» UltraRAMDisk.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

UltraRAMDisk.exe

Ultra RAMDisk

ieungSoft

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Ultra RAMDisk’. This is installed with Ultra RAMDisk.

File name:

UltraRAMDisk.exe

Publisher:

ieungSoft (signed and verified)

Product:

Ultra RAMDisk

Description:

Ultra RAMDisk Main

Version:

1.40

MD5:

8ad86fcb993acb14a79ff83024a9aa8f

SHA-1:

bdbb9c061b85829e3e02da3dfda4eab5ea7882c6

SHA-256:

919b75edb2dee3482a9ceee46ce8851ad20ebce8fd9e5d6d3b75c4fb58c4049d

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

12/26/2024 6:57:57 PM UTC (today)

File size:

753.9 KB (772,000 bytes)

Product version:

1.40

Original file name:

UltraRAMDisk.exe

File type:

Executable application (Win32 EXE)

Common path:

C:\Program Files\ultra ramdisk\ultraramdisk.exe

Digital Signature

Signed by:

ieungSoft

Authority:

Symantec Corporation

Valid from:

2/23/2016 9:00:00 AM

Valid to:

8/24/2016 8:59:59 AM

Subject:

CN=ieungSoft, O=ieungSoft, L=Yuseong-gu, S=Daejeon, C=KR

Issuer:

CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:

52B43E3B0854D8D32847777B4599807A

File PE Metadata

Compilation timestamp:

2/24/2016 2:39:24 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:6sv729jDSgUd4rExG3GmCrvmdfc16GHtkyod/B93:6Ljeda4ucrvgRoTs593

Entry address:

0x2B4970

Entry point:

60, BE, 00, 40, 64, 00, 8D, BE, 00, D0, DB, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89... 
[+]

Entropy:

6.6952

Packer / compiler:

UPX 2.90LZMA

Code size:

452 KB (462,848 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Ultra RAMDisk

Command:

"C:\Program Files\ultra ramdisk\ultraramdisk.exe" \logon

The file UltraRAMDisk.exe has been discovered within the following program.

Ultra RAMDisk by ieungSoft

About 7% of users remove it

Scan UltraRAMDisk.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.