File scan report
Verdict Safe
Is steam_ api. dll safe? Yes, no threats found.
Steam API DLL signed by Valve, zero engine detections, and widely distributed since 2011.
Strong evidence · A verified publisher signature, and no engine flags it.
Retain the file; it matches the expected Steam API component with no malicious indicators.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Valve
- Test run Completed
- First seen 15y ago
Chapter 02
Why we think so
0 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No antivirus engine flagged the file. It carries a valid Valve signature and has been submitted by hundreds of users over more than a decade.
The file is a 12-year-old Steam API DLL signed by Valve. All 70 antivirus engines that checked it returned clean results, including 16 major antivirus engines. Prevalence data shows 269 unique sources and 385 submissions since 2011. Sandbox activity (and direct-IP contacts) is consistent with legitimate Steam behavior in the test run and produced no malicious verdict. No external intelligence sources or file it created detections contradict the clean engine consensus.
What We Detected
75 engines scanned the sample; none returned a malicious or suspicious result. The DLL is signed by Valve with a verified certificate dated 2011.
Threat Behavior
No dropped malicious files it created, no complete contacted-host reputation result was available contacts, and no external-intel hits from CIRCL, MalwareBazaar, or YARAify. The file's age, prevalence, and clean signing history align with a legitimate Steam component rather than malware.
What To Do Now
The file can be considered safe. Keep Windows Defender and other security software enabled; no action is required.
- Valve code signature verified
- Zero engine detections across 75 scanners
- Widely distributed since 2011
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 11sandbox rule tags
- 1spawned processes
- 2network contacts
- 22filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
11MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1018
- T1027.005· Obfuscated code
- T1055· Process injection
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1129· Loads modules
- T1218.011
- T1497· Sandbox evasion
- T1518.001· Checks your AV
Observed activity
Processes started
1Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\<USER>\Desktop\attachment.dll",#1
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
20.42.65.92 - IP address
52.182.143.212
Files
18Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_36ce9e2f536be5a4331b1b3c284f5c74c7c99_82810a17_067a49f0 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_36ce9e2f536be5a4331b1b3c284f5c74c7c99_82810a17_067a49f0\Report.wer - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC753.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC753.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA42.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA42.tmp.WERInternalMetadata.xml
Show all 18 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCAFE.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCAFE.tmp.xml - Written
C:\Users\user\AppData\Local\DBG - Written
\Device\ConDrv\\Connect - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3993.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER39B3.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC753.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC753.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA42.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA42.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCAFE.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCAFE.tmp.xml
Mutexes
4Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\DBWinMutex\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4368\Sessions\1\BaseNamedObjects\Global\AmiProviderMutex_InventoryApplicationFile\Sessions\1\BaseNamedObjects\Global\0a320a65-1a66-46c5-982a-8691d2ed9d4b
Files this sample writes at runtime
This file drops 4 children at runtime. None are currently flagged malicious in our cache. 4 have no saved verdict and were not checked; that is missing coverage, not a finding.
- a036100b166ab8db85a0…f8424aNot checkedno saved verdict
- fc572b569f5a0117c9c0…ca00cfNot checkedno saved verdict
- 09a5463427d1fed5d01a…cf3842Not checkedno saved verdict
- 583b46be574aa86dc4fe…e4e979Not checkedno saved verdict
Chapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; signed by Valve.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 6, 2026, 6:48 AM UTC
- SHA-256
11c7a5df676ffe1aa0a498103d061e8c594a3d9df3b9cc23e5b5f642b12f7163- SHA-1
d97a7eb691694e0abad9292bbbe57223ff0446de- MD5
d4b48fdf43364047016fc9ef13c209ff
About this file
steam_api.dll is a Win32 DLL file of 124.7 kB.
- Type and size
- Win32 DLL · 124.7 kB
- Signer
- ValveValid code signature.
- First seen
- Apr 30, 2011On VirusTotal.
- Submitted by
- 269 distinct sources
- Packer
- None detected
- Entropy
- 7.25 of 8
First scanned
Antivirus consensus
0 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is steam_api.dll safe?
What is steam_api.dll?
How many antivirus engines detected steam_api.dll?
Is steam_api.dll digitally signed?
What is the SHA-256 hash of steam_api.dll?
Is it safe to use steam_api.dll?
How up to date is this analysis of steam_api.dll?
Community
Member reviews and reports for this exact file hash.