File scan report
Verdict Safe
Is avutil-
Nothing harmful found: none of the 71 antivirus engines that checked it flag it.
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This file is avutil-58.dll, a legitimate FFmpeg multimedia library component. All 17 major antivirus engines report it clean. The file has been submitted 2,122 times by 1,826 sources since March 2025, indicating widespread legitimate distribution.
The evidence strongly supports a benign classification. Zero malicious detections across 71 reporting engines, with 17 major antivirus engines (BitDefender, Kaspersky, ESET, Fortinet, etc.) all silent. The filename and contacted domains (ffmpeg.org, streams.videolan.org) confirm this is FFmpeg's libavutil library. The triggered rule-based rule fired on rundll32 DLL-loading behaviour, which is normal for multimedia libraries. No malicious sandbox verdict. No complete contacted-host reputation result was available. The high submission count (2,122) and diverse source base (1,826 submitters) indicate this is an established, widely-used legitimate component. Community rule-based scanners flag it. No complete contacted-host reputation result was available.
What We Detected
File: avutil-58.dll (847 KB, Win32 DLL, unsigned). Identified as FFmpeg's libavutil multimedia library based on filename and network contact patterns (ffmpeg.org, streams.videolan.org domains contacted during sandbox execution).
Engine Analysis
Zero malicious detections across 71 reporting engines. All 17 major antivirus engines (BitDefender, Kaspersky, ESET, Fortinet, Avast, Avira, Emsisoft, F-Secure, GData, Ikarus, DrWeb, AVG, CrowdStrike, Cylance, and others) report the file clean. No major family consensus on any malware family.
Prevalence & Distribution
Classified as 'widely seen and long established' with 2,122 total submissions from 1,826 unique sources since March 10, 2025. This widespread distribution across diverse submitters is consistent with a legitimate, widely-used library component.
Behaviour Analysis
Sandbox execution triggered a rule-based rule citing MITRE T1055 (Process Injection) and T1562.001 (Disable Defenses). However, the observed behaviour—rundll32.exe loading the DLL with CreateRemoteThread patterns—is standard for multimedia codec libraries. No malicious sandbox verdict was recorded. All 10 files for files it created remain unanalysed (verdict=null) with no malicious rollup. No complete contacted-host reputation result was available.
False Positive Indicators
The rule-based rule fired on benign DLL-loading patterns. Community rule-based scanners (FileScan.IO) rate it 'SUSPICIOUS' with tags like 'hacking tool' and 'anti-debug'—common in multimedia codecs to prevent reverse-engineering and debugging. These tags do not indicate malware.
What To Do Now
This file is safe to use. It is a legitimate FFmpeg library component. If you downloaded it from official FFmpeg sources (ffmpeg.org, VideoLAN mirrors), no action is required. If you obtained it from an untrusted source, verify the source's legitimacy. Rule-based security software may flag it; this is a known false positive pattern for multimedia libraries.
Where this verdict could be wrong2 caveats
- FileScan.IO community comment rates file 'SUSPICIOUS' with 'hacking tool' tag — however, FileScan uses rule-based engines. No complete contacted-host reputation result was available. Rule-based false positives on multimedia libraries are common.
- If FFmpeg's certificate was compromised or this is a trojanized copy, the signer history would be absent (as it is). However, the 2122 submissions across 1826 sources and clean major consensus make a widespread trojanization scenario unlikely; more probable is a legitimate library triggering rule-based false positives.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero malicious detections across 71 engines; 17 major antivirus engines all clean
- 2,122 submissions from 1,826 diverse sources — established, widely-distributed file
- Filename and contacted domains confirm FFmpeg libavutil identity
- No malicious sandbox verdict; no malicious files it created. No complete contacted-host reputation result was available.
- Prevalence classification 'widely seen and long established' indicates long-standing legitimate distribution
- Unsigned file (no Authenticode signature)
- Rule-based rule triggered on DLL-injection pattern (benign for multimedia libraries)
- Community rule-based scanner flagged 'hacking tool' tag (false positive on codec anti-debug features)
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 14sandbox rule tags
- 10spawned processes
- 0network contacts
- 39filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
14MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1055· Process injection
- T1056· Keylogging
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1129· Loads modules
- T1218.011
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1542.003
- T1562.001· Disables security
- T1574.002· Execution hijack
Observed activity
Processes started
10Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\readme.dll",#1loaddll64.exeC:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\avutil-58.dll"cmd.exeC:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\avutil-58.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil-58.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\avutil-58.dll,av_add_irundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\avutil-58.dll,av_add_q
Show all 10 entries for processes started
rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\avutil-58.dll,av_add_stablerundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil-58.dll",av_add_irundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil-58.dll",av_add_qrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil-58.dll",av_add_stable
Files
29Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\64a7a31e-e019-4047-a92e-da3a33ddf0d5 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\c2c28c63-09e6-4e7f-8d40-ca5c98ce7994 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\0053f096-68d1-41e8-a7af-6dda651348c9
Show all 29 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\095e5f0d-6f6d-4931-9b54-f9ba21271ffd - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\0e3186b8-c3c0-4604-9ff0-04f2c03ff135 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\a54f6196-7ab7-4c84-96fe-42d301bbcad8 - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCE9A.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD811.tmp.WERInternalMetadata.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9C8.tmp.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2D2.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2D2.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2E2.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCE9A.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD811.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9C8.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCE9A.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD811.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9C8.tmp.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2D2.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2D2.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2E2.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2E2.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA3BD.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA3DD.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA46A.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA47A.tmp
Registry and auto-start
2Settings the file changed, including ways to start again after a restart.
- Deleted
\REGISTRY\A\{adf5bad9-a2d6-2ba8-fdcd-98fdd305be94}\Root\InventoryApplicationFile\PermissionsCheckTestKey - Deleted
\REGISTRY\A\{1230f344-7bd3-d656-ec28-83ab616c8b53}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\WERReportingForProcess3028Global\AmiProviderMutex_InventoryApplicationFileGlobal\f4f4c7b3-a2fb-4297-a286-4973a2eb450b\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7548\Sessions\1\BaseNamedObjects\Global\c58422de-4bac-4b85-802d-e39d32a70f21\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7580
Show all 10 entries for mutexes
\Sessions\1\BaseNamedObjects\Global\c6e7178d-f5d5-4c07-b90d-43492c5d4054\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5772\Sessions\1\BaseNamedObjects\InventorySynchronizationInventoryApplicationFileMutex2968\Sessions\1\BaseNamedObjects\Global\45f37633-9043-441e-bfb8-e288cab8a8bd
Sandbox background — not the file
5The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3028 -s 496 - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
WerFault.exeC:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7580 -s 348 - VM process
WerFault.exeC:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7548 -s 332 - VM process
WerFault.exeC:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6204 -s 348
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 4307452af4305e19c4ed…7e5424Not checkedno saved verdict
- baf850813b666d674420…26843bNot checkedno saved verdict
- 449b28ddbb4be506e9ae…89c1edNot checkedno saved verdict
- 9f77c986571e09eda896…9a6f4fNot checkedno saved verdict
- 557f64e5219b4c8bf8c5…eefa21Not checkedno saved verdict
- ebf3c2756464be9acf1e…a168b4Not checkedno saved verdict
- 8ebfa31a62b849400092…a90b4bNot checkedno saved verdict
- 9dbcdfb00e98a3dab8e7…a078edNot checkedno saved verdict
- 65bdd8f23f5e6f96d508…0e66acNot checkedno saved verdict
- 06bfa219192d61d11897…dde092Not checkedno saved verdict
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jun 10, 2026, 1:37 PM UTC
- SHA-256
1119854f778e303c42084a46815f3755784e36137cf242de8c36b0d7553dba76- SHA-1
23379c6baa10cd813c247120a68416dbbaa1c117- MD5
41a99218993ea073ec161cf8358104a9
About this file
avutil-58.dll is a Win32 DLL file of 847.4 kB.
- Type and size
- Win32 DLL · 847.4 kB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 10, 2025On VirusTotal.
- Submitted by
- 1,826 distinct sources
- Packer
- None detected
- Entropy
- 6.31 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is avutil-58.dll safe?
What is avutil-58.dll?
How many antivirus engines detected avutil-58.dll?
What is the SHA-256 hash of avutil-58.dll?
Is it safe to use avutil-58.dll?
How up to date is this analysis of avutil-58.dll?
Community
Member reviews and reports for this exact file hash.