{
  "type": "Domain",
  "indicator": "zh.map",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/zh.map",
    "alexa": "http://www.alexa.com/siteinfo/zh.map",
    "indicator": "zh.map",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4018344482,
      "indicator": "zh.map",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 1,
      "pulses": [
        {
          "id": "67709b347e368914cb5d1fa2",
          "name": "ld869rwRuHeO9Tw.exe   1d773d866966940f042d442b9e0cec638e733a83f7137cbdd4e70d4cb9803ada",
          "description": "https://www.hybrid-analysis.com/sample/1d773d866966940f042d442b9e0cec638e733a83f7137cbdd4e70d4cb9803ada/677086f7a2798798250fafcd\nLastcode analysis wedi cyhoeddi i'wadu cyffredinol, \u00c2\u00a31.5m, \u00e2\u201a\u00ac2.4m.",
          "modified": "2025-05-14T21:11:16.436000",
          "created": "2024-12-29T00:43:32.094000",
          "tags": [
            "sha256 file",
            "type type",
            "language chi2",
            "image english",
            "us 1",
            "1 upx1",
            "monitoruj",
            "rozszerzenia",
            "kali linux",
            "live boot",
            "apple m1",
            "kolekcja dvd",
            "sound pool",
            "hashdb narodowa",
            "oprogramowania",
            "nsrl",
            "programfiles",
            "kopiuj md5",
            "kopiuj sha1",
            "skopiuj sha256",
            "sha1",
            "sha256",
            "runtime process",
            "description zip",
            "type",
            "size",
            "error",
            "null",
            "install",
            "bitcoin",
            "python",
            "calendar",
            "xorist",
            "path",
            "refresh",
            "body",
            "span",
            "green",
            "win32",
            "designer",
            "filler",
            "tools",
            "black",
            "wallpaper",
            "zapis",
            "pulpit",
            "autoit",
            "bill",
            "light",
            "stars",
            "look",
            "verify",
            "restart",
            "desktop"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1486",
              "name": "Data Encrypted for Impact",
              "display_name": "T1486 - Data Encrypted for Impact"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 491,
            "FileHash-MD5": 452,
            "FileHash-SHA1": 458,
            "BitcoinAddress": 1,
            "URL": 39,
            "domain": 66,
            "hostname": 18
          },
          "indicator_count": 1525,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 124,
          "modified_text": "382 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 1,
  "pulses": [
    {
      "id": "67709b347e368914cb5d1fa2",
      "name": "ld869rwRuHeO9Tw.exe   1d773d866966940f042d442b9e0cec638e733a83f7137cbdd4e70d4cb9803ada",
      "description": "https://www.hybrid-analysis.com/sample/1d773d866966940f042d442b9e0cec638e733a83f7137cbdd4e70d4cb9803ada/677086f7a2798798250fafcd\nLastcode analysis wedi cyhoeddi i'wadu cyffredinol, \u00c2\u00a31.5m, \u00e2\u201a\u00ac2.4m.",
      "modified": "2025-05-14T21:11:16.436000",
      "created": "2024-12-29T00:43:32.094000",
      "tags": [
        "sha256 file",
        "type type",
        "language chi2",
        "image english",
        "us 1",
        "1 upx1",
        "monitoruj",
        "rozszerzenia",
        "kali linux",
        "live boot",
        "apple m1",
        "kolekcja dvd",
        "sound pool",
        "hashdb narodowa",
        "oprogramowania",
        "nsrl",
        "programfiles",
        "kopiuj md5",
        "kopiuj sha1",
        "skopiuj sha256",
        "sha1",
        "sha256",
        "runtime process",
        "description zip",
        "type",
        "size",
        "error",
        "null",
        "install",
        "bitcoin",
        "python",
        "calendar",
        "xorist",
        "path",
        "refresh",
        "body",
        "span",
        "green",
        "win32",
        "designer",
        "filler",
        "tools",
        "black",
        "wallpaper",
        "zapis",
        "pulpit",
        "autoit",
        "bill",
        "light",
        "stars",
        "look",
        "verify",
        "restart",
        "desktop"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1486",
          "name": "Data Encrypted for Impact",
          "display_name": "T1486 - Data Encrypted for Impact"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 491,
        "FileHash-MD5": 452,
        "FileHash-SHA1": 458,
        "BitcoinAddress": 1,
        "URL": 39,
        "domain": 66,
        "hostname": 18
      },
      "indicator_count": 1525,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 124,
      "modified_text": "382 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "zh.map",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "zh.map",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780326636.999598
}