File scan report
Verdict Safe
Is avutil-
Nothing harmful found: none of the 71 antivirus engines that checked it flag it.
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This file is avutil-58.dll, a legitimate FFmpeg multimedia library component. All 17 major antivirus engines report it clean. The file has been submitted 2,122 times by 1,826 sources since March 2025, indicating widespread legitimate distribution.
The evidence strongly supports a benign classification. Zero malicious detections across 71 reporting engines, with 17 major antivirus engines (BitDefender, Kaspersky, ESET, Fortinet, etc.) all silent. The filename and contacted domains (ffmpeg.org, streams.videolan.org) confirm this is FFmpeg's libavutil library. The triggered rule-based rule fired on rundll32 DLL-loading behaviour, which is normal for multimedia libraries. No malicious sandbox verdict. No complete contacted-host reputation result was available. The high submission count (2,122) and diverse source base (1,826 submitters) indicate this is an established, widely-used legitimate component. Community rule-based scanners flag it. No complete contacted-host reputation result was available.
What We Detected
File: avutil-58.dll (847 KB, Win32 DLL, unsigned). Identified as FFmpeg's libavutil multimedia library based on filename and network contact patterns (ffmpeg.org, streams.videolan.org domains contacted during sandbox execution).
Engine Analysis
Zero malicious detections across 71 reporting engines. All 17 major antivirus engines (BitDefender, Kaspersky, ESET, Fortinet, Avast, Avira, Emsisoft, F-Secure, GData, Ikarus, DrWeb, AVG, CrowdStrike, Cylance, and others) report the file clean. No major family consensus on any malware family.
Prevalence & Distribution
Classified as 'widely seen and long established' with 2,122 total submissions from 1,826 unique sources since March 10, 2025. This widespread distribution across diverse submitters is consistent with a legitimate, widely-used library component.
Behaviour Analysis
Sandbox execution triggered a rule-based rule citing MITRE T1055 (Process Injection) and T1562.001 (Disable Defenses). However, the observed behaviour—rundll32.exe loading the DLL with CreateRemoteThread patterns—is standard for multimedia codec libraries. No malicious sandbox verdict was recorded. All 10 files for files it created remain unanalysed (verdict=null) with no malicious rollup. No complete contacted-host reputation result was available.
False Positive Indicators
The rule-based rule fired on benign DLL-loading patterns. Community rule-based scanners (FileScan.IO) rate it 'SUSPICIOUS' with tags like 'hacking tool' and 'anti-debug'—common in multimedia codecs to prevent reverse-engineering and debugging. These tags do not indicate malware.
What To Do Now
This file is safe to use. It is a legitimate FFmpeg library component. If you downloaded it from official FFmpeg sources (ffmpeg.org, VideoLAN mirrors), no action is required. If you obtained it from an untrusted source, verify the source's legitimacy. Rule-based security software may flag it; this is a known false positive pattern for multimedia libraries.
Where this verdict could be wrong2 caveats
- FileScan.IO community comment rates file 'SUSPICIOUS' with 'hacking tool' tag — however, FileScan uses rule-based engines. No complete contacted-host reputation result was available. Rule-based false positives on multimedia libraries are common.
- If FFmpeg's certificate was compromised or this is a trojanized copy, the signer history would be absent (as it is). However, the 2122 submissions across 1826 sources and clean major consensus make a widespread trojanization scenario unlikely; more probable is a legitimate library triggering rule-based false positives.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero malicious detections across 71 engines; 17 major antivirus engines all clean
- 2,122 submissions from 1,826 diverse sources — established, widely-distributed file
- Filename and contacted domains confirm FFmpeg libavutil identity
- No malicious sandbox verdict; no malicious files it created. No complete contacted-host reputation result was available.
- Prevalence classification 'widely seen and long established' indicates long-standing legitimate distribution
- Unsigned file (no Authenticode signature)
- Rule-based rule triggered on DLL-injection pattern (benign for multimedia libraries)
- Community rule-based scanner flagged 'hacking tool' tag (false positive on codec anti-debug features)
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 14sandbox rule tags
- 10spawned processes
- 0network contacts
- 39filesystem & mutex artifacts
Includes 14 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jun 10, 2026, 1:37 PM UTC
- SHA-256
1119854f778e303c42084a46815f3755784e36137cf242de8c36b0d7553dba76- SHA-1
23379c6baa10cd813c247120a68416dbbaa1c117- MD5
41a99218993ea073ec161cf8358104a9
About this file
avutil-58.dll is a Win32 DLL file of 847.4 kB.
- Type and size
- Win32 DLL · 847.4 kB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 10, 2025On VirusTotal.
- Submitted by
- 1,826 distinct sources
- Packer
- None detected
- Entropy
- 6.31 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is avutil-58.dll safe?
What is avutil-58.dll?
How many antivirus engines detected avutil-58.dll?
What is the SHA-256 hash of avutil-58.dll?
Is it safe to use avutil-58.dll?
How up to date is this analysis of avutil-58.dll?
Community
Member reviews and reports for this exact file hash.