Multi-License Discount Quote

Change Region

English
Threat Database Trojans Trojan.Badjoke

Trojan.Badjoke

By CagedTech in Trojans

Threat Scorecard

Popularity Rank: 1,753
Threat Level: 10 % (Normal)
Infected Computers: 4,942
First Seen: April 5, 2012
Last Seen: January 26, 2026
OS(es) Affected: Windows

SpyHunter Detects & Remove Trojan.Badjoke

File System Details

Trojan.Badjoke may create the following file(s):
Expand All | Collapse All
# File Name MD5 Detections
1. VS Revo Group---Virus Boss!!!!!!!.vbs d68479c58d8ff342d3721bdffe8a0220 183
2. friend.exe b2b63a8ce53e18f9dc70bbccf42ede83 10

Analysis Report

General information

Family Name: PUP.Badjoke
Signature status: No Signature

Known Samples

MD5: ae1aa2de6b8be19775f356e78349c0c7
SHA1: ca8c0565373312867cec2f2f6650d2708c03499b
File Size: 64.00 KB, 64000 bytes
MD5: 8db2bc4ed355239adc629409ee80a156
SHA1: 1ee48acf095fad37b022fe16b95cb17e42fd557f
File Size: 419.84 KB, 419840 bytes
MD5: 0a137e56a8ff25fd0cef22d970142d82
SHA1: 2fca749ff8f9d57c56e0873c9ee788c6cacd3323
SHA256: 5F93BF831407B99E8D5F7CDECACB3E729CCB951FC6220B4D9D884A58B8CA856A
File Size: 153.09 KB, 153088 bytes
MD5: 6931cf934847b2f341fc34e36cd7bf9f
SHA1: 3b48f80706b63b5e102bef92822158af8e4c2a86
SHA256: E32E8C77D5191005B03AAC3918A7A46569F6278FE1CDF8DC4BAD6F4E90FFFF01
File Size: 4.54 MB, 4535135 bytes
MD5: 0b02384d96a7d1aa046618bad40c0a69
SHA1: fb2d41f057215c52530c23dce863c08c1027c334
SHA256: 00D0AA34A4F90864B05F340A27808AF18E9CDE73108F866A902D1915A72430EB
File Size: 267.26 KB, 267264 bytes
Show More
MD5: d4163d85ba71a09b181dea459744698c
SHA1: 002efbdaf3b87a486cd1b577b219a36995a66489
SHA256: 1FD51D6DD83F903B81C2FE5EE5811A32F4EEDDAE97B02C89659E6F0E7DA16B1E
File Size: 613.38 KB, 613376 bytes
MD5: 8ed8f5c96b0a178fb2c5855729f2af0e
SHA1: a2c368f0145546d7991079b71f189435d301d80c
SHA256: D3029297E1B684901D7C7A82A5A80B24B7867CC9CD27F2D5F5E090C2E41CF661
File Size: 552.96 KB, 552960 bytes
MD5: e4a61690469507d6da1496c231acc055
SHA1: 42921c9d12286d95594de1c17a60006d6b4f5895
SHA256: 0C16FB3F6EBAEF29004AE74F333774C739CD7BAD324ECD3459945693FBE01AAE
File Size: 1.62 MB, 1624064 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File has been packed
  • File has exports table
  • File has TLS information
  • File is .NET application
  • File is 32-bit executable
Show More
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name Value
Assembly Version
  • 1.0.8.0
  • 1.0.0.0
Command Line -p "[path]" -t "[file types]" -f "[find what]" -i include subdirs -c case sensitive search.exe -p "c:\windows" -t "*.htm" -f "Microsoft" -c -i
Comments
  • AutoRun Wizard is a product of RJL Software, Inc.
  • For more FREE software visit our website.
  • For more FREE useful software visit our website.
  • Made by malwareman https://www.youtube.com/channel/UCk8Gj-r2kQdCkleLtKWz7rQ
Company Name
  • MALWAREMAN
  • ResidentEvil4Re
  • RJL Software, Inc.
  • RJL Software, Inc.
Email support@rjlsoftware.com
File Description
  • Configures an AutoRun for Windows CD-ROMs
  • Displays your installed Windows Product Key
  • Maltoolkit
  • ResidentEvil4Re
  • Setup Launcher
  • Simple file search and replace utility
File Version
  • 2018.2.21.10560245
  • 3.01.0000
  • 2.0.1.0
  • 2.0.0.0
  • 1.0.8.0
  • 1.0.6.0
  • 1.0.0.0
Internal Name
  • autorun
  • Maltoolkit.exe
  • ResidentEvil4Re.exe
  • Simple Search and Replace
  • Windows Product Key Viewer
Legal Copyright
  • 749
  • chenstack
  • Copyright 2002-2004, RJL Software, Inc.
  • Copyright 2002-2007, RJL Software, Inc.
  • Copyright 2005-2025, RJL Software, Inc.
  • Copyright © MALWAREMAN
Legal Trademarks
  • None
  • None.
Original Filename
  • autorun.exe
  • Maltoolkit.exe
  • ResidentEvil4Re.exe
  • search.exe
  • winproductkey.exe
Product Name
  • AutoRun Wizard
  • Maltoolkit
  • Net Send Lite
  • ResidentEvil4Re
  • Simple Search and Replace
  • Windows Product Key Viewer
Product Version
  • 2018.2.21.10560245
  • 3.01.0000
  • 2.0.1.0
  • 2.0.0.0
  • 1.0.8.0
  • 1.0.6.0
  • 1.0.0.0
Unity Version 2018.2.21f1_a122f5dc316d
Website
  • www.rjlsoftware.com
  • www.rjlsoftware.com www.AutorunWizard.com

File Traits

  • .adata
  • .aspack
  • .NET
  • Agile.net
  • ASPack v2.12
  • big overlay
  • CreateThread
  • Fody
  • HighEntropy
  • Installer Manifest
Show More
  • Installer Version
  • No Version Info
  • packed
  • VirtualQueryEx
  • WriteProcessMemory
  • x64
  • x86

Block Information

Total Blocks: 6,238
Potentially Malicious Blocks: 29
Whitelisted Blocks: 5,026
Unknown Blocks: 1,183

Visual Map

0 0 0 0 ? ? ? ? ? ? ? ? ? ? x ? 0 x ? ? x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 0 ? 0 0 0 0 ? ? 0 ? ? ? ? 0 0 ? 0 0 0 0 0 0 0 0 0 ? 0 ? ? 0 ? ? ? ? ? ? ? 0 ? ? 0 ? ? ? ? ? 0 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 0 0 0 ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? 0 0 0 ? 0 0 ? 0 ? ? ? ? 0 0 0 0 0 ? 0 ? 0 ? ? ? ? ? 0 0 0 0 ? 0 0 0 ? 0 0 0 0 ? 0 0 0 0 ? 0 0 0 0 ? ? ? ? ? 0 ? ? ? ? 0 ? ? ? 0 0 0 0 ? 0 ? 0 ? 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 ? ? ? ? 0 ? 0 ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? 0 0 0 0 0 ? 0 0 ? 0 ? ? ? ? ? ? ? ? ? ? 0 ? 0 0 ? ? 0 ? ? 0 0 ? 0 ? ? 0 ? ? ? ? ? 0 0 ? 0 ? 0 0 0 0 0 0 ? 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 0 0 0 0 ? 0 ? ? ? 0 ? 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? 0 0 ? ? ? ? 0 ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 ? 0 0 ? 0 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? 0 ? ? 0 0 ? 0 ? ? ? 0 0 ? 0 ? ? ? ? ? 0 ? ? ? 0 ? ? ? 0 ? 0 0 ? 0 0 ? ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? 0 ? ? 0 ? ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 ? ? 0 0 ? ? ? 0 ? 0 0 0 ? 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 ? ? 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? ? 0 ? ? ? 0 ? ? ? ? 0 ? ? 0 ? 0 ? ? ? ? 0 0 0 ? 0 ? 0 ? 0 x 0 0 ? 0 0 ? ? 0 0 0 0 ? ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 0 0 ? 0 ? ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? 0 0 ? ? ? ? ? ? ? ? ? 0 0 0 ? 0 ? 0 0 ? ? ? ? ? ? ? ? 0 ? ? 0 ? ? ? 0 ? ? ? ? 0 ? ? ? ? ? ? 0 0 0 0 ? 0 0 0 0 0 0 0 ? 0 0 0 0 ? 0 ? 0 0 0 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? 0 ? 0 0 ? ? ? 0 ? ? ? 0 ? ? ? 0 0 x 0 0 0 0 0 ? x 0 0 ? ? ? ? ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? 0 0 ? 0 ? ? 0 0 ? 0 0 ? 0 0 ? 0 ? ? ? ? ? ? 0 0 0 0 0 ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 0 0 0 0 0 ? 0 0 ? ? ? ? ? ? 0 ? ? ? ? 0 0 0 0 x 0 0 0 ? 0 ? 0 0 ? 0 0 0 ? 0 ? 0 ? ? 0 0 ? ? ? ? ? 0 ? ? ? ? ? 0 ? ? ? 0 ? 0 0 0 ? 0 0 0 0 0 0 ? 0 ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? ? 0 0 0 0 0 ? ? 0 0 0 0 ? 0 ? ? 0 0 0 ? ? ? 0 0 0 ? ? ? 0 ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? ? 0 0 0 0 0 0 ? ? ? 0 0 0 0 ? 0 ? ? 0 0 ? ? 0 0 ? ? ? 0 ? ? 0 ? ? ? ? ? ? ? 0 ? 0 ? ? ? ? ? 0 ? 0 ? ? ? ? 0 ? 0 ? 0 ? ? 0 0 ? 0 0 ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 ? ? 0 0 0 0 ? 0 0 0 ? ? 0 0 0 0 ? ? 0 0 ? ? ? ? ? ? ? ? 0 ? ? ? 0 0 ? ? ? 0 0 ? ? 0 ? ? ? ? ? ? ? 0 0 ? ? ? ? ? ? 0 ? ? 0 0 0 0 ? 0 0 ? ? ? ? 0 0 0 ? 0 ? 0 0 0 0 0 0 0 ? ? ? ? ? ? 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 ? 0 0 ? ? ? 0 0 0 0 ? ? ? 0 ? ? ? ? 0 0 0 0 0 ? 0 0 ? ? ? 0 ? 0 ? ? 0 0 ? 0 ? ? ? ? 0 0 0 0 ? 0 0 0 ? ? ? 0 0 ? ? 0 0 ? ? ? 0 0 0 0 ? 0 ? ? 0 ? 0 ? ? ? ? 0 0 ? ? ? 0 0 0 0 0 0 0 ? 0 0 0 0 ? ? ? ? 0 0 ? ? 0 0 ? 0 0 0 0 0 ? ? 0 ? x ? ? ? ? 0 0 0 0 ? ? ? ? x ? x ? ? ? ? ? ? ? ? x 0 0 0 0 0 0 0 ? ? ? ? 0 0 ? ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? x ? 0 ? ? ? ? ? ? 0 ? ? 0 ? 0 ? ? ? ? ? ? ? ? 0 0 ? ? ? ? ? ? 0 ? ? ? ? 0 0 0 ? ? ? ? ? 0 ? ? ? ? 0 0 ? ? ? ? ? ? ? ? 0 0 ? 0 ? ? ? ? ? ? 0 0 ? 0 0 0 0 0 0 0 0 ? 0 ? 0 ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? 0 ? ? 0 0 0 ? 0 0 ? ? 0 ? ? ? ? ? 0 0 ? ? ? ? 0 0 0 0 ? ? x ? ? ? ? ? ? 0 ? ? ? 0 0 ? ? ? ? ? ? 0 ? 0 0 ? ? ? 0 0 ? ? 0 ? ? ? ? ? ? 0 ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? 0 ? ? ? ? ? ? ? ? ? 0 ? 0 ? 0 ? ? 0 0 ? ? ? 0 0 ? 0 0 ? ? ? 0 ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? ? ? 0 ? ? ? 0 0 0 ? ? ? ? ? ? 0 0 0 0 0 0 0 0 ? ? ? 0 ? ? ? ? ? 0 0 0 ? 0 0 0 0 0 0 0 ? ? ? 0 ? ? 0 ? ? 0 ? ? 0 ? ? 0 ? ? 0 0 ? 0 0 ? ? 0 ? ? 0 ? ? ? 0 0 0 0 ? 0 ? ? 0 ? 0 0 ? 0 ? ? 0 ? ? ? 0 ? 0 ? 0 0 0 0 0 ? ? ? 0 ? 0 0 ? 0 0 0 ? ? 0 0 0 0 ? ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? 0 ? 0 ? ? 0 0 0 0 0 ? 0 0 0 ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? 0 0 ? 0 0 ? 0 0 0 0 0 0 ? 0 ? ? ? x 0 0 ? 0 0 ? ? ? 0 0 ? ? ? ? ? ? ? 0 0 0 0 ? 0 ? ? ? 0 ? 0 0 0 0 0 0 ? ? ? ? ? 0 ? 0 0 ? 0 ? ? 0 ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 0 0 ? 0 0 ? ? ? ? 0 ? ? 0 ?
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Bancos.B
  • Farfli.FR
  • Fugrafa.T
  • Injector.DFF
  • Injector.DGB
Show More
  • Injector.FGSA
  • Injector.FHE
  • Injector.GDSA
  • Injector.KKF
  • LegendMir.B
  • Shipup.AG
  • Sohanad.A

Files Modified

File Attributes
\device\namedpipe\gmdasllogger Generic Write,Read Attributes
c:\users\user\appdata\local\temp\_is74c1.tmp Synchronize,Write Attributes
c:\users\user\appdata\local\temp\_is74c1\0x0409.ini Generic Write,Read Attributes
c:\users\user\appdata\local\temp\_is74c1\_ismsidel.ini Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\_is74c1\net send lite.msi Generic Write,Read Attributes
c:\users\user\appdata\local\temp\_is74c1\setup.ini Generic Write,Read Attributes
c:\users\user\appdata\local\temp\_msi5166._is Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\~74b0.tmp Generic Write,Read Attributes
c:\windows\downloaded installations\{52df3883-6f28-4253-b39e-77338c33e13b}\net send lite.msi Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144

Windows API Usage

Category API
Anti Debug
  • IsDebuggerPresent
  • NtQuerySystemInformation
User Data Access
  • GetComputerName
  • GetComputerNameEx
  • GetUserDefaultLocaleName
  • GetUserName
  • GetUserObjectInformation
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Encryption Used
  • BCryptOpenAlgorithmProvider
Syscall Use
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcConnectPort
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreatePrivateNamespace
Show More
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcess
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationJobObject
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtResumeThread
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • UNKNOWN

Shell Command Execution

MSIEXEC.EXE /i "C:\WINDOWS\Downloaded Installations\{52DF3883-6F28-4253-B39E-77338C33E13B}\Net Send Lite.msi" SETUPEXEDIR="c:\users\user\downloads"

Related Posts

Trending

Most Viewed

Loading...