Madoka.exe

2022-12-29T22:39:04Z

Whc2001: Add dialogue image and rough translation

{{#seo:
|keywords="Madoka.exe, Madoka.exe application, Madoka virus, Madoka.exe screamer, Sadako virus, Madoka screamer, Madoka malware, Madoka screamer, Madoka screamer, Madoka.exe download"
}}
{{Deleted}}
{{Infobox
|title = Madoka
|image = Madoka.png
|maker = Qiwen Lin
|type = Application
|date = 2001
|imagecaption = The '''Madoka.exe''' icon.
}}
'''Madoka.exe''', also known as the '''Ghost virus''' or the '''Sadako virus''' in Japan, was a Taiwanese [[screamer]] program, which is a variant of the Win32/FlaGhost Malware. The original author is Qiwen Lin (林啟文) and it's written in Hot Soup Processor programming language.

== Payload ==
When the user runs the malware by executing the EXE directly, a picture of a Japanese woman in full screen is displayed followed by a "introduce dialogue" text in the upper-left corner of the screen. However, a ghost version of the woman in the image will appear briefly along with a scream sound effect, before immediately returning to the original image.

Before showing the initial payload, the malware will copy itself to Windows directory as ''ozawa.exe'' and try to append itself to ''win.ini'' in order to auto start with the OS. Judging from the decompiled source code, this only works on Win98/ME. On XP or higher, there is no ''Run'' section in ''win.ini'' and the malware would not work apart from the initial payload.

If the malware is launched from the system directory with ''ozawa.exe'' as the name (either from auto start or double click manually in system directory), it will enter "reside mode" without showing the initial payload with the normal woman picture. Instead, it runs in background. It will then show the screamer image along with the scream sound effect indefinitely in the following interval: 3 minutes, 10 minutes, 30 minutes, 60 minutes, 60 minutes, 60 minutes ...

If the user executes the original EXE once again after infection, the normal woman picture and a " meet-again dialogue" text will be shown and there is no screamer picture.

The program also records the number of executions of the original EXE (not the one in system directory) in ''win.ini''. If it is run over 5 times, the malware will show the "bye dialogue" with the normal woman picture, then uninstall itself.

== Dialogue ==
<tabber>
Introduce Dialogue=

[[File:Madoka mess1.bmp|thumb]]

Are you looking at me?

You can get closer...

And look into my eyes...

What can you see in my eyes?

'''<Screamer>'''

Ah, sorry for scaring you.

I'm gonna tell you a secret...

I've already dwelled in your computer...

Beware that I may appear anytime!

Hehehe...

|-|Meet-again Dialogue=

[[File:Madoka mess2.bmp|thumb]]

Why it's you again?

I've already living in your computer...

Could you please stop bothering me?

|-|Bye Dialogue=

[[File:Madoka mess3.bmp|thumb]]

You are so annoying!

I'm not gonna living in your computer anymore...

Bye...

</tabber>

== Trivia ==

* The original EXE accepts arguments. The accepted arguments are shown below:
** '''/inst''': Install to system directory silently, without the initial payload.
** '''/unst''': Uninstall the installation
** '''/ver''': Show an about dialog message box with version
* According to the decompiled source code, holding down F10 when double clicking the original EXE will cause the malware to decompile itself and unpack all the assets and codes. However, this behavior is tested not working on a WinXP virtual machine.

==Link==
NOTE: The following application contains a [[screamer]]!
*web.archive.org/web/20041106190224/geocities.co.jp/SiliconValley-Oakland/8358/mysoft/files/madoka08.zip
 
{{Maliciousnav}}
[[Category:Applications]]
[[Category:Other scary images]]
[[Category:Japan]]
[[Category:Other makers]]
[[Category:2001]]
[[Category:Joke_screamers]]
[[Category:Malicious_scripts]]
{{Comments}}

File:Madoka mess3.bmp

2022-12-29T22:36:35Z

Whc2001:

File:Madoka mess2.bmp

2022-12-29T22:35:40Z

Whc2001:

File:Madoka mess1.bmp

2022-12-29T22:32:07Z

Whc2001:

Madoka.exe

2022-12-29T22:27:28Z

Whc2001: Add author name to the sidebox

{{#seo:
|keywords="Madoka.exe, Madoka.exe application, Madoka virus, Madoka.exe screamer, Sadako virus, Madoka screamer, Madoka malware, Madoka screamer, Madoka screamer, Madoka.exe download"
}}
{{Deleted}}
{{Infobox
|title = Madoka
|image = Madoka.png
|maker = Qiwen Lin
|type = Application
|date = 2001
|imagecaption = The '''Madoka.exe''' icon.
}}
'''Madoka.exe''', also known as the '''Ghost virus''' or the '''Sadako virus''' in Japan, was a Taiwanese [[screamer]] program, which is a variant of the Win32/FlaGhost Malware. The original author is Qiwen Lin (林啟文) and it's written in Hot Soup Processor programming language.

== Payload ==
When the user runs the malware by executing the EXE directly, a picture of a Japanese woman in full screen is displayed followed by a "introduce dialogue" text in the upper-left corner of the screen. However, a ghost version of the woman in the image will appear briefly along with a scream sound effect, before immediately returning to the original image.

Before showing the initial payload, the malware will copy itself to Windows directory as ''ozawa.exe'' and try to append itself to ''win.ini'' in order to auto start with the OS. Judging from the decompiled source code, this only works on Win98/ME. On XP or higher, there is no ''Run'' section in ''win.ini'' and the malware would not work apart from the initial payload.

If the malware is launched from the system directory with ''ozawa.exe'' as the name (either from auto start or double click manually in system directory), it will enter "reside mode" without showing the initial payload with the normal woman picture. Instead, it runs in background. It will then show the screamer image along with the scream sound effect indefinitely in the following interval: 3 minutes, 10 minutes, 30 minutes, 60 minutes, 60 minutes, 60 minutes ...

If the user executes the original EXE once again after infection, the normal woman picture and a "meet-again dialogue" text will be shown and there is no screamer picture.

The program also records the number of executions of the original EXE (not the one in system directory) in ''win.ini''. If it is run over 5 times, the malware will show the "bye dialogue" with the normal woman picture, then uninstall itself.

== Dialogue ==

== Trivia ==

* The original EXE accepts arguments. The accepted arguments are shown below:
** '''/inst''': Install to system directory silently, without the initial payload.
** '''/unst''': Uninstall the installation
** '''/ver''': Show an about dialog message box with version
* According to the decompiled source code, holding down F10 when double clicking the original EXE will cause the malware to decompile itself and unpack all the assets and codes. However, this behavior is tested not working on a WinXP virtual machine.

==Link==
NOTE: The following application contains a [[screamer]]!
*web.archive.org/web/20041106190224/geocities.co.jp/SiliconValley-Oakland/8358/mysoft/files/madoka08.zip
 
{{Maliciousnav}}
[[Category:Applications]]
[[Category:Other scary images]]
[[Category:Japan]]
[[Category:Other makers]]
[[Category:2001]]
[[Category:Joke_screamers]]
[[Category:Malicious_scripts]]
{{Comments}}