24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample 30cd1dbd2a00… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 30cd1dbd2a00…. Malware family: Mint.Zard.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/30cd1dbd2a000503fd734ef2f4656ea46cd1ec0867ac8ec4b75378e88319c3b0","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","30cd1dbd2a000503fd734ef2f4656ea46cd1ec0867ac8ec4b75378e88319c3b0"],"about":{"@type":"SoftwareApplication","name":"8_1_.exe","applicationCategory":["peexe","executable"],"identifier":"30cd1dbd2a000503fd734ef2f4656ea46cd1ec0867ac8ec4b75378e88319c3b0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T868," HTTP/1.1 200 OK Date: Wed 22 Apr 2026 03:37:35 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=85v6A2MiyJHf39nJZLy5Ujl7En3tGrEQyBfVHoWfT2g-1776829055.1072576-1.0.1.1-C0vfkhwQNBGc44HjD9BCwSr3xsgkm6s_Stov1v9BV9YMr7gm479Uq68jmguFO_4Vm7jcMt87D4XdhPknZvZqQGPM9QnoVXDz8wD.9ZBDn6B5JqK2SSujSKnFs0QRTLqt; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Wed 22 Apr 2026 04:07:35 GMT Server: cloudflare CF-RAY: 9f01973a6cc1a666-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /5/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 22 Apr 2026 03:37:35 GMT Content-Type: text/plain Content-Length: 7 Last-Modified: Mon 20 Apr 2026 08:26:43 GMT Connection: keep-alive ETag: "69e5e343-7" Accept-Ranges: bytes with response body ==>3132303936380A....... "GET /5/7632.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 22 Apr 2026 03:37:36 GMT Content-Type: text/plain Content-Length: 258970 Last-Modified: Mon 20 Apr 2026 07:57:01 GMT Connection: keep-alive ETag: "69e5dc4d-3f39a" Accept-Ranges: bytes with response body ==>76696572646261626340667265652E66723A776F6F64636F636B0A78617669657264696D654069636C6F75642E636F6D3A4B6F626533333135210A7861766965....... "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Wed 22 Apr 2026 03:40:06 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940127-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 67028 X-Timer: S1776829207.605541 VS0 VE69 X-Cache: MISS X-Vcl-Time-Ms: 69 Cache-Control: no-cache no-store Accept-Ranges: bytes with response body ==>BINARY_CONTENT....... "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Wed 22 Apr 2026 03:40:07 GMT Set-Cookie: lidc="b=VGST08:s=V:r=V:a=V:p=V:g=3418:u=1:x=1:i=1776829207:t=1776915607:v=2:sig=AQGD6QX38IPgHgl2wtCitMz0pQEIamf8"; Expires=Thu 23 Apr 2026 03:40:07 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure X-Li-Uuid: AAZQBEm/FE3+Ppt8XgyO+w== X-Li-Fabric: prod-lva1 X-Msedge-Ref: Ref A: 82224AF301E542E79C845AEB73AC71F4 Ref B: BY1AA1072316031 Ref C: 2026-04-22T03:40:07Z Vary: Accept-Encoding X-Li-Proto: http/2 Content-Encoding: gzip X-Li-Pop: afd-prod-lva1-x X-Cache: CONFIG_NOCACHE Alt-Svc: h3=":443"; ma=86400 Linkedin-Action: 1 with response body ==>BINARY_CONTENT.......2b:T725,"" (Indicator: "GetDC"; Source: "00000000-00002200.00000000.203821.025F0000.00000004.mdmp, 00000000-00002200.00000001.205740.025F0000.00000004.mdmp, 00000000-00002200.00000002.207661.025F0000.00000004.mdmp, 00000000-00002200.00000003.213169.025F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002200.00000000.203821.025F0000.00000004.mdmp, 00000000-00002200.00000001.205740.025F0000.00000004.mdmp, 00000000-00002200.00000002.207661.025F0000.00000004.mdmp, 00000000-00002200.00000003.213169.025F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002200.00000000.203821.025F0000.00000004.mdmp, 00000000-00002200.00000001.205740.025F0000.00000004.mdmp, 00000000-00002200.00000002.207661.025F0000.00000004.mdmp, 00000000-00002200.00000003.213169.025F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002200.00000000.203821.025F0000.00000004.mdmp, 00000000-00002200.00000001.205740.025F0000.00000004.mdmp, 00000000-00002200.00000002.207661.025F0000.00000004.mdmp, 00000000-00002200.00000003.213169.025F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002200.00000000.203821.025F0000.00000004.mdmp, 00000000-00002200.00000001.205740.025F0000.00000004.mdmp, 00000000-00002200.00000002.207661.025F0000.00000004.mdmp, 00000000-00002200.00000003.213169.025F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002200.00000000.203821.025F0000.00000004.mdmp, 00000000-00002200.00000001.205740.025F0000.00000004.mdmp, 00000000-00002200.00000002.207661.025F0000.00000004.mdmp, 00000000-00002200.00000003.213169.025F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002200.00000000.203821.025F0000.00000004.mdmp, 00000000-00002200.00000001.205740.025F0000.00000004.mdmp, 00000000-00002200.00000002.207661.025F0000.00000004.mdmp, 00000000-00002200.00000003.213169.025F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002200.00000000.203821.025F0000.00000004.mdmp, 00000000-00002200.00000001.205740.025F0000.00000004.mdmp, 00000000-00002200.00000002.207661.025F0000.00000004.mdmp, 00000000-00002200.00000003.213169.025F0000.00000004.mdmp")3b:Ta00,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002200.00000000.203821.025F0000.00000004.mdmp, 00000000-00002200.00000001.205740.025F0000.00000004.mdmp, 00000000-00002200.00000002.207661.025F0000.00000004.mdmp, 00000000-00002200.00000003.213169.025F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69e842601787bdd7550244be"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69e842601787bdd7550244be"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002200.00000000.203821.025F0000.00000004.mdmp, 00000000-00002200.00000001.205740.025F0000.00000004.mdmp, 00000000-00002200.00000002.207661.025F0000.00000004.mdmp, 00000000-00002200.00000003.213169.025F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e842601787bdd7550244be"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69e842601787bdd7550244be"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"