24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4fb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 3f3ac0a31d28… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3f3ac0a31d28…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 13/27 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3f3ac0a31d28e9bbc85df54dd4300c9b15bf255b192fab15d94505ea1e528b02","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","3f3ac0a31d28e9bbc85df54dd4300c9b15bf255b192fab15d94505ea1e528b02"],"about":{"@type":"SoftwareApplication","name":"3f3ac0a31d28e9bbc85df54dd4300c9b15bf255b192fab15d94505ea1e528b02.bin","applicationCategory":["peexe","executable"],"identifier":"3f3ac0a31d28e9bbc85df54dd4300c9b15bf255b192fab15d94505ea1e528b02","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T414," HTTP/1.1 200 OK Date: Wed 08 Jul 2026 16:51:00 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Ray: a18097557d0555c2-SJC CF-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: public max-age=0 must-revalidate ETag: "7559f1b113a09be7943d4bf260a47b92fdc96493" Server: cloudflare Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Accept-Encoding Alt-Svc: h3=":443"; ma=86400 Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Protocol: HTTP/2.0 x-cache-note: The cf-cache-status header doesnt actually reflect the real cache status we always return the geo information of your current connecting ip (see the x-ip header) x-ip: 64.124.12.162 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=qcUAd%2FZ2r3bXWnVl%2FTgZSoKxYcr5VA%2BZqbqUh%2BZ561BaAD9RmdFIr2DQQ%2BGallcepTzlavrWYTAIvFYrgqdOp4orVndgfUW7uq%2Fk7V1i01w%2BZY%2Fboxxs4ux7xw%3D%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} with response body ==>7B226F7267616E697A6174696F6E223A225A61796F222C22636F756E747279223A22556E6974656420537461746573222C22697370223A225A61796F222C2263.......2f:T1478," "" HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed 08 Jul 2026 16:50:58 GMT with response body ==>3C733A456E76656C6F706520786D6C6E733A733D22687474703A2F2F736368656D61732E786D6C736F61702E6F72672F736F61702F656E76656C6F70652F223E....... "POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 192.144.32.84:16383 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate" with payload::==> "" HTTP/1.1 200 OK Content-Length: 26500 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed 08 Jul 2026 16:50:58 GMT with response body ==>3C733A456E76656C6F706520786D6C6E733A733D22687474703A2F2F736368656D61732E786D6C736F61702E6F72672F736F61702F656E76656C6F70652F223E.......38:T574,"GetModuleFileNameA@KERNEL32.DLL" in "|.bh\"\n Heuristic match: \"n9.dz\"\n Heuristic match: \"3o.se\"\n Heuristic match: \"myq.ac\"\n Heuristic match: \"fo*.et\"\n Pattern match: \"http://tempuri.org/endpoint/checkconnecthost\"\n Pattern match: \"http://tempuri.org/endpoint/environmentsettingshost\"\n Heuristic match: \"api.ip.sb\"\n Pattern match: \"www.sysinternals.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a4e7fd52ea8c57992080c9a"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /geoip HTTP/1.1\nHost: api.ip.sb\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a4e7fd52ea8c57992080c9a"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a4e7fd52ea8c57992080c9a"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a4e7fd52ea8c57992080c9a"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://api.ip.sb/geoip","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a4e7fd52ea8c57992080c9a"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"api.ip.sb\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a4e7fd52ea8c57992080c9a"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.26.13.31\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a4e7fd52ea8c57992080c9a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a4e7fd52ea8c57992080c9a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"