�30������t2��ҒhV�����+K�{���MB���6�,�� e�5�k��L47�ɚ���蟺�M}�V3����t��ꂺp��(�@VII��!��1���3 ���R���E����_��] \W�.�q:C���$���Im�F��vښ�x��{��D�v�1\��d��}I�z��QUy��"�v<)�b.=��|B�&W ��Y���]�8�&82�[�����9 ����P��6�$�ëf�m$���`W`M��m_0B�X�ű������rg�Nq���=��\Rf+~w�4�� �+ �p*�7���軸/e�J�D( ����M�#�c��.�����<�P���V�t�����12TΈ:����T^���uW�4��6��r�.K����(��0�N���[ .��WTK��������8�~�R������ȴ�@���K������y��-q!� �,,"�.����J��H�1)��/�B�����?.�".<����T�uږ���N�$��� a��v�G����*W!�Ӷ�d�xZ~À��A+�p��W#fͿ�g�<�..��A����$�_0?�g\5DFz���>��L�S- ��n}�i2��6�B��Hs���% ���xf��a"eq��:J�i��|e���'�3@9���:�|V���ȼ$��<_d�����%�I��X�� X�oN-�)�U���xdcI�g܀�.��J���9 gc�3B�����HYb�n9�A���� �f�ܝ�V�|���u��Sx&sBP�N���kx�k�D�Bc�z�8�h: _�#�ğ( �GC�U��*��VqhK����ʯ~���Ĥ�yr�u����X��\���0j�"*BB�?/@ȕw]��s��wx� !o"��wS�LygEc�p$<��/��X�^�^�*�T$�\�¸�Y��q6�>��)isg�+cBI��'�2�uI�yh������ ��;f�l����8c 5��-���|����7����af��Z���Y�a�@ڳ����'z���i����l/O��4]�L>E0uC&����@Q!�씸hI�)@ �m1�@'�`�EA} =��q�66?�#m�Z�T��K$9�����*"�v�i�P�9������j�aV��i�aC\���ު5 o��iZ0'F`� ����#SV@i)+�)M)�Έ�| ��������pt��O����(t� �/��y�-9r�9�Bѓ���\̃�Z�;&殇� a� �,�eM�6r��U���]"�&!��L���缏Z��w�S�'����+��K�M7��A2��;�Ġ�Ǎ=�f�Y�h��j�J�O�f�Ց�fϑ���m�][\����J�&Yо��X�w=>R5� �BL�8T���>&5���"I�f��Z|u�ӧ ���q�6�J���Ǘ����֍DF�$�7��q%u��KN�tw� 2o�p�%QjS�Lv� ��~{�j1,������`���6�$7:6�m����d��a���S_ż�5��g�H8�^b}�����'�}k�o��:���^$��*w��j$����6�~n��]'t�X> ق`�Ł4��K���*R�ڴ�-By&C~�X �'����n![w���#V(�*m����xb��QY:�c�7��EvK���@7�T��x�(�kK��f�"�9v*�C��w�ď��h�� ?VqqacT����Z!�5p� T"9 B�۬�aZ����ǐ;������R� ����~u�|�4��\@k��c=��`2��ǵY�j��! ��� r� �wlǨ���,ⷯ�������Klq����@r(v~9 Eh��Z]�k�w��(�X���T����w��+[���f�P!ݻF�7�I�b��Q�}��LQk`�*]�� �=�sl4�eқ����)~���q�y�����e�����m58�V��O|�)�ճA�m.���(�������붻�Ak�����e�^]YK_|qw��co ���W��w��� n��5��D��|�[���*vLZ��"r� ��u��� �iS�����GZ1��O�z\��@�B����=�KnC����"�<��H���H1��Șo$�p��<Ԩ�6+6�P�[U��g$L�(<��Z���l�l��8% ��L��^=%���<�l�������\��J)��|��0�h˼n5�aPm�k��q���G`��d�**En�Ǩ$�!~K!��;4"�2�B���[8�?�+䶰�ϲ #�E2�d��\1���n96P��#�^"<��l6&�J�!1� KSČ�:��G� �.�F���!>���'�1�ɡ3W��~��{�s��s��5���Zn�N���F$��^��G5Cd��K2�� �f�� 9���͔��]y��餐�1�mqZb�@A���i�}!� o��"�;�x���x�����H�B�qT���=�:���#کQv]⤪�H�j̉r+�s��� 20��Պ��� س*[nP��}�a�?yS�G��{��6j�D1��=�nI)+��7�s���9�08��N�ҩV[٩�i�ajD��4:������ը�OD@(��:�ܛ�KOk:�Q+?Y3�3���ƓG|Q��C[ߓq�u��\6�P{���D�u�-�f�t��Cs���k���b���_Іi �^���td"i�x����+c��:Mb�ey7��ސkÇ��N��@n{AO�lJ���_�{z�A�a��O9$�� @�� s�Ě�)�d=�_�7��&��خq��uu�8��΅���V�`������;j�4j{'�:+z<���#Lx:/G醍k!Y`�����m<�S�]\�����LD�TJ�tuE}9t�#k0欁5\ȥA��H�PG[EA� );c�����<��RF�c5���-���=�SOd?�m hȣ����,���� ��;4�Ä�lz��,@����%>�v65���d\}D_5%(:���"��2�,�"�Y���y|Y��b�V���Y�D��L�I����&�Lû�Z�sȗ�y��lJ������ķ�7�1`�A9������i�9�q|p�Ndlb".�xӃ�S" v���
Static task
static1
Behavioral task
behavioral1
Sample
NoMercy 1.0.6 [Cracked]/NoMercy 1.0.6/ZTC1TJGBfr.exe
Resource
win10-20231215-en
Behavioral task
behavioral2
Sample
NoMercy 1.0.6 [Cracked]/Patcher/NoMercyPatcher.exe
Resource
win10-20231215-en
General
-
Target
NoMercy 1.0.6 Cracked.zip
-
Size
8.0MB
-
MD5
d5046e368cc998775024f79f400ee43f
-
SHA1
0693bf49c128332ad5e73c9db3e2ec9c587dc8fb
-
SHA256
885f96512ab6c0a22ecf60847dbb5ece1bcb1515ea1c9e32aa0fb15b1d966c61
-
SHA512
45e08d221dff8e26d65f2f314db3a3a95e1ce90f3bff805a44741a39e2bd9ebd58906f8db153a689958ada9bf0a95a6ae21ca38bee0c0198173d505f6775e88e
-
SSDEEP
196608:8y5otd/e4e/fNkYc+eEGHzxVlBoE7rVJs7NbLm/MjgVBAUBmddP:Tot1NW1K9pz7rcJLATBAUSdP
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/NoMercy 1.0.6 [Cracked]/NoMercy 1.0.6/ZTC1TJGBfr.exe unpack001/NoMercy 1.0.6 [Cracked]/Patcher/NoMercyPatcher.exe
Files
-
NoMercy 1.0.6 Cracked.zip.zip
-
NoMercy 1.0.6 [Cracked]/NoMercy 1.0.6/ZTC1TJGBfr.exe.exe windows:6 windows x64 arch:x64
c7159e19b3f8dcaeb8aca533374249c3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
FindNextFileW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursorPos
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
imm32
ImmReleaseContext
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertGetCertificateChain
ws2_32
ntohs
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
fmod
advapi32
GetUserNameA
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 816KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.0987ehz Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.0987ehz Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
NoMercy 1.0.6 [Cracked]/Patcher/NoMercyPatcher.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
�%B~+�� �5RFy�$"��#"��Cp3BH�B�\M�7#���m��r�-��Lxv�s}�x4�e�PYN��28��|��7�bژ� :��gz�R���0��*�&�;�\�7{ n�mG��w��,���N��R 찡M�{@�J*�m[V����Z�Ka�Ԯh3���X�Q�\<��%N��g�����x�#l��X�����6�,����`�`�ם�^�x�Ї�E�������1S,1NlXez��>�O��� ��G�>�. � �^������1�j~H��~��;9�"8���{w�/��� >z��8\х����������_zyʤm�FN��;�j�����j'旡��H��ϻq�K*�q���}�q֮�)��� ��̈j8�9�'iô� ����,�s��t���z�z����4F�8N�t�o��F܂�NL/c�H�A z 9�HZ��qpR��0��j��Ivm�E���Un� �47Z6�w��������^ֹ�h���S�ZL�N_w\Z+�X�/��ә �a@,���������V����Ix?F^�G����_�j�����J=�~�;� B���Zr��@�iڱ�����hk��u=iNʭ�I�\�� �H#�\�Z�2��� 69�d}@X�@�� J ��~���q���d���)����i�^���1 �Չ��hb���̠�R���ym7��p�i�N������^�*���e�M4��xu�p4����"Ѐ]#���d�a�ȤCfʲ�����C��f���lڞ ��?��q0�f��fLC�Ž��a��3�Fb��e�I/�`��� �rۈ;ߋ�Ml}6n�aV��t���躬��i_o]n������{3��tՊ�k1@Hp�;�4w�ne{�����en��.�a�4����&�o��]�2Yow�,]���5諏\�"s���F ��e�0}�����^A�"�"IUHq�I���bm-����������ה�Sv�7���?K#Cf�� ������^�cۧ�r1vG.!<I��Wg�ڦ�T�Z-_�W���"�-��(��Mk^.zk]g¿���D,)�mg�D���X3֢ƍ 6�����,)��{�<}aw�"}f:k�بdT��T2؝�o4TɩWo�'�����IH�j�g$���R�X���.7���v�6���X����X�&��_�ї>Kbc�wb[����*�ͳ�l�����WM]G���r�g��̋��+l�*4E{ϰ�W%S���O�<pJT��U�W��.;G3�b��V��/�%Α������CdS�ɡM�G�z�L����P��a����} 4���eUP,AεWou��}�L����{�I s�9��ϕ��2�Mb=ٮ^�㦞��^�a����3��Qk\�iWA�3c�j��F�6:*߿� �����F���������,�R'�zYQ��� ߋ R=���a{5�i?�3E�l�����{��4�衩�.�nE��cY��h��}�m�&�����`��ı,"�)�� ��GĢ̸B�O˫� �u��~'���g&�g�x��`�^��,��v�,VD[�V'Ō�s�Ĥ�9��A =�����c��-�7A�C�RH����D�A�:����'{u��+}$)-p f��`躠�Zt�����;)k4��r��[�U;��D'��luP$� �kf���u�����[���˪�l^����i�!�fl-����'Yeڱ�̃Y��]��m�Gy���*ʎ�g(���9��lxe�̸;УZ=��b��q�c��R`I�MJ>]z�4��D�O�-�bG?�[�!�f?6P8R���Ё��}j:Q��,��� ƍ#�Wđ�Vp��U�D4�9��?� ���v� ���|�Վ�'Đ\[��]�O-V�'�AW����R���Y��4��dƓ���C�LƌI;H��>�qU͍,)3�3�WG�8zKFyq ?l5�K�#lW��'Q0�AN �uX� FI� �|��[A�ٛ�����+����l�3M�P�����G��!��-��0� ���¦=4�Ɋ��k����^�����NS��{�>������ʤ��0��6���7�s)�+%�P��� ��歖�!�V� �D�6�/�U�^�NTC��bI�Ep-!8�����N9����J}WX+k=��>���NA�)x��y��(�K� q+�?"��;^7�?~�����Ck����Z���#�B�g�N�5p��D�4k�߈�-(YS"p�|�#�,��y���g� &�0S�H��Z��Z�p��[��{S�7�kX�ȗ�����(����J�cGض�&����P��|R����ӫ�90P�Ϸu�pQ�8����m��k��Z�rJ���#k�~o��G��}O��:"c-��p�1%��ٲ�_��������/X��.�*%75��O�Mdd���u�I� �9=F�Z��>�|��`i��,�c�α��5�*<m�O�� ���5��4ֽ"���Z���t��m 'm�mW��Ο�?t���z�n�L]�R �v��"�>�WA� �&7 =(�|~�ne3r D��TI���r��H�Fc�f��T]���-.9E�vY����Ǥ ���)�"���_��dA�b�b�Q�p��T^hU@��X��s�� ��@��+{�x�n��f�gT'L�LF ���}���j�t��C�x��K!0N��Bu��<T ��C��+)�X��υU$9���]�,x��h�ĻdO|X�l��s�1-��%���I���l3���ߣyp+����C��X���|�Ɠ6�f�45�WV�7�q9`A:)�����}��V����L<�s���H���T�����+y��|��CSi1�xެ��;<<�F�% �Ė�����AL2!aQ�F���c�i�S>���� ��i�Q��?�o�fi}�!�l�s`�ڄ0dmį#,�lK�y����ee��jr�E��@_�F:�w�ޥ���Bvϸ��gށN��?�7�G� �h�u ��!#���F壥w�&�G�B�z�c����!M����ǡR_9��t����ҕ��̰F���_�b���y�Dn*-Y�G��R�玫 �1�]��`�yܑ��4�����);��Aq*�.�'l��k�]1�Y�[�p�^t�|��xj��H�M�[��2�^�z��ᖈ30i�Cf��$��_����wǾ��9L����`�z�6V��������N;�ק��!P����� \�����b����x3*1����j�FE��ie��Nb�l��}.�{��?���E����\�Hm�R�P�q�P,�y�����B�cq621N"��32y���'(`v�$�f�� �>��%��J֢ Xs��}�������H ���|�5���YG �z�v� o.��ڲ�C� t�4ð�BȢ���k��R���pk�&���q�ț?dkq����6��M��k�ҷ��!�uv����m�AoZ�� E8�ߊ�xK�W�+" ��ڜ�]����S�2��Vm^iͱ'r!�nmsHI���L��n?�����PK7L��i��՝Z���0)����:�V��N������wi����u�2�����E�^z�[��1(U�U
Sections
Size: - Virtual size: 640KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 356KB - Virtual size: 432KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 126KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 11.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
NoMercy 1.0.6 [Cracked]/README.txt