C:\Users\LLAMA\source\repos\VeilUI\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
Overview
overview
7Static
static
7RedBoy 3.9....3.dll
windows7-x64
1RedBoy 3.9....3.dll
windows10-2004-x64
1RedBoy 3.9...ox.dll
windows7-x64
1RedBoy 3.9...ox.dll
windows10-2004-x64
1RedBoy 3.9...UI.dll
windows7-x64
1RedBoy 3.9...UI.dll
windows10-2004-x64
1RedBoy 3.9...oy.dll
windows7-x64
7RedBoy 3.9...oy.dll
windows10-2004-x64
7RedBoy 3.9...oy.exe
windows7-x64
3RedBoy 3.9...oy.exe
windows10-2004-x64
3RedBoy 3.9.2/Teen.dll
windows7-x64
1RedBoy 3.9.2/Teen.dll
windows10-2004-x64
1Behavioral task
behavioral1
Sample
RedBoy 3.9.2/Bunifu_UI_v1.5.3.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RedBoy 3.9.2/Bunifu_UI_v1.5.3.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral3
Sample
RedBoy 3.9.2/FastColoredTextBox.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
RedBoy 3.9.2/FastColoredTextBox.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
RedBoy 3.9.2/FlatUI.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
RedBoy 3.9.2/FlatUI.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
RedBoy 3.9.2/RedBoy.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
RedBoy 3.9.2/RedBoy.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
RedBoy 3.9.2/RedBoy.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
RedBoy 3.9.2/RedBoy.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
RedBoy 3.9.2/Teen.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
RedBoy 3.9.2/Teen.dll
Resource
win10v2004-20240802-en
General
-
Target
ef2f393076d12c96241e3dfc583b82b3_JaffaCakes118
-
Size
2.4MB
-
MD5
ef2f393076d12c96241e3dfc583b82b3
-
SHA1
624037d6373deb2907b232535ad2e950e7793f32
-
SHA256
f02508814980dde5a47f9e48a2d473b32e4eb75f8f444ae588672337d9b7fc71
-
SHA512
d9b1f700e236085d0fc4b2da66968a0338964a0b613fe6aa9cd49c450ecc1638ca92f3539e57552119a657fb01e6b41952eb5d5281caad24d22441073c5d7bba
-
SSDEEP
49152:rwPbxie6n/N/z+osyxB1xKhvbFsY1erV8vePWnczCXTpwqnw8Oby/ui9as3tYI5k:rKxivn/hNsy71gDFsVVjzCXTpdwdenwR
Malware Config
Signatures
-
resource yara_rule static1/unpack001/RedBoy 3.9.2/RedBoy.dll vmprotect -
Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/RedBoy 3.9.2/Bunifu_UI_v1.5.3.dll unpack001/RedBoy 3.9.2/FastColoredTextBox.dll unpack001/RedBoy 3.9.2/FlatUI.dll unpack001/RedBoy 3.9.2/RedBoy.dll unpack001/RedBoy 3.9.2/RedBoy.exe unpack001/RedBoy 3.9.2/Teen.dll
Files
-
ef2f393076d12c96241e3dfc583b82b3_JaffaCakes118.rar
-
RedBoy 3.9.2/Bunifu_UI_v1.5.3.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 320KB - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
RedBoy 3.9.2/FastColoredTextBox.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 320KB - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
RedBoy 3.9.2/FlatUI.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\Users\Aero\Desktop\FlatUI-master\src\FlatUI\obj\Debug\FlatUI.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
RedBoy 3.9.2/RedBoy.dll.dll windows:6 windows x86 arch:x86
1981aba9949f6c52b94c13c5b03df2ee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleFileNameA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SendInput
CharUpperBuffW
msvcp140
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
wininet
InternetOpenA
vcruntime140
__std_type_info_destroy_list
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-math-l1-1-0
_CIcosh
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
Œv�T6�p2vg�������W����N�����L��9�*�c�B����4R����J4��~Fb��yg���%K�Z>\���C]�דGbq��@jS��J"nNc��x��SQ{Z��_�MF�U��d������j�!{��aU��^M�n.13�����&H��C���}��59|%�}|���&eo��,q���$LmQN�����2p/s�r��=�Kֲ�W��M���������9��@G��?�2MA� �5"�X+Į���(��>��yt���� V0�&?�8UJe"L�F~���_e�Lޑ�n�����A^�F�}��q;z[^`A�^����b�qy�6����$���UDh��_C�Ѫ{����mC����GVf�N���xBr��+G4,����pX�#�����ɘG-�eq�m�<�Je���:�壃�Uo�����'%��I�"QƎ�jv�(��9���i��1G��y��`�o����kŁ�<=�wC'��">�������~��>�&��RS蝟�o֗�M~sMO�t6�j_z���L��t���x ��I&m}PS�yF�<�W�;<c���lr�<���1�>N�A�X4;'�'&��t����n}}w����ŘG�bH��x���"_-�W��g��G �v;4d�����u3?���?0Fϴ���Zs�2 �\��v�@"V�� �����o:��0-��b�e�R��R������a��)UL��'�u�5+������B?�>�?�/���{ĥ���P�^;oa�%M�ʙ�m-\�~ h���K<bv���\��8��3�����g����?Y>M�� B� �?Ʈ�EF��ͯ��QYՐ�vz[�܆�T��lm7����5yxg >a)쇦ۑ�]̘���es��о�呭J��N!�������JU������DA�V�4 �CAɍP�������m��$moS������Qc�#�&���LR+�i��R��Σ3�>Y���dѼb�U�#��{���(䮽MuM��N.�����sc�4�.��ϫ��E�1�$�2B�x��&�@�h��-I���¿���d>��P�.�bd���Q�@]kEb�\��d�/������g� ����:��<ϑ��F �$%G �����<A��_�N�����W4t8�h���R���`{v���^1�Ɍ�M;�����Q{1����>����po��� U�`��L��CΨtһ�>F�x����Cջ�K[+{� ~��JmM�֚��F\I�&��\�'�i��d�q�5a�n}�W�1������/�s�-�s�C��&d�ɲ"��tYD����&I�gP���� L猄= �noh�pf�_�����3�?�p)�ctj����y�r�{�!�W���J:$�\5�{.�9K˲��6-������`�ni�E�O!�`����l#]c��}����k�NXh��]��o?�e�ik&�8PJK��jM}wsN�=�� x uZ���gFu���߃����(i8A�~�V>��ZqA�jQ!��A�}�D$(�3U5o���\x�<{WHD��wy�J#X�"�� ���c�@���i��ߕ�5���a7�.�4r�͢M�b�lb�j����:I�Db�iNaT��>�Б��/as��Ǹ�/��^b�i����,�k��5�����g_ XhW�@�n��i������aN�j^m�O��bJ����z��@CX�#r��R�5�����fr�����D�Tʳl!I�V��I㑡:� �Z�:�L��Q�]�I��[��Gbv��Å|7�3�!�xC�|2���&r�XV��3�i3mH�� Öi,*A��xP��)t@ "�����l+'�ۗ/+D��,�7,��y����@��D�5�>͂%oW|��x�)��� �6������3ҭ�6�W{��Q���,��K1.�rs��wvZ�R'zZ�<��M��W!a�Z�Շ��R�7$�s�^ӵ��xK6��?jrs�JD�����V> l��c��-�����&vO�����f�����/~{��'X���Y������Ğ��)aP�c� %̺j8WA�.���UEtC���7�n��&W��xY�Ћ2�٪\��`D���&��k���8m�ȏ6��7�M,ǿY�se��G��Tv7|�&��a�eִ��d�9���K)�o������@��q�����JY���y&�J� �1�)�Fs����s�ȉ�ت��F� ~�Bu�+� >TY���Ƀ<~�J�\я��bq}��K������e�+�'������,�F�y�\Є�ڵ��n9���!������U�Rq��W���Ne�ȍs�]��kש�TH�9��iӖ@�L7�ӑ����>(�CĕYb�>�u������&�'��Qk���9��j T�S�s���S��P�G�bS�=��~::좱�$p~0.�kIƨQ���� ,]��|�Nmp@�����⋔��6N�����p~9��_���IێFDh�=�=����`_��h����f2�v��[g� I(���L��?Z�ܡ7�ER�2R����'�XHp��_����# i*�O��R&#���xv���F~-���t�<>���@�I��rkp#��V�;(zZ���/(�議 舵ܜ�4�s�9�! M�({��[�����ة����Q?���<DC�1���,�f6�;������Q#k���_�:�y�;���̢ʳ�D �e�W7���d�\\ �����^;|���Zw ��B�lTq���% n|����\)�U��4V�W��עv(��9�v�I�l���i�~���^ݹp��:V��o��J��[����u�o"IZ���Z�n���B�u��p��O��W���`ھ��w�IIߴ�%�Љ������o����Z�t�_@4�KR�?�͂�͎�l�S����ҥg��{��5F���F_&����c�:��1̅{�垕vЮm����䒵,0O� �J*X ����/�yy\(NEb_[�Uٌ@_9�4��9R"��I��&b'r�(S�bWf���AoR��L1V6��ޝ��LQ�N�H�4Qz$�6�����4��^����
Sections
.text Size: - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
RedBoy 3.9.2/RedBoy.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
C:\Users\HP User\Desktop\RedBoy UI\RedBoy\obj\Debug\RedBoy.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 991KB - Virtual size: 991KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
RedBoy 3.9.2/RedBoy_obfuscation_log.txt
-
RedBoy 3.9.2/Teen.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
c:\users\one eyed inspiration\documents\visual studio 2017\Projects\Teen\Teen\obj\Debug\Teen.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
RedBoy 3.9.2/autoexec/ReadMe.txt
-
RedBoy 3.9.2/autoexec/init.txt