File scan report
Verdict Safe
Is glfw3.
None of the 71 antivirus engines that checked it flagged this widely submitted 64-bit DLL, which matches the GLFW graphics library, and the sandbox runs showed no malicious or…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
No action is needed. Use it only as a library from software you trust and keep your antivirus enabled.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
1 point against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This file is a 64-bit DLL named like the GLFW graphics library. None of the 71 antivirus engines that checked it flagged it, it has been submitted by 433 sources since Feb 2024, and sandbox runs showed nothing hostile. Nothing in the evidence points to a threat.
None of the 71 antivirus engines that checked it flagged the file, including 18 major antivirus engines that reported clean. It was first seen on Feb 23, 2024 and 433 distinct sources have submitted it, which fits a commonly redistributed library. The combined sandbox verdict was clean, with no injection into other processes, no network contacts and no dropped files. The few techniques recorded are common in legitimate software, such as loading the DLL through rundll32 and input checks. A reference database lists the same file name. The lack of a signature is typical for open-source libraries bundled with applications.
What We Detected
No engine flagged this 64-bit Windows DLL. Its structure looks normal, with no packing and no unusual entropy.
Threat Behavior
Sandbox runs loaded the DLL and called its exported window and cursor functions. They showed no network traffic, no process injection and no dropped files.
What To Do Now
No action is needed. Keep the file alongside the application that uses it and keep your security software active.
Where this verdict could be wrong1 caveat
- The file is unsigned and its host-reputation check was not completed, so network reputation is unverified; the sandbox saw no network contacts, however.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the file
- Submitted by 433 distinct sources since Feb 23, 2024
- Sandbox runs gave a clean combined verdict with no network contacts or injection
- A reference database lists a file with the same name
- The file is unsigned, so its publisher cannot be verified from a signature.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 7sandbox rule tags
- 15spawned processes
- 0network contacts
- 1filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
7MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1056· Keylogging
- T1056.001· Keylogging
- T1115
- T1129· Loads modules
- T1218.011
Observed activity
Processes started
15Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\attachment.dll",#1loaddll64.exeC:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\attachment.dll"cmd.exeC:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\attachment.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\attachment.dll,glfwCreateCursorrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\attachment.dll,glfwCreateStandardCursor
Show all 15 entries for processes started
rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\attachment.dll,glfwCreateWindowrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",glfwCreateCursorrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",glfwCreateStandardCursorrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",glfwCreateWindowrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",glfwWindowShouldCloserundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",glfwWindowHintStringrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",glfwWindowHintrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",glfwWaitEventsTimeoutrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",glfwWaitEvents
Files
1Files the file created, changed or deleted.
- Written
\Device\ConDrv\\Connect
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 24, 2026, 9:18 PM UTC
- SHA-256
3dcbeae25f5a38935f00056e14b4a64815a81dd2f14e5a10701be13ca6a56bc3- SHA-1
92f93980e79b6ad390a6f668351576daebc9378f- MD5
4ef53a7fb51300a84bf4002bb284dfc3
About this file
glfw3.dll says it is GLFW 3.4.0 DLL (GLFW), 369.7 kB.
- Claims to be
- GLFW 3.4.0 DLL (GLFW)From the file's own version information, written by whoever built it.
- Original name
- glfw3.dllMatches the shared file name.
- Type and size
- Win32 DLL · 369.7 kB
- Signer
- UnsignedNo code signature.
- First seen
- Feb 23, 2024On VirusTotal.
- Submitted by
- 433 distinct sources
- Packer
- None detected
- Entropy
- 5.95 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is glfw3.dll safe?
What is glfw3.dll?
How many antivirus engines detected glfw3.dll?
What is the SHA-256 hash of glfw3.dll?
Is it safe to use glfw3.dll?
How up to date is this analysis of glfw3.dll?
Community
Member reviews and reports for this exact file hash.