash-MD5": 8943, "FileHash-SHA256": 37374, "FileHash-SHA1": 8939, "JA3": 11, "domain": 497, "URL": 408, "email": 38, "FilePath": 1 }, "indicator_count": 56946, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64e9896df7ea5c41750e6aac", "name": "Kelowna Mental Health", "description": "", "modified": "2023-10-14T00:01:59.166000", "created": "2023-08-26T05:11:09.863000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ellenmmm", "id": "233693", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 785, "domain": 550, "email": 38, "URL": 511, "CVE": 21, "FileHash-MD5": 15725, "FileHash-SHA1": 15719, "FileHash-SHA256": 67914, "JA3": 11, "FilePath": 1 }, "indicator_count": 101275, "is_author": false, "is_subscribing": null, "subscriber_count": 88, "modified_text": "961 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "Tell your dog I said 'hi'", "Prolexic (Parent organization?): Akamai Technologies: prolexicprotected.com | akaetp.net | akamai-trials.com | prolexic.net", "Unknown frontdoor.com A | test.unsubscribe.tapp.dpgmedia.cloud", "@Kailula4 Pulse wiped? https://otx.alienvault.com/pulse/61b8f5afd7c432928006610d", "IP\u2019s Contacted 104.123.122.11 204.79.197.200 | Domains Contacted www.defense.gov www.bing.com", "Yara Detections is__elf , LZMA , ELFHighEntropy , elf_empty_sections", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/0d34445978515452930712687a2b969955852dbbeb91011b3382e0efc1e4b13a", "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", "http://analytics.com/track?id=54 | http://analytics.com/track?id=55", "Executed Commands: iexplore.exe \"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" http://www.defense.gov/?date=2019-11-21", "AutorunMacro.D", "'http'://www.defense.gov/?date=2019-11-21 | http'://www.defense.gov ?" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Unix.trojan.darknexus-7679166-0", "Malware-gen\\ [trj]", "Alf:trojandownloader:powershell/ploprolo.db" ], "industries": [], "unique_indicators": 61410 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/dcaa.mil", "whois": "http://whois.domaintools.com/dcaa.mil", "domain": "dcaa.mil", "hostname": "www.dcaa.mil" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "66ca35f7202c88b2bf667c66", "name": "Ploprolo | Unix.Trojan.DarkNexus-7679166-0 | U.S. Department of Defense", "description": "Why not question suspect instead of threaten smear name in all types distasteful content. US DoD auto populated as did all tags. Link found in Adult website documented in court records. Investigate victim? Bryan Counts of upper management in Concentra telling victim Jeffrey Scott Reimer was a professional assaulter, believes there are other victims and he could be a killer. Counts back pedals they kept Reimer employed but from treating females, stating everything checked out. They are very sorry. Asked victim for hacked w'away recordings and told her 'Thank you for not pursuing our therapist.' 'You are no longer able to receive care here. I'm a public figure and I can't have this. My best friend is going to be the Sheriff. Hey yourselves a bunch of lawyers and hide. Surround yourself with people you can trust.' Mark Montano MD.\n@Kailula4 has an emptied graph of same custom Trojan. I have trouble believing it's the actual US Government. If it is, it's very sad.", "modified": "2024-09-23T18:04:30.948000", "created": "2024-08-24T19:35:19.416000", "tags": [ "asn as16625", "akamai", "link", "a domains", "as20940", "aaaa", "meta", "script", "input", "passive dns", "general", "united states", "as2914 ntt", "as721 dod", "as3257 gtt", "domain", "as2828 verizon", "as16625 akamai", "united", "as15169 google", "as44273 host", "search otx", "read c", "create c", "high", "memcommit", "delete", "write c", "module load", "dock", "write", "execution", "sample hash", "Injection", "inject", "analyzer threat", "ip summary", "detection list", "cisco umbrella", "alexa top", "million", "safe site", "cl0p ransomware", "maltiverse safe", "zbot", "malware", "ip address", "secretary", "defense", "defense lloyd", "strong", "support", "value", "joint chiefs", "minister", "ukraine", "service", "live", "honor", "department", "america", "defense og", "defense meta", "joint chief", "military", "government", "trackers", "external_resources", "third_party_cookies", "iframes", "today", "document file", "v2 document", "canada unknown", "canada", "invalid url", "scan endpoints", "all scoreblue", "ipv4", "url analysis", "creation date", "entries", "hostname", "date", "hostnames", "urls http", "mail spammer", "autorunmacro.d", "penalties", "army", "afghanistan", "journal julyaug", "stovl promises", "uas road", "cheers", "way ahead", "mor pdf", "armed forces", "copy", "format", "core", "createdate", "producer gimp", "navy", "title navy", "filehash", "av detections", "ids detections", "nxscspu", "zsextbzusbrvsk", "pxnzj", "jwxkrhdlrivprs", "qxrfnjuodik", "mncau", "csqvrkwsqka", "testpath path", "else", "xszcgdvlhymmww", "exploit", "win64", "null", "suspicious", "hotkey", "yara detections", "alerts", "analysis date", "file score", "brian sabey" ], "references": [ "http://analytics.com/track?id=54 | http://analytics.com/track?id=55", "IP\u2019s Contacted 104.123.122.11 204.79.197.200 | Domains Contacted www.defense.gov www.bing.com", "'http'://www.defense.gov/?date=2019-11-21 | http'://www.defense.gov ?", "Executed Commands: iexplore.exe \"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" http://www.defense.gov/?date=2019-11-21", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/0d34445978515452930712687a2b969955852dbbeb91011b3382e0efc1e4b13a", "AutorunMacro.D", "Yara Detections is__elf , LZMA , ELFHighEntropy , elf_empty_sections", "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", "@Kailula4 Pulse wiped? https://otx.alienvault.com/pulse/61b8f5afd7c432928006610d", "Prolexic (Parent organization?): Akamai Technologies: prolexicprotected.com | akaetp.net | akamai-trials.com | prolexic.net", "Unknown frontdoor.com A | test.unsubscribe.tapp.dpgmedia.cloud", "Tell your dog I said 'hi'" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [ { "id": "Unix.Trojan.DarkNexus-7679166-0", "display_name": "Unix.Trojan.DarkNexus-7679166-0", "target": null }, { "id": "Malware-gen\\ [Trj]", "display_name": "Malware-gen\\ [Trj]", "target": null }, { "id": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "display_name": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4572, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 448, "FileHash-MD5": 935, "URL": 267, "domain": 176, "FileHash-SHA256": 1504, "FileHash-SHA1": 616, "email": 3, "CVE": 1 }, "indicator_count": 3950, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "616 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a0d760557004620f409f", "name": "Kelowna Mental Health", "description": "", "modified": "2023-12-06T16:27:03.467000", "created": "2023-12-06T16:27:03.467000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 715, "CVE": 20, "FileHash-MD5": 8943, "FileHash-SHA256": 37374, "FileHash-SHA1": 8939, "JA3": 11, "domain": 497, "URL": 408, "email": 38, "FilePath": 1 }, "indicator_count": 56946, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64e9896df7ea5c41750e6aac", "name": "Kelowna Mental Health", "description": "", "modified": "2023-10-14T00:01:59.166000", "created": "2023-08-26T05:11:09.863000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ellenmmm", "id": "233693", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 785, "domain": 550, "email": 38, "URL": 511, "CVE": 21, "FileHash-MD5": 15725, "FileHash-SHA1": 15719, "FileHash-SHA256": 67914, "JA3": 11, "FilePath": 1 }, "indicator_count": 101275, "is_author": false, "is_subscribing": null, "subscriber_count": 88, "modified_text": "961 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://www.dcaa.mil/Content/Documents/small_business/Accounting_System.pdf", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://www.dcaa.mil/Content/Documents/small_business/Accounting_System.pdf", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780358154.7743003 }