26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample 93a3412e427d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 93a3412e427d…. Malware family: Mint.Zard.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/93a3412e427dbe3690a625219166d9e494593cd600932dface8584b3efe2b9ad","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","93a3412e427dbe3690a625219166d9e494593cd600932dface8584b3efe2b9ad"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"93a3412e427dbe3690a625219166d9e494593cd600932dface8584b3efe2b9ad","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8f5," HTTP/1.1 200 OK Date: Thu 02 Apr 2026 20:23:23 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=iGzRmBtgTFBoxANOYyIfOouxNCTxqbBKq9mj7O1hvhQ-1775161403.3002121-1.0.1.1-gVboS6BbFE4Wyk0YhO9HKqMPiIvO6f5OSxVtdknMKZfefn6B1VwqVfI1LU_FGoCycH4bGXGmL5uzB1A6VUooUvbMM0Ah10rfK3rvCb92_Lj_05afDxXdfPBUBchuoNYa; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Thu 02 Apr 2026 20:53:23 GMT Server: cloudflare CF-RAY: 9e628d129c5accf8-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /us/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 158.94.211.162" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 02 Apr 2026 20:23:26 GMT Content-Type: text/plain Content-Length: 5 Last-Modified: Tue 31 Mar 2026 19:12:46 GMT Connection: keep-alive ETag: "69cc1cae-5" Accept-Ranges: bytes with response body ==>323534360A....... "GET /us/2484.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 158.94.211.162" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 02 Apr 2026 20:23:27 GMT Content-Type: text/plain Content-Length: 258217 Last-Modified: Tue 31 Mar 2026 18:53:00 GMT Connection: keep-alive ETag: "69cc180c-3f0a9" Accept-Ranges: bytes with response body ==>6E76697365752E6E65743A4D616769637368726F6F6D31210A686F72766174686C61796E65406F6E65742E706C3A47616D657232303033210A6A656476696365.......2e:T725,"mx02.mail.icloud.com" Heuristic match: "hmta7.am0.yahoodns.net" Heuristic match: "wave.ai" Heuristic match: "jmx-apac.mail.gm0.yahoodns.net" Heuristic match: "ns.net" Heuristic match: "viseu-net.mail.protection.outlook.com" Heuristic match: "vmx-aol.mail.gm0.yahoodns.net" Heuristic match: ".azharwong.com.my" Heuristic match: "rotection.outlook.com" Heuristic match: "on.outlook.com" Heuristic match: "4ed'esenviseu-net.mail.protection.outlook.com" Heuristic match: "fmail4.industrialesud.com" Heuristic match: "5mx1.hc494-80.c3s2.iphmx.com" Heuristic match: "bcorreo.mag.gob.ec" Heuristic match: "dmx.serviciodecorreo.es" Heuristic match: "*:mx2.free.fr" Heuristic match: "pmx-aol.mail.gm0.yahoodns.net" Heuristic match: "4nasa-gov.mail.protection.outlook.com" Heuristic match: "+afmx.freemail.hu" Heuristic match: "ceres.deusto.es" Heuristic match: "xarterialeducation.com" Heuristic match: "wmail-new.ht.hr"38:T8e8,Found URL "http://www.94.211.162/us/n.txt158.94.211.162/us/n.txt162.211.94.211.162/us/n.txt158.94.211.162/us/n.txtfaultconnectionsettingsus/n.txtus/n.txtus/n.txtbout:blankummy://urlpmapperus/n.txtpmapperpmapperbout:blankookie:\hapubws\appdata\local\microsoft\windows\inetcache\iescby323hapubws\appdata\local\microsoft\windows\historyistory\hapubws\appdata\local\microsoft\windows\inetcookies:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\om.icanhazipapubws\appdata\local\microsoft\windows\history:\users\hapubws\appdata\local\microsoft\windows\inetcookiesontentontent\hapubws\appdata\local\microsoft\windows\history:\users\hapubws\appdata\local\microsoft\windows\historycanhazip.comcanhazip.comookies\hapubws\appdata\local\microsoft\windows\inetcookies:\users\hapubws\appdata\local\microsoft\windows\inetcookies\isited:hapubws\appdata\local\microsoft\windows\history:\users\hapubws\appdata\local\c:\users\hapubws\appdata\local\microsoft\windowsinetcookies:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie:\users\hapubws\appdata\local\microsoft\feeds" - Source: "00000000-00004880.00000000.161231.03090000.00000004.mdmp") Found URL "http://158.94.211.162/158.94.211.162.txt58.94.211.16258.94.211.16258.94.211.16262.211lmem8asycasycprocessor_identifier=intel64" - Source: "00000000-00004880.00000000.161231.03090000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004880.00000000.161231.03090000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004880.00000001.163151.03090000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004880.00000002.165072.03090000.00000004.mdmp") Found URL "http://icanhazip.com/[%s][0.0.0.0][0.0.0.0]%s.comesmtpehlo" - Source: "00000000-00004880.00000003.170582.00104000.00000002.mdmp") Found URL "http://binance.com" - Source: "00000000-00004880.00000003.170582.00104000.00000002.mdmp") Found URL "http://bitrefill.com" - Source: "00000000-00004880.00000003.170582.00104000.00000002.mdmp") Found URL "http://crypto.com" - Source: "00000000-00004880.00000003.170582.00104000.00000002.mdmp") Found URL "http://kucoin.com" - Source: "00000000-00004880.00000003.170582.00104000.00000002.mdmp")39:T5dc,Contacted domain: "126mx03.mxmail.netease.com" has high entropy Contacted domain: "163mx01.mxmail.netease.com" has high entropy Contacted domain: "97700650cloud.boosteroid.comauthregister" has high entropy Contacted domain: "ASPMX4.GOOGLEMAIL.COM" has high entropy Contacted domain: "ASPMX5.GOOGLEMAIL.COM" has high entropy Contacted domain: "aesntrmjanakpuri.com" has high entropy Contacted domain: "alt1.aspmx.l.google.com" has high entropy Contacted domain: "alt2.aspmx.l.google.com" has high entropy Contacted domain: "alt3.aspmx.l.google.com" has high entropy Contacted domain: "alt4.aspmx.l.google.com" has high entropy Contacted domain: "arterialeducation.com" has high entropy Contacted domain: "artgulin.com" has high entropy Contacted domain: "aspmx2.googlemail.com" has high entropy Contacted domain: "athirdparty.com.au" has high entropy Contacted domain: "atmagenus.com.br" has high entropy Contacted domain: "au-smtp-inbound-1.mimecast.com" has high entropy Contacted domain: "azharwong.com.my" has high entropy Contacted domain: "bauschmitt.de" has high entropy Contacted domain: "bgmgate9.biglobe.ne.jp" has high entropy Contacted domain: "bigpond.net.au" has high entropy Contacted domain: "blackhorizonstudio.com" has high entropy Contacted domain: "blairr.freeserve.co.uk" has high entropy Contacted domain: "buckeye-express.com" has high entropy Contacted domain: "catypc.work.gd" has high entropy Contacted domain: "clubdetirlefaucon.com" has high entropy3a:Tac3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004880.00000000.161231.03090000.00000004.mdmp, 00000000-00004880.00000001.163151.03090000.00000004.mdmp, 00000000-00004880.00000002.165072.03090000.00000004.mdmp, 00000000-00004880.00000003.170582.03090000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004880.00000000.161231.03090000.00000004.mdmp, 00000000-00004880.00000001.163151.03090000.00000004.mdmp, 00000000-00004880.00000002.165072.03090000.00000004.mdmp, 00000000-00004880.00000003.170582.03090000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004880.00000000.161231.03090000.00000004.mdmp, 00000000-00004880.00000001.163151.03090000.00000004.mdmp, 00000000-00004880.00000002.165072.03090000.00000004.mdmp, 00000000-00004880.00000003.170582.03090000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004880.00000000.161231.03090000.00000004.mdmp, 00000000-00004880.00000001.163151.03090000.00000004.mdmp, 00000000-00004880.00000002.165072.03090000.00000004.mdmp, 00000000-00004880.00000003.170582.03090000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004880.00000000.161231.03090000.00000004.mdmp, 00000000-00004880.00000001.163151.03090000.00000004.mdmp, 00000000-00004880.00000002.165072.03090000.00000004.mdmp, 00000000-00004880.00000003.170582.03090000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004880.00000000.161231.03090000.00000004.mdmp, 00000000-00004880.00000001.163151.03090000.00000004.mdmp, 00000000-00004880.00000002.165072.03090000.00000004.mdmp, 00000000-00004880.00000003.170582.03090000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004880.00000000.161231.03090000.00000004.mdmp, 00000000-00004880.00000001.163151.03090000.00000004.mdmp, 00000000-00004880.00000002.165072.03090000.00000004.mdmp, 00000000-00004880.00000003.170582.03090000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004880.00000000.161231.03090000.00000004.mdmp, 00000000-00004880.00000001.163151.03090000.00000004.mdmp, 00000000-00004880.00000002.165072.03090000.00000004.mdmp, 00000000-00004880.00000003.170582.03090000.00000004.mdmp")3b:T9d7,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004880.00000000.161231.03090000.00000004.mdmp, 00000000-00004880.00000001.163151.03090000.00000004.mdmp, 00000000-00004880.00000002.165072.03090000.00000004.mdmp, 00000000-00004880.00000003.170582.03090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69ced019efbd45ac7206fa39"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69ced019efbd45ac7206fa39"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004880.00000000.161231.03090000.00000004.mdmp, 00000000-00004880.00000001.163151.03090000.00000004.mdmp, 00000000-00004880.00000002.165072.03090000.00000004.mdmp, 00000000-00004880.00000003.170582.03090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69ced019efbd45ac7206fa39"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69ced019efbd45ac7206fa39"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"