DiskDefragPro[.]exe

Resubmissions

05/07/2026, 21:31

260705-1c8tqsfy3w

05/07/2026, 21:30

260705-1cwjeafy3t3

Sharing

Copy URL Twitter E-mail

General

Target
DiskDefragPro.exe
Size 2.3MB
Sample260705-1c8tqsfy3w
SHA256 555a571610be6b881aae4793f5518dabed019e27e574d1aa2b6ee5802f6e232a
MD5 fb8e1a5c9351361e3648badea105e7a6
SHA1 cc798323c53e1b547d00c140809e89db7b84b42c
SHA512 80e49b83c32bc1f98231b01114d8c4e0e062692e53d7b14f3b591eaf20cd70f646320194a6107395b49d59acd40223a27bd95836ade8f10c308c5fd48cedaed8
SSDEEP 49152:ewY/PxsiZoCd8CbzNLsEvk8rW3hbe6pm0khxvD3yxWr7CYu3WunXQM8WV:a5B68rgSxvD3yxWr7CYum
TLSH
T1BBB5AF4AA7F401E8C577D17CCA56960BE7713408033097EB27F48AA62F53BE16B7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DiskDefragPro.exe

File Explorer

DiskDefragPro.exe

.exe 2.3MB

DiskDefragPro.exe

IMPHASH fc9cc036e92bf0e388bb039f9ceb7aec
SHA256 555a571610be6b881aae4793f5518dabed019e27e574d1aa2b6ee5802f6e232a
MD5 fb8e1a5c9351361e3648badea105e7a6
SHA1 cc798323c53e1b547d00c140809e89db7b84b42c
SHA512 80e49b83c32bc1f98231b01114d8c4e0e062692e53d7b14f3b591eaf20cd70f646320194a6107395b49d59acd40223a27bd95836ade8f10c308c5fd48cedaed8
SSDEEP 49152:ewY/PxsiZoCd8CbzNLsEvk8rW3hbe6pm0khxvD3yxWr7CYu3WunXQM8WV:a5B68rgSxvD3yxWr7CYum
TLSH
T1BBB5AF4AA7F401E8C577D17CCA56960BE7713408033097EB27F48AA62F53BE16B7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1849996

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpQueryHeaders WinHttpAddRequestHeaders

kernel32

GetTickCount VirtualQuery IsDebuggerPresent CheckRemoteDebuggerPresent SetThreadAffinityMask SetThreadPriority SwitchToThread GetProcessId DuplicateHandle OpenProcess GetSystemInfo HeapAlloc ReadFile GetFileSizeEx CreateFileA GetModuleHandleW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree GetSystemDirectoryW LoadLibraryW SleepEx MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW WakeAllConditionVariable SleepConditionVariableSRW FreeConsole RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead ReleaseSRWLockShared AcquireSRWLockShared FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CloseHandle Process32Next GetCurrentThread GetLastError GetConsoleMode Sleep CreateToolhelp32Snapshot GetCurrentThreadId Module32First CreateMutexA Module32Next GetModuleFileNameW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx OutputDebugStringW GetConsoleWindow GetCurrentProcessId FlushConsoleInputBuffer TerminateProcess VirtualAlloc SetConsoleMode GetStdHandle GetCurrentProcess GetThreadContext VirtualFree SetConsoleTextAttribute GetConsoleScreenBufferInfo Process32First VirtualQueryEx ReadProcessMemory VirtualProtectEx GetTickCount64 WriteProcessMemory VirtualProtect GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleHandleA HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA CreateFileW InitializeCriticalSectionEx DeleteCriticalSection RtlCaptureContext

user32

RegisterClassExW UnregisterClassW FindWindowA ShowWindow GetAsyncKeyState PostQuitMessage GetSystemMetrics UpdateWindow CreateWindowExW SetWindowPos DestroyWindow OpenClipboard GetWindowRect DispatchMessageA DefWindowProcW SetWindowLongA SetWindowDisplayAffinity GetMonitorInfoA TrackMouseEvent CloseClipboard GetWindowLongA GetKeyboardLayout GetForegroundWindow SetCapture SetCursor MoveWindow SetLayeredWindowAttributes BringWindowToTop TranslateMessage GetClientRect ScreenToClient IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC MonitorFromWindow GetCursorPos GetCapture GetDC LoadCursorA ClientToScreen GetMessageExtraInfo SetWindowTextW EmptyClipboard SendInput GetWindowTextA GetClipboardData mouse_event SetClipboardData ShowCursor GetWindowThreadProcessId GetKeyState PeekMessageA

gdi32

GetDeviceCaps

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW

shell32

ShellExecuteA

d3dcompiler_43

D3DCompile

vmprotectsdk64

VMProtectIsValidImageCRC VMProtectEnd VMProtectIsDebuggerPresent VMProtectFreeString VMProtectDecryptStringA VMProtectBeginVirtualizationLockByKey VMProtectBeginMutation VMProtectBeginUltraLockByKey

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

msvcp140

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z _Thrd_id _Thrd_join _Cnd_broadcast ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z _Xtime_get_ticks ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Syserror_map@std@@YAPEBDH@Z ?_Random_device@std@@YAIXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_counter _Query_perf_frequency ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ _Mtx_unlock _Thrd_detach _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ _Cnd_do_broadcast_at_thread_exit

winmm

timeGetTime timeBeginPeriod

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CertEnumCertificatesInStore CertFreeCertificateContext CertOpenStore CertCloseStore CryptStringToBinaryW CertFindCertificateInStore

ws2_32

WSAGetLastError inet_pton ntohs WSASetLastError WSAEventSelect WSAEnumNetworkEvents send getsockopt closesocket inet_ntop bind connect getpeername getsockname htons recv setsockopt socket gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept select __WSAFDIsSet WSAIoctl WSACreateEvent WSACloseEvent

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp __current_exception __std_terminate wcschr strstr _CxxThrowException strchr memcmp memchr __std_exception_destroy __std_exception_copy memset __current_exception_context memmove memcpy longjmp strrchr wcsrchr __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

_set_fmode fwrite _wfopen __stdio_common_vsprintf _wopen fread __stdio_common_vsscanf fputs __p__commode fseek _read _write _fileno _close fclose fgets fflush __acrt_iob_func feof __stdio_common_vfprintf __stdio_common_vsprintf_s ftell fputc _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos _lseeki64 fgetc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

wcsncpy isspace _wcsicmp _stricmp isdigit strcpy_s strcmp tolower strncpy strpbrk wcsncmp _strdup strcspn strncmp wcspbrk strspn

api-ms-win-crt-heap-l1-1-0

calloc realloc free malloc _callnewh _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtoll strtoull strtoul strtod wcstombs atoi atof strtol

api-ms-win-crt-runtime-l1-1-0

_errno abort terminate _invalid_parameter_noinfo_noreturn _beginthreadex __sys_errlist __sys_nerr exit _invoke_watson _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc system _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-time-l1-1-0

strftime _time64 _localtime64_s _gmtime64_s _gmtime64

api-ms-win-crt-math-l1-1-0

pow sqrtf sin _dsign sinf _fdopen powf ldexp _dclass _fdclass acosf atan2f ceilf cos cosf fmodf __setusermatherr sqrt logf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _unlock_file _lock_file _fstat64 _unlink

api-ms-win-crt-environment-l1-1-0

_dupenv_s