24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4cb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample d0849b2ce09b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d0849b2ce09b…. Malware family: Mint.Zard.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d0849b2ce09bffdd925bbac6327361f4e219a1c58d07b65be71d209ff7fd73ec","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","d0849b2ce09bffdd925bbac6327361f4e219a1c58d07b65be71d209ff7fd73ec"],"about":{"@type":"SoftwareApplication","name":"d0849b2ce09bffdd925bbac6327361f4e219a1c58d07b65be71d209ff7fd73ec.bin","applicationCategory":["peexe","executable"],"identifier":"d0849b2ce09bffdd925bbac6327361f4e219a1c58d07b65be71d209ff7fd73ec","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8dc," HTTP/1.1 200 OK Date: Sun 19 Apr 2026 10:08:36 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=Aro1ENny3pCiSb9l2dxDNQuAI0gz.m6tV1CRkYnrr90-1776593316.4216366-1.0.1.1-mvY.mfJfbCBVDv5x1Y5MXAn2_4yGDN5Y3ZptW_pCna08u5mn99Z7FVqHKrUF623pVBhM0akz0ZbCp9kUfjF2HZhJjvVt.QjSEyPvaWUO8lfaxvlX6ifrwy1GB_bc2yxA; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Sun 19 Apr 2026 10:38:36 GMT Server: cloudflare CF-RAY: 9eeb1be3aabceb24-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /ok/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 19 Apr 2026 10:08:37 GMT Content-Type: text/plain Content-Length: 2 Last-Modified: Sun 19 Apr 2026 09:58:42 GMT Connection: keep-alive ETag: "69e4a752-2" Accept-Ranges: bytes with response body ==>310A....... "GET /ok/a HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 19 Apr 2026 10:08:37 GMT Content-Type: application/octet-stream Content-Length: 225237 Last-Modified: Sun 19 Apr 2026 09:59:51 GMT Connection: keep-alive ETag: "69e4a797-36fd5" Accept-Ranges: bytes with response body ==>617264656C6C61706C756D0A617264656C6C61706C756D0A617264656C6C61706C756D0A617264656C6C61706C756D4064656C74616A6F686E736F6E732E636F....... "GET /ok/1.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 19 Apr 2026 10:08:39 GMT Content-Type: text/plain Content-Length: 225237 Last-Modified: Sun 19 Apr 2026 09:58:36 GMT Connection: keep-alive ETag: "69e4a74c-36fd5" Accept-Ranges: bytes with response body ==>617264656C6C61706C756D0A617264656C6C61706C756D0A617264656C6C61706C756D0A617264656C6C61706C756D4064656C74616A6F686E736F6E732E636F....... "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Sun 19 Apr 2026 10:10:43 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940047-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 67232 X-Timer: S1776593443.303776 VS0 VE70 X-Cache: MISS X-Vcl-Time-Ms: 70 Cache-Control: no-cache no-store Accept-Ranges: bytes with response body ==>BINARY_CONTENT....... "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Sun 19 Apr 2026 10:10:43 GMT Set-Cookie: lidc="b=TGST08:s=T:r=T:a=T:p=T:g=3252:u=1:x=1:i=1776593444:t=1776679844:v=2:sig=AQH6nFXfDl9V7LUrpRaYmU4iESZ24LZ6"; Expires=Mon 20 Apr 2026 10:10:44 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure X-Li-Uuid: AAZPzWUkzK1phdDB+P7q3g== X-Li-Fabric: prod-ltx1 X-Msedge-Ref: Ref A: 44388A7153424B55B8197801CB6BDC36 Ref B: BY1AA1072319031 Ref C: 2026-04-19T10:10:44Z Vary: Accept-Encoding X-Li-Proto: http/2 Content-Encoding: gzip X-Li-Pop: afd-prod-ltx1-x X-Cache: CONFIG_NOCACHE Alt-Svc: h3=":443"; ma=86400 Linkedin-Action: 1 with response body ==>BINARY_CONTENT....... "GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json Date: Sun 19 Apr 2026 10:10:45 GMT X-Azure-Ref: 20260419T101045Z-r1d644b859c2hc7mhC1CHI3r600000000e8g000000004ygg X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Ms-Blob-Type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id Server x-ms-version Content-Type ETag Last-Modified x-ms-lease-status x-ms-blob-type Content-Length Date Transfer-Encoding Access-Control-Allow-Origin: * Last-Modified: Tue 24 Oct 2023 08:27:00 GMT X-Fd-Int-Roxy-Purgeid: 83583309 Etag: 0x8DBD46AFE482320 X-Cache: TCP_HIT Accept-Ranges: bytes X-Ms-Request-Id: 9ff593fa-b01e-0045-389d-cc6794000000 with no response body "GET /mapuid?member=280&user=32DFF8A43A9F6A9B15B5EE573B1A6B37;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D32DFF8A43A9F6A9B15B5EE573B1A6B37%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 307 Temporary Redirect Content-Type: text/html; charset=utf-8 Date: Sun 19 Apr 2026 10:10:45 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=9096477324723685922; SameSite=None; Path=/; Max-Age=7776000; Expires=Sat 18-Jul-2026 10:10:45 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: 33174d8a-dbaa-48ec-a68a-ab86e17da9b9 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D32DFF8A43A9F6A9B15B5EE573B1A6B37%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D32DFF8A43A9F6A9B15B5EE573B1A6B37%252526gdpr%25253D0%252526gdpr_consent%25253D Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body "GET /crx/blobs/AQx-wa5CdJIJjS706_knugjy7Cklz3uJDf87x4mZfLZdq9myhunualUk1-rVhRTqBVeo4o-Rknd414J61ZjE36shzOrH0ymHdk6zgTltGzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-Os: Windows Priority: u=4, i Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Accept-Encoding: gzip, deflate, br, zstd Sec-Mesh-Client-Os-Version: 10.0.16299 Sec-Mesh-Client-Webview: 0 Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AMNfjG1UMHKjLyg1JE9CD0rZaniAwXqzNxI5p0gknaXwAxKdTU-_4-PCJylV-9tLCCve9ymMtR7c6nI Date: Sat 18 Apr 2026 15:03:22 GMT Server: UploadServer Last-Modified: Tue 14 Apr 2026 15:03:12 GMT Expires: Sun 18 Apr 2027 15:03:22 GMT Etag: 1db0e9cf_2cf27c25_ffe43034_bc33e3f0_b05b60af Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 68843 X-Goog-Hash: crc32c=939wAg== with response body ==>BINARY_CONTENT....... "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/octet-stream Date: Sun 19 Apr 2026 10:10:51 GMT X-Azure-Ref: 20260419T101051Z-179668f7bf48kpmmhC1CHInxgw0000000e4g00000000anh1 X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked Content-Encoding: gzip X-Ms-Blob-Type: BlockBlob Last-Modified: Tue 24 Feb 2026 03:27:40 GMT X-Fd-Int-Roxy-Purgeid: 0 Etag: 0x8DE7354AA0713A3 X-Cache: TCP_HIT Cache-Control: public max-age=604800 Accept-Ranges: bytes X-Ms-Request-Id: 628ca06c-c01e-000e-0fc8-cce371000000 with response body ==>BINARY_CONTENT.......2d:T725,"" (Indicator: "GetDC"; Source: "00000000-00004352.00000000.237739.009C0000.00000004.mdmp, 00000000-00004352.00000001.239659.009C0000.00000004.mdmp, 00000000-00004352.00000002.241580.009C0000.00000004.mdmp, 00000000-00004352.00000003.247083.009C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004352.00000000.237739.009C0000.00000004.mdmp, 00000000-00004352.00000001.239659.009C0000.00000004.mdmp, 00000000-00004352.00000002.241580.009C0000.00000004.mdmp, 00000000-00004352.00000003.247083.009C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004352.00000000.237739.009C0000.00000004.mdmp, 00000000-00004352.00000001.239659.009C0000.00000004.mdmp, 00000000-00004352.00000002.241580.009C0000.00000004.mdmp, 00000000-00004352.00000003.247083.009C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004352.00000000.237739.009C0000.00000004.mdmp, 00000000-00004352.00000001.239659.009C0000.00000004.mdmp, 00000000-00004352.00000002.241580.009C0000.00000004.mdmp, 00000000-00004352.00000003.247083.009C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004352.00000000.237739.009C0000.00000004.mdmp, 00000000-00004352.00000001.239659.009C0000.00000004.mdmp, 00000000-00004352.00000002.241580.009C0000.00000004.mdmp, 00000000-00004352.00000003.247083.009C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004352.00000000.237739.009C0000.00000004.mdmp, 00000000-00004352.00000001.239659.009C0000.00000004.mdmp, 00000000-00004352.00000002.241580.009C0000.00000004.mdmp, 00000000-00004352.00000003.247083.009C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004352.00000000.237739.009C0000.00000004.mdmp, 00000000-00004352.00000001.239659.009C0000.00000004.mdmp, 00000000-00004352.00000002.241580.009C0000.00000004.mdmp, 00000000-00004352.00000003.247083.009C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004352.00000000.237739.009C0000.00000004.mdmp, 00000000-00004352.00000001.239659.009C0000.00000004.mdmp, 00000000-00004352.00000002.241580.009C0000.00000004.mdmp, 00000000-00004352.00000003.247083.009C0000.00000004.mdmp")3e:T9d7,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004352.00000000.237739.009C0000.00000004.mdmp, 00000000-00004352.00000001.239659.009C0000.00000004.mdmp, 00000000-00004352.00000002.241580.009C0000.00000004.mdmp, 00000000-00004352.00000003.247083.009C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69e4a979981004f59009f977"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00004352.00000000.237739.04BE9000.00000004.mdmp\n 00000000-00004352.00000001.239659.04BE9000.00000004.mdmp\n 00000000-00004352.00000002.241580.04BE9000.00000004.mdmp\n 00000000-00004352.00000003.247083.04BE9000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69e4a979981004f59009f977"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69e4a979981004f59009f977"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004352.00000000.237739.009C0000.00000004.mdmp, 00000000-00004352.00000001.239659.009C0000.00000004.mdmp, 00000000-00004352.00000002.241580.009C0000.00000004.mdmp, 00000000-00004352.00000003.247083.009C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e4a979981004f59009f977"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69e4a979981004f59009f977"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\" \"{\"hash\":\"3pAIs/e6fHR+TSkkaPW//6IT3ACN71CvAcpkD/ovg70=\",\"ids\":[\"ghbmnnjooekpmoecnnnilnnbdlolhkhi\"],\"protocol_version\":1}\" HTTP/2 200 OK\nContent-Type: application/json; charset=UTF-8\nDate: Sun\n 19 Apr 2026 10:10:52 GMT\nServer: ESF\nX-Xss-Protection: 0\nX-Content-Type-Options: nosniff\nVary: Referer\nContent-Encoding: gzip\nX-Frame-Options: SAMEORIGIN\nAlt-Svc: h3=\":443\"; ma=2592000\nh3-29=\":443\"; ma=2592000 with response body ==>BINARY_CONTENT.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69e4a979981004f59009f977"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"