24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample 5fb0a8edd0ec… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5fb0a8edd0ec…. Malware family: Mint.Zard.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5fb0a8edd0ece76b52b8bb32dd9777255585237c511a54d2bc3875796db5c361","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","5fb0a8edd0ece76b52b8bb32dd9777255585237c511a54d2bc3875796db5c361"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"5fb0a8edd0ece76b52b8bb32dd9777255585237c511a54d2bc3875796db5c361","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8cf," HTTP/1.1 200 OK Date: Thu 23 Apr 2026 08:04:59 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=4TVSKdv5DPbGfYOSOnsEYQBhk1asxyOAgPAIr8IEDBQ-1776931499.3943305-1.0.1.1-a3ht_evhr0X9pMdtITUxPGFLDAzPAB0cqiH8FIW6Zp2jz93taJ3Muy.Uk3m1plraZtjKZGRCMfYcqglrtOJjF33BF5swuFBaP5Rx44j2jXGMGyB2386rrRSC.likD1Fb; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Thu 23 Apr 2026 08:34:59 GMT Server: cloudflare CF-RAY: 9f0b5c4f3ba9ce78-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /1/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 23 Apr 2026 08:05:00 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sun 19 Apr 2026 09:24:07 GMT Connection: keep-alive ETag: "69e49f37-6" Accept-Ranges: bytes with response body ==>36303739310A....... "GET /1/23457.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 23 Apr 2026 08:05:00 GMT Content-Type: text/plain Content-Length: 258232 Last-Modified: Sun 19 Apr 2026 05:16:13 GMT Connection: keep-alive ETag: "69e4651d-3f0b8" Accept-Ranges: bytes with response body ==>210A69626F2E6179617272406C696265726F2E69743A6B6F6F6C73617661730A786D656E3230303040766964656F74726F6E2E63613A43616E6164610A616176.......2b:T725,"126mx00.mxmail.netease.com" Heuristic match: "ud.co" Heuristic match: "dmx4.catchservers.net" Heuristic match: "hmta5.am0.yahoodns.net" Heuristic match: "omta7.am0.yahoodns.net" Heuristic match: "rmx-rogers.mail.am0.yahoodns.net" Heuristic match: "dmx-att.mail.am0.yahoodns.net" Heuristic match: "`jmta6.am0.yahoodns.net" Heuristic match: "smtp-in.orange.fr" Heuristic match: "-yeahmx00.mxmail.netease.com" Heuristic match: "pmx-aol.mail.gm0.yahoodns.net"35:T6e5,Found URL "http://130.12.180.190/1/23457.txt130.12.180.190/1/23457.txt163mx03.mxmail.netease.commx.wp.plmx1h1.comcast.netmx1a1.comcast.netmx2c1.comcast.netmx2a1.comcast.netmx1.mxge.comcast.netmx2.mxge.comcast.netmx1c1.comcast.netcomcast.netmx2h1.comcast.net163mx03.mxmail.netease.com:\users\hapubws\appdata\local\pmapperpmapperbout:blankpmapperpmapperbout:blankummy://url1/n.txtmtp-in.libero.itx1c1.comcast.net63mx03.mxmail.netease.comx2h1.comcast.net63mx03.mxmail.netease.comx2c1.comcast.net63mx03.mxmail.netease.comx2a1.comcast.netx2h1.comcast.netx1h1.comcast.net63mx03.mxmail.netease.commx-ha02.web.deogonserver=\\desktop-fvvf82dhapub\modules\;c:\public=c:nsolee=c:\users\hapubws\a(data=c:\tempappdata\local\temp:\users\hapubws\appdata\local\microsoft\windows\iecompatuacache\windir=c:\windowsllusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00004496.00000000.125132.03440000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004496.00000000.125132.03440000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004496.00000001.127055.03440000.00000004.mdmp") Found URL "http://icanhazip.com/[%s][0.0.0.0][0.0.0.0]%s.comesmtpehlo" - Source: "00000000-00004496.00000002.128972.00F14000.00000002.mdmp") Found URL "http://binance.com" - Source: "00000000-00004496.00000002.128972.00F14000.00000002.mdmp") Found URL "http://bitrefill.com" - Source: "00000000-00004496.00000002.128972.00F14000.00000002.mdmp") Found URL "http://crypto.com" - Source: "00000000-00004496.00000002.128972.00F14000.00000002.mdmp") Found URL "http://kucoin.com" - Source: "00000000-00004496.00000002.128972.00F14000.00000002.mdmp")36:T5b9,Contacted domain: "1-grid-mx02.com" has high entropy Contacted domain: "126mx00.mxmail.netease.com" has high entropy Contacted domain: "163mx03.mxmail.netease.com" has high entropy Contacted domain: "ALT2.ASPMX.L.GOOGLE.COM" has high entropy Contacted domain: "alt1.aspmx.l.google.com" has high entropy Contacted domain: "alt3.aspmx.l.google.com" has high entropy Contacted domain: "alumni.uwosh.edu" has high entropy Contacted domain: "aperantis.com" has high entropy Contacted domain: "b1991.mx.srv.dfn.de" has high entropy Contacted domain: "bigpond.net.au" has high entropy Contacted domain: "esa02.rowan.edu" has high entropy Contacted domain: "extmail.bigpond.com" has high entropy Contacted domain: "extmail.bpbb.bigpond.com" has high entropy Contacted domain: "fuerte.juxal.org" has high entropy Contacted domain: "grupofissa.com" has high entropy Contacted domain: "guilhermescardini.com" has high entropy Contacted domain: "gw.samjinelex.com" has high entropy Contacted domain: "i.softbank.jp" has high entropy Contacted domain: "imsmx1.netvigator.com" has high entropy Contacted domain: "kaede12.kiesag.xyz" has high entropy Contacted domain: "kmx.poczta.onet.pl" has high entropy Contacted domain: "leadershipworks.co.za" has high entropy Contacted domain: "lifeexp-co01b.mail.protection.outlook.com" has high entropy Contacted domain: "mailsec.protonmail.ch" has high entropy Contacted domain: "msv.softbank.jp" has high entropy37:Tac3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004496.00000000.125132.03440000.00000004.mdmp, 00000000-00004496.00000001.127055.03440000.00000004.mdmp, 00000000-00004496.00000002.128972.03440000.00000004.mdmp, 00000000-00004496.00000003.134477.03440000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004496.00000000.125132.03440000.00000004.mdmp, 00000000-00004496.00000001.127055.03440000.00000004.mdmp, 00000000-00004496.00000002.128972.03440000.00000004.mdmp, 00000000-00004496.00000003.134477.03440000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004496.00000000.125132.03440000.00000004.mdmp, 00000000-00004496.00000001.127055.03440000.00000004.mdmp, 00000000-00004496.00000002.128972.03440000.00000004.mdmp, 00000000-00004496.00000003.134477.03440000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004496.00000000.125132.03440000.00000004.mdmp, 00000000-00004496.00000001.127055.03440000.00000004.mdmp, 00000000-00004496.00000002.128972.03440000.00000004.mdmp, 00000000-00004496.00000003.134477.03440000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004496.00000000.125132.03440000.00000004.mdmp, 00000000-00004496.00000001.127055.03440000.00000004.mdmp, 00000000-00004496.00000002.128972.03440000.00000004.mdmp, 00000000-00004496.00000003.134477.03440000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004496.00000000.125132.03440000.00000004.mdmp, 00000000-00004496.00000001.127055.03440000.00000004.mdmp, 00000000-00004496.00000002.128972.03440000.00000004.mdmp, 00000000-00004496.00000003.134477.03440000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004496.00000000.125132.03440000.00000004.mdmp, 00000000-00004496.00000001.127055.03440000.00000004.mdmp, 00000000-00004496.00000002.128972.03440000.00000004.mdmp, 00000000-00004496.00000003.134477.03440000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004496.00000000.125132.03440000.00000004.mdmp, 00000000-00004496.00000001.127055.03440000.00000004.mdmp, 00000000-00004496.00000002.128972.03440000.00000004.mdmp, 00000000-00004496.00000003.134477.03440000.00000004.mdmp")38:T9b8,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004496.00000000.125132.03440000.00000004.mdmp, 00000000-00004496.00000001.127055.03440000.00000004.mdmp, 00000000-00004496.00000002.128972.03440000.00000004.mdmp, 00000000-00004496.00000003.134477.03440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69e9d28ec12f1cfbbb0274f2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69e9d28ec12f1cfbbb0274f2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004496.00000000.125132.03440000.00000004.mdmp, 00000000-00004496.00000001.127055.03440000.00000004.mdmp, 00000000-00004496.00000002.128972.03440000.00000004.mdmp, 00000000-00004496.00000003.134477.03440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e9d28ec12f1cfbbb0274f2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69e9d28ec12f1cfbbb0274f2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"