26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample cdf876273c61… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cdf876273c61…. Malware family: Mint.Zard.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cdf876273c6175f4cdbaacd6ab361ffde60edb2ac3ffa2bcf8e74c5a18f4e462","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","cdf876273c6175f4cdbaacd6ab361ffde60edb2ac3ffa2bcf8e74c5a18f4e462"],"about":{"@type":"SoftwareApplication","name":"cdf876273c6175f4cdbaacd6ab361ffde60edb2ac3ffa2bcf8e74c5a18f4e462.bin","applicationCategory":["peexe","executable"],"identifier":"cdf876273c6175f4cdbaacd6ab361ffde60edb2ac3ffa2bcf8e74c5a18f4e462","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":15,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9b1," HTTP/1.1 200 OK Date: Tue 21 Apr 2026 06:30:07 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=R8SJ1.uMYqC49JfKOmgyX4K36gB0cbPRkd1kC1a5QcE-1776753007.468857-1.0.1.1-7UeSIAlRwsvauqBB_4sjqoDpX3MKUwBZrwhFcyafgpIpA04ADeq9Tm404Qwj8FYMzZAMOYsstVtv05I7gr_1FyiOFCehbSWSVFw79Ty_FviH9DozZ.MlApr_aoouBkbI; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 21 Apr 2026 07:00:07 GMT Server: cloudflare CF-RAY: 9efa5698aee7c67f-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /6/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 21 Apr 2026 06:30:08 GMT Content-Type: text/plain Content-Length: 5 Last-Modified: Tue 21 Apr 2026 06:25:06 GMT Connection: keep-alive ETag: "69e71842-5" Accept-Ranges: bytes with response body ==>363430310A....... "GET /6/1202.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 21 Apr 2026 06:30:08 GMT Content-Type: text/plain Content-Length: 253938 Last-Modified: Mon 20 Apr 2026 15:06:54 GMT Connection: keep-alive ETag: "69e6410e-3dff2" Accept-Ranges: bytes with response body ==>0A636D6F6E697175657740616D65726974726164652E636F6D0A636D6F6E697332407961686F6F2E636F6D0A636D6F6E69734073616E2E72722E636F6D0A636D.......2e:T725,"mx3.mail.icloud.com" Heuristic match: "c.net" Heuristic match: "dns.ne" Heuristic match: ":y:custmx.cscdns.net" Heuristic match: "ofwd2.porkbun.com" Heuristic match: "mx.tp" Heuristic match: "^mta7.am0.yahoodns.net" Heuristic match: "-md)mx0.aug.com" Heuristic match: "pmx-aol.mail.gm0.yahoodns.net" Heuristic match: "c-org.mail.protection.outlook.com"38:T7f0,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001284.00000000.143696.006D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001284.00000001.145616.006D0000.00000004.mdmp") Found URL "http://130.12.180.190/6/[64.124.12.162]izon.netcmott67@comcast.netcmott79@live.comcmott9@sbcglobal.netcmott@att.netcmott@cfl.rr.comcmott@citlink.netcmott@email.unc.educmott@icqmail.comcmott@live.comcmott@nc.rr.comcmott@netscape.netcmott@ole.comcmott@pacbell.nebcglobal.comcmotsenbocker@aol.comcmotsenbocker@msn.comcmotsenbocker@netscape.netcmotsenbocker@yahoo.comcmotsett7@bellsouth.netcmotsett@att.netcmotsinger1@triad.rr.comcmotsinger@att.netcmotsinger@mailcity.comcmotsinger@nc.rr.comcmotsinger@sbcglobal.netcmotsinger@yahoo.comcmotsinger@ymail.comcmotsko@adelphia.netcmotsko@aol.comcmotsko@att.netcmotsko@roadrunner.comcmotsko@yahoo.comcmotsney@aol.comcmotsney@copperheadchemical.comcmott002@yahoo.comcmott00@aol.comcmott09@live.comcmott09@sbcglobal.netcmott10236@aol.comcmott10@msn.comcmott13@yahoo.comcmott1@houston.rr.comcmott1@sbcglobal.netcmott2117@iwon.comcmott2@mix.wvu.educmott2@msn.comcmott2@yahoo.comcmott377@msn.comcmott377@yahoo.comcmott3@cox.netcmott3@sbcglobal.netcmott3@yahoo.comcmott527@ver[64.124.12.162]" - Source: "00000000-00001284.00000001.145616.00816000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001284.00000002.147536.006D0000.00000004.mdmp") Found URL "http://icanhazip.com/[%s][0.0.0.0][0.0.0.0]%s.comesmtpehlo" - Source: "00000000-00001284.00000002.147536.00814000.00000002.mdmp") Found URL "http://binance.com" - Source: "00000000-00001284.00000002.147536.00814000.00000002.mdmp") Found URL "http://bitrefill.com" - Source: "00000000-00001284.00000002.147536.00814000.00000002.mdmp") Found URL "http://crypto.com" - Source: "00000000-00001284.00000002.147536.00814000.00000002.mdmp") Found URL "http://kucoin.com" - Source: "00000000-00001284.00000002.147536.00814000.00000002.mdmp")39:T5b6,Contacted domain: "1044sprintpcs.com" has high entropy Contacted domain: "adcentspro.com" has high entropy Contacted domain: "agriwaste.com" has high entropy Contacted domain: "alt1.aspmx.l.google.com" has high entropy Contacted domain: "alt2.aspmx.l.google.com" has high entropy Contacted domain: "alt3.aspmx.l.google.com" has high entropy Contacted domain: "angelfire.com" has high entropy Contacted domain: "archstonemail.com" has high entropy Contacted domain: "aspmx2.googlemail.com" has high entropy Contacted domain: "blackplanet.com" has high entropy Contacted domain: "brf-watermark.com" has high entropy Contacted domain: "centurymalson.com" has high entropy Contacted domain: "compton.k12.ca.us" has high entropy Contacted domain: "cybersouth.com" has high entropy Contacted domain: "d187183a.ess.barracudanetworks.com" has high entropy Contacted domain: "d218257a.ess.barracudanetworks.com" has high entropy Contacted domain: "dnvrco-postmx01.email.rr.com" has high entropy Contacted domain: "earthlink.com" has high entropy Contacted domain: "edinburg.com" has high entropy Contacted domain: "eu-smtp-inbound-1.mimecast.com" has high entropy Contacted domain: "fwd2.porkbun.com" has high entropy Contacted domain: "gcah-net.mx1.arsmtp.com" has high entropy Contacted domain: "hyperion.it.miami.edu" has high entropy Contacted domain: "image-work.com" has high entropy Contacted domain: "inbound.localnet.com" has high entropy3a:Tac3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001284.00000000.143696.006D0000.00000004.mdmp, 00000000-00001284.00000001.145616.006D0000.00000004.mdmp, 00000000-00001284.00000002.147536.006D0000.00000004.mdmp, 00000000-00001284.00000003.153039.006D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001284.00000000.143696.006D0000.00000004.mdmp, 00000000-00001284.00000001.145616.006D0000.00000004.mdmp, 00000000-00001284.00000002.147536.006D0000.00000004.mdmp, 00000000-00001284.00000003.153039.006D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001284.00000000.143696.006D0000.00000004.mdmp, 00000000-00001284.00000001.145616.006D0000.00000004.mdmp, 00000000-00001284.00000002.147536.006D0000.00000004.mdmp, 00000000-00001284.00000003.153039.006D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001284.00000000.143696.006D0000.00000004.mdmp, 00000000-00001284.00000001.145616.006D0000.00000004.mdmp, 00000000-00001284.00000002.147536.006D0000.00000004.mdmp, 00000000-00001284.00000003.153039.006D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001284.00000000.143696.006D0000.00000004.mdmp, 00000000-00001284.00000001.145616.006D0000.00000004.mdmp, 00000000-00001284.00000002.147536.006D0000.00000004.mdmp, 00000000-00001284.00000003.153039.006D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001284.00000000.143696.006D0000.00000004.mdmp, 00000000-00001284.00000001.145616.006D0000.00000004.mdmp, 00000000-00001284.00000002.147536.006D0000.00000004.mdmp, 00000000-00001284.00000003.153039.006D0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001284.00000000.143696.006D0000.00000004.mdmp, 00000000-00001284.00000001.145616.006D0000.00000004.mdmp, 00000000-00001284.00000002.147536.006D0000.00000004.mdmp, 00000000-00001284.00000003.153039.006D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001284.00000000.143696.006D0000.00000004.mdmp, 00000000-00001284.00000001.145616.006D0000.00000004.mdmp, 00000000-00001284.00000002.147536.006D0000.00000004.mdmp, 00000000-00001284.00000003.153039.006D0000.00000004.mdmp")3b:T9e1,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001284.00000000.143696.006D0000.00000004.mdmp, 00000000-00001284.00000001.145616.006D0000.00000004.mdmp, 00000000-00001284.00000002.147536.006D0000.00000004.mdmp, 00000000-00001284.00000003.153039.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69e71953b300fcb3a4096e56"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69e71953b300fcb3a4096e56"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001284.00000000.143696.006D0000.00000004.mdmp, 00000000-00001284.00000001.145616.006D0000.00000004.mdmp, 00000000-00001284.00000002.147536.006D0000.00000004.mdmp, 00000000-00001284.00000003.153039.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e71953b300fcb3a4096e56"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69e71953b300fcb3a4096e56"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"