File scan report
Verdict Safe
Is SSDBooster.
None of the 72 antivirus engines that checked it flagged this SSD tuning utility, and the sandbox recorded no high-risk behaviour, though its signature has expired and its code…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Use this file only if you downloaded it from the developer's official site, and keep your antivirus protection enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 72 flagged
- Flagged 0
- No detection 72
- No result 4
- Code signing Signer not verified
- Test run Completed
- First seen 9mo ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
In the sandbox it ran a drive TRIM status query and showed no injection, persistence or high-risk techniques. Its signature has expired and its code is protected with .NET Reactor, so download it only from the developer's official site.
None of the 72 antivirus engines that checked it flagged the file, and all 18 major antivirus engines reported it clean. In the sandbox it launched only itself and a query of the drive's TRIM setting, which is expected for an SSD optimisation tool. No injected processes, persistence or high-risk techniques were recorded. A defence-tampering mapping appeared without any matching artefact, so it is not evidence. The signature claims Omid Soroori but failed verification because the certificate expired, so the publisher identity is unconfirmed. Community rules note .NET Reactor protection, which is common in commercial software.
What We Detected
None of the 72 antivirus engines that checked it flagged this file, and 18 major antivirus engines reported it clean. The file has been seen for about 265 days, from 34 distinct submitters. Its signature claims Omid Soroori but failed verification because the certificate expired.
Threat Behavior
In the sandbox, the program queried the drive's TRIM setting, which is consistent with an SSD tuning utility. No process injection, persistence or high-risk techniques were observed. No complete host-reputation check is available. Community YARA matches indicate .NET Reactor code protection. This obfuscator is used by legitimate developers and by attackers alike, and it does not identify any malware.
What To Do Now
The file can be used if it came from the developer's official source. Keep your antivirus enabled, and rescan any copy you obtained from a third-party site.
Where this verdict could be wrong2 caveats
- Community rule matches show the code is protected with .NET Reactor JIT encryption, which hides the program logic from static inspection and is also used by threat actors.
- The code-signing certificate is expired, so the publisher identity cannot be confirmed.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 72 antivirus engines that checked it flagged the file, including every major antivirus engine.
- The sandbox observed no injection, persistence or high-risk techniques.
- Its sandbox activity, a drive TRIM status query, matches its stated purpose.
- The file has been seen from dozens of submitters over roughly nine months.
- The code-signing certificate has expired, so the publisher identity cannot be verified.
- The program code is obfuscated with a commercial protector that is also used by attackers.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 13sandbox rule tags
- 3spawned processes
- 0network contacts
- 6filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
13MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1057· Lists programs
- T1082· System recon
- T1083· Scans your files
- T1095· Custom network
- T1129· Loads modules
- T1140· Deobfuscation
- T1198
- T1497· Sandbox evasion
- T1560
- T1562.001· Disables security
- T1620· In-memory loading
Observed activity
Processes started
3Programs the file ran, with their command lines.
SSDBooster.exe"C:\Users\<USER>\Desktop\SSDBooster.exe"fsutil"fsutil" behavior query disabledeletenotifySSDBooster.exe"C:\Users\user\Desktop\SSDBooster.exe"
Files
6Files the file created, changed or deleted.
- Written
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp - Written
\Sessions\1\BaseNamedObjects - Written
\Device\KsecDD - Written
\\?\PIPE\lsarpc - Written
\\?\PIPE\NETLOGON - Written
C:\Users\user\AppData\Roaming
Sandbox background — not the file
7The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
Show all 7 entries for sandbox background — not the file
- VM host
162.159.36.2
Chapter 04
Technical details
None of the 72 antivirus engines that checked it flag it; a signature that did not verify.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Apr 24, 2026, 6:18 AM UTC
- SHA-256
291e282a1574dda5ca191a456d0c01f0defb69b2a4b18e2b4bbbdf2c4362d15e- SHA-1
74f790636a883b9f7075a4988d9ee298c9da2852- MD5
49f22135e2aa4a6abebc8cad0bc2ce07
About this file
SSDBooster.exe is a Win32 EXE file of 3.5 MB.
- Type and size
- Win32 EXE · 3.5 MB
- Signer
- Omid Soroori (unverified signature)Worth noting: Malware sometimes copies or steals a company's signature, so this does not mean that company made it.
- First seen
- Jan 27, 2026On VirusTotal.
- Submitted by
- 34 distinct sources
- Packer
- None detected
- Entropy
- 7.40 of 8
First scanned Updated
Verdict history
- Safe
- Suspiciousafter a new scan
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
0 of 72 engines flagged this file
4 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust18 engines0flagged
View all 76 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is SSDBooster.exe safe?
What is SSDBooster.exe?
How many antivirus engines detected SSDBooster.exe?
Is SSDBooster.exe digitally signed?
What is the SHA-256 hash of SSDBooster.exe?
Is it safe to run SSDBooster.exe?
How up to date is this analysis of SSDBooster.exe?
Community
Member reviews and reports for this exact file hash.
