24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample eec4d40ff10e… — Score 93/100 — Hybrid Analysis","description":"Malicious verdict for sample eec4d40ff10e…. Malware family: Mint.Zard.Generic. Threat score 93/100. 11/27 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/eec4d40ff10e228f61464c822de9e4e12fe37f4e1c3b83fe3323c58e51c87546","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","eec4d40ff10e228f61464c822de9e4e12fe37f4e1c3b83fe3323c58e51c87546"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"eec4d40ff10e228f61464c822de9e4e12fe37f4e1c3b83fe3323c58e51c87546","additionalType":"Malicious sample"},"threatScore":93,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":11,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8de," HTTP/1.1 200 OK Date: Tue 19 May 2026 23:16:10 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=___7dm5Is_Retl5F639QFhhaBnaXrFJUU8NSaz7TAoY-1779232570.9001062-1.0.1.1-vOig7Kn8Og4FLLFAt4Ji_7GJFkJb.ynibkRFXfsyDV8x19I7w1SUDmzd3pv89VzSerGU.AlpOGo3Qa3aHu_yz8.bU0ogY.Eqa76yo4dXg6rWWt7i3dTbzKoxwXdN8Rki; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 19 May 2026 23:46:10 GMT Server: cloudflare CF-RAY: 9fe6ced01a3e98ae-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /11/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue 19 May 2026 23:16:11 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Tue 19 May 2026 23:18:23 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940107-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 63227 X-Timer: S1779232704.773339 VS0 VE65 X-Cache: MISS X-Vcl-Time-Ms: 65 Cache-Control: no-cache no-store Accept-Ranges: bytes with no response body "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Tue 19 May 2026 23:18:23 GMT Set-Cookie: lidc="b=VGST08:s=V:r=V:a=V:p=V:g=3439:u=1:x=1:i=1779232704:t=1779319104:v=2:sig=AQEwonDOuEUmRo8QODbw4x5APDvJWv4u"; Expires=Wed 20 May 2026 23:18:24 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure X-Li-Uuid: AAZSM+VPQg72qeu9xi9ZXQ== X-Li-Fabric: prod-lva1 X-Msedge-Ref: Ref A: 9D8F53D3708B43EFBDA957934CB9AB16 Ref B: BY1AA1072320042 Ref C: 2026-05-19T23:18:24Z Vary: Accept-Encoding X-Li-Proto: http/2 Content-Encoding: gzip X-Li-Pop: afd-prod-lva1-x X-Cache: CONFIG_NOCACHE Alt-Svc: h3=":443"; ma=86400 Linkedin-Action: 1 with response body ==>BINARY_CONTENT....... "GET /mapuid?member=280&user=32DFF8A43A9F6A9B15B5EE573B1A6B37;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D32DFF8A43A9F6A9B15B5EE573B1A6B37%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 307 Temporary Redirect Content-Type: text/html; charset=utf-8 Date: Tue 19 May 2026 23:18:24 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=4794941456890720393; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon 17-Aug-2026 23:18:24 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: 1caed069-aa77-47e4-813d-b5401010834c X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 893.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D32DFF8A43A9F6A9B15B5EE573B1A6B37%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D32DFF8A43A9F6A9B15B5EE573B1A6B37%252526gdpr%25253D0%252526gdpr_consent%25253D Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/octet-stream Date: Tue 19 May 2026 23:18:29 GMT Last-Modified: Wed 08 Apr 2026 16:21:07 GMT X-Azure-Ref: 20260519T231829Z-15c4dcdf87cr7n8rhC1CHIrqac00000002700000000086rh X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Fd-Int-Roxy-Purgeid: 0 Vary: Accept-Encoding Content-Encoding: br X-Cache: TCP_HIT Cache-Control: public max-age=604800 X-Ms-Request-Id: b8e22df5-201e-0064-7fe7-e53b59000000 X-Ms-Blob-Type: BlockBlob with no response body "GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json Date: Tue 19 May 2026 23:18:35 GMT X-Azure-Ref: 20260519T231835Z-r18bcf59d969mjbchC1CHI0ydn00000001ng0000000027h3 X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Ms-Blob-Type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id Server x-ms-version Content-Type ETag Last-Modified x-ms-lease-status x-ms-blob-type Content-Length Date Transfer-Encoding Access-Control-Allow-Origin: * Last-Modified: Tue 24 Oct 2023 08:27:00 GMT X-Fd-Int-Roxy-Purgeid: 83583309 Etag: 0x8DBD46AFE482320 X-Cache: TCP_HIT Cache-Control: public max-age=432000 Accept-Ranges: bytes X-Ms-Request-Id: 8e9fb30e-501e-005d-0186-e5b8f3000000 with no response body2c:T725," Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a0cef224a2932fb7f0a26e1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\" \"{\"hash\":\"WHwDYNyCDmmr0kauCoL1fa1mTzBuoPLNKdbRaW3Hhoo=\",\"ids\":[\"ghbmnnjooekpmoecnnnilnnbdlolhkhi\"],\"protocol_version\":1}\" HTTP/2 200 OK\nContent-Type: application/json; charset=UTF-8\nDate: Tue\n 19 May 2026 23:18:30 GMT\nServer: ESF\nX-Xss-Protection: 0\nX-Content-Type-Options: nosniff\nVary: Referer\nContent-Encoding: gzip\nX-Frame-Options: SAMEORIGIN\nAlt-Svc: h3=\":443\"; ma=2592000\nh3-29=\":443\"; ma=2592000 with response body ==>BINARY_CONTENT.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a0cef224a2932fb7f0a26e1"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6a0cef224a2932fb7f0a26e1"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.16.185.241 on port 80 is sent without HTTP header\n TCP traffic to 130.12.180.190 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a0cef224a2932fb7f0a26e1"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"