MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Safe

Single low-trust generic detection; 18 tier-1 engines silent; benign library loading; no malicious children or sandbox verdicts.

Trust score82Moderate trust
MT AI confidence · 78%
Libretracker20201027.zip
22.4 MB
381a7bac08651c9b90…81a1643b1f
Antivirus engines
1 of 77 flagged
Code signing
Unsigned
Age
First seen 2y ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

78%Confidence
High
Reasoning

The file exhibits a classic low-trust-only false-positive shape: a single generic heuristic detection from a low-confidence engine, complete silence from tier-1 vendors, and no corroborating malicious behaviour. The filename 'Libretracker' and the presence of OpenCV/LSL libraries suggest a legitimate research or multimedia application. Process injection via rundll32.exe is consistent with normal library loading in scientific software, not adversarial AV evasion. The absence of malicious dropped children, sandbox verdicts, and contacted hosts further supports a benign classification. No external intelligence (CIRCL, YARAify, MalwareBazaar) corroborates a malware interpretation.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. 1/68 engines malicious (MaxSecure, low-trust); tier1Malicious=0; onlyLowTrustFlagging=true

  2. MaxSecure label 'Trojan.Malware.300983.susgen' is generic heuristic; no tier-1 family consensus

  3. 18 tier-1 engines (Kaspersky, BitDefender, ESET, Fortinet, Avast, Ikarus, etc.) all undetected

  4. Dropped children: 10 inspected, 0 malicious, all verdicts unknown; no malicious sandbox verdict; no malicious contacted hosts

  5. Process injection via rundll32.exe loading OpenCV/LSL libraries (legitimate scientific libraries), not AV-evasion pattern

Points in its favour
  • 18 tier-1 antivirus engines silent (Kaspersky, BitDefender, ESET, Fortinet, Avast, Ikarus, Emsisoft, F-Secure, DrWeb, GData, Avira, AVG)
  • No malicious dropped children (10 inspected, 0 malicious)
  • No malicious sandbox verdict
  • No malicious contacted hosts
  • Legitimate library names (OpenCV, LSL) consistent with research software
Points against
  • Unsigned archive (no code signature)
  • Process injection via rundll32.exe (T1055)
  • Defence impairment technique observed (T1562.001)
  • Single low-trust engine detection (MaxSecure)
What to do

Classify this file as safe. The single low-trust detection is a false positive; tier-1 engine consensus and benign runtime behaviour support this assessment. If the source is trusted, proceed with normal use.

Sources disagree

1 contradiction resolved by the scoring engine

Only low-trust / heuristic engines flagged this file
1 engine from the heuristic / generic-AI set flagged it. No tier-1 engine agreed.
Verdict treated these as likely false positives.
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
12

Adversary techniques mapped to the MITRE ATT&CK framework.

T1010T1012T1036T1055T1056T1057T1071T1082T1497T1518.001T1562.001T1574.002
Spawned processes
11
$(unnamed)
"C:\Users\<USER>\AppData\Local\Temp\Libretracker/Libretracker.exe"
$(unnamed)
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Libretracker/opencv_videoio_msmf450_64.dll",#1
$(unnamed)
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Libretracker/opencv_world450.dll",#1
$(unnamed)
C:\Windows\system32\WerFault.exe -u -p 4016 -s 644
$(unnamed)
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Libretracker/liblsl64.dll",#1
$(unnamed)
C:\Windows\system32\WerFault.exe -u -p 5896 -s 536
$(unnamed)
"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\Libretracker20201027.zip"
$(unnamed)
C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\hxcbp4rw.2rh" "C:\Users\user\Desktop\Libretracker20201027.zip"
+3 more processes captured.
Filesystem & mutexes
34
Files written15
  • C:\ProgramData\fltk.org\fltk.prefs
  • C:\Users\<USER>\AppData\Roaming\fltk.org\fltk.prefs
  • C:\ProgramData\Microsoft\Windows\WER\Temp
  • C:\ProgramData\Microsoft\Windows\WER\Temp\093da611-5cc0-486b-9882-6edd809e7d96
  • C:\ProgramData\Microsoft\Windows\WER\ReportQueue
+10 more
Files deleted12
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER7FF4.tmp
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER8506.tmp
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER87A6.tmp
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER7FF4.tmp.dmp
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER8506.tmp.WERInternalMetadata.xml
+7 more
Mutexes created7
  • Local\WERReportingForProcess4016
  • Global\98b9d985-d219-4ede-b694-98a753bd3c9f
  • Local\WERReportingForProcess5896
  • Global\AmiProviderMutex_InventoryApplicationFile
  • Global\571c45db-0e6d-40ba-a34c-913e638d8274
+2 more
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen
  • 07058dece244d5aa61ef…0df0c6Never scanned
    never seen before
  • 1c26fe818d9ff71f3d38…7123daNever scanned
    never seen before
  • f5af97bca5c8a4da59f8…e17136Never scanned
    never seen before
  • 62de274fef7acd0f1b25…057916Never scanned
    never seen before
  • c698afabe9a8fee8d6b7…b687e3Never scanned
    never seen before
  • bbaa0c0be5ee7118d71a…61544cNever scanned
    never seen before
  • 91053d80948f69babbd7…8c357fNever scanned
    never seen before
  • 4f238e4502c500759367…2615abNever scanned
    never seen before
  • 4795a56ae53f701e0bd2…d87deeNever scanned
    never seen before
  • f5604a010c710b0f23e9…d4fac1Never scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA + heuristic rules that fired

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

1 synthesis
MITRE ATT&CK profile
Defense evasion× 1
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • ProcessInjection
    T1055
    high

    MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.

    Evidence
    "C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Libretracker/opencv_videoio_msmf450_64.dll",#1
Antivirus engine breakdown

1 detection across 77 engines

1 malicious0 suspicious76 clean
Tier-118 engines
0flag
Top commercial AVs (low FP rate)
Tier-238 engines
0flag
Mainstream engines with mixed FP rates
Low-trust21 engines
1flag
Heuristic / generic-AI engines (high FP rate)
MaxSecure
malicious
Trojan.Malware.300983.susgen
Hash 381a7bac0865… cross-referenced against 77 AV engines via our AV network.
Prevalence

How often this file shows up in the wild

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium
Unique uploaders
10
Moderate upload volume.
Total submissions
10
Includes repeat uploads by the same source.
First seen by VT
2y ago
Oct 20, 2024
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
10/20/2024, 10:42:33 PM
First seen (MalwareBazaar)
—
Last analysis (VT)
10/20/2024, 10:42:33 PM
Scanned here
7/1/2026, 11:46:11 AM
File name
Libretracker20201027.zip
Size
22.43 MB
MIME type
(unknown)
Detected type
ZIP
SHA-256
381a7bac08651c9b900bca4a1c947ba120473245e8cb2e7d711b7781a1643b1f
MD5
3f3f14e5ac996970f919221ff4c6a13f
SHA-1
f269091ce8f522a85c36263fefad4d14699cd0a5
First seen (VT)
10/20/2024, 10:42:33 PM
Last analysis (VT)
10/20/2024, 10:42:33 PM
First scan (MalwareTips)
7/1/2026, 11:46:11 AM
Last scan (MalwareTips)
7/1/2026, 11:46:11 AM
Behavior tags
zipchecks-user-inputdetect-debug-environmentlong-sleeps
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.