File scan report
Verdict Safe
Is CMT_
Only 1 of the 70 antivirus engines that checked it flagged this long-established DLL, while every major engine remained silent and no corroborated malicious behavior was recorded.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 70 flagged
- Flagged 1
- No detection 69
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 12y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Cynet alone flagged the DLL, while the other 74 of the 70 antivirus engines that checked it did not, including all reporting major engines. Its history spans 117 submitters since it was first seen on Mar 25, 2014, and the sandbox evidence does not substantiate process injection, making the isolated detection likely a false positive.
The strongest signal is the antivirus result: only 1 of the 70 antivirus engines that checked it flagged the file, and that detection came from a less reliable engine with no named malware family. All 18 reporting major engines remained silent, and there is no corroborating malicious sandbox verdict. The file also has broad, long-standing prevalence, with 117 distinct submitters and a first-seen date of Mar 25, 2014. Although the DLL is unsigned and UPX-packed, those properties are not proof of malware. A label was recorded without any named injection target, so it does not establish that process injection occurred. Two IP contacts warrant caution because no complete reputation result is available, but they do not outweigh the broader benign evidence.
What We Detected
Only Cynet flagged the DLL, producing 1 detection out of 75 engines. The remaining engines did not flag it, including all 18 reporting major engines, and no engine identified a real malware family.
Threat Behavior
The sandbox summary included a T1055 label, but it recorded no process targeted for injection, so that label does not demonstrate actual process injection. Two IP contacts were observed, although a complete reputation assessment for those hosts is not available. No malicious sandbox verdict or malicious dropped file was recorded.
Additional Context
The DLL is unsigned and compressed with UPX, with high-entropy code. These traits can conceal code and justify caution, but they are also found in legitimate software. The sample has substantial history across 117 distinct submitters and was first seen on Mar 25, 2014, which weighs strongly against the isolated detection.
What To Do Now
Use the DLL only if it came from the expected software package or another trusted source. Keep security software enabled and rescan if the file changes or begins producing unexpected network or application behavior.
Where this verdict could be wrong3 caveats
- The DLL is unsigned and UPX-packed, which makes its contents less transparent and warrants obtaining it from a trusted source.
- The sandbox summary recorded two IP contacts, but no complete host-reputation assessment is available.
- Our static analysis was not available, so the packed contents were not independently examined.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 70 antivirus engines that checked it flagged the file, and the sole detection came from a less reliable engine.
- All 18 reporting major engines remained silent.
- The sample has been submitted by 117 distinct sources and was first seen on Mar 25, 2014.
- No malicious sandbox verdict or corroborated process-injection target was recorded.
- No inspected dropped file was identified as malicious.
- The DLL is unsigned.
- The executable code is compressed with UPX and has high entropy.
- The sandbox summary recorded two IP contacts whose reputations were not fully assessed.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 11sandbox rule tags
- 0spawned processes
- 2network contacts
- 35filesystem & mutex artifacts
Includes 11 mapped techniques, every process, file, registry and network entry and 4 dropped files.
Show the technical evidenceChapter 04
Technical details
1 of the 70 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- CynetMalicious (score: 100)
File fingerprint
- Last analyzed
- Sep 6, 2026, 7:24 PM UTC
- SHA-256
36955430d0ed08f6b937c554377c02b5181ef274a84d02dafe43c01faf61db73- SHA-1
23d8b54373a7c6e4b991536d54fd6aabfe507c5f- MD5
ab45ee71a9abb17c365f52f77e986198
About this file
CMT_Bitcrusher_2.dll is a Win32 DLL file of 667.1 kB.
- Type and size
- Win32 DLL · 667.1 kB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 25, 2014On VirusTotal.
- Submitted by
- 117 distinct sources
- Packer
- UPX (section names)Packing hides code; legitimate installers use it too.
- Entropy
- 7.92 of 8A code section is highly compressed or encrypted.
First scanned Updated
Verdict history
- Suspicious
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Includes every engine result (75), 2 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is CMT_Bitcrusher_2.dll safe?
What is CMT_Bitcrusher_2.dll?
How many antivirus engines detected CMT_Bitcrusher_2.dll?
What is the SHA-256 hash of CMT_Bitcrusher_2.dll?
Is it safe to use CMT_Bitcrusher_2.dll?
How up to date is this analysis of CMT_Bitcrusher_2.dll?
Community
Member reviews and reports for this exact file hash.