File scan report
Verdict Safe
Is juul.
Only one less reliable engine flagged this established DLL, while higher-trust engines, the test run, host checks, and researcher intelligence supplied no corroborating malware…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 69 flagged
- Flagged 1
- No detection 68
- No result 6
- Code signing Unsigned
- Test run Completed
- First seen 7mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
McAfeeD alone flagged the DLL with a generic hash-like label; none of the 69 antivirus engines that checked it included a higher-trust detection. The sample is established across 194 sources, and its completed runtime run recorded no hostile sandbox verdict, persistence, injected process, or malicious contacted host.
The detection pattern is dominated by a single less reliable McAfeeD result, with no named family and no higher-trust corroboration. This DLL has been submitted 303 times by 194 sources over 211 days, which substantially reduces concern that it is an obscure new payload. One sandbox run mapped T1620, but it recorded no injected process, persistence, file it created, or hostile sandbox assessment. Host-reputation coverage included both distinct observed hosts and found neither malicious nor suspicious, while one domain and the IP were identified as analysis-environment background traffic. Researcher intelligence produced no MalwareBazaar or malware-specific YARA corroboration, and the antivirus analysis found neither packing nor high-entropy code. The unsigned status and mapping warrant ordinary source verification, but the overall evidence most strongly supports a false-positive detection.
What We Detected
One of the 69 antivirus engines that checked it flagged the DLL. The sole result came from less reliable McAfeeD and used a generic hash-like label rather than identifying a malware family; no higher-trust engine corroborated it.
Threat Behavior
A completed sandbox run mapped T1620, a technique associated with reflective code loading. However, it recorded no injected process, persistence indicator, dropped file, or hostile sandbox assessment. Reputation checks covered both distinct observed hosts and found neither malicious nor suspicious; one domain and the observed IP were identified as background activity from the analysis environment.
Context
The file is unsigned, but it is not rare: 194 sources submitted it 303 times over 211 days. Researcher intelligence returned no malware-family hit or malware-specific YARA match, and the PE showed no identified packer or high-entropy code. Four of five import-table fingerprint-related files previously received favorable assessments, though those matches are weak because they lack a signer match and may simply share a build framework.
What To Do Now
Keep security software enabled and obtain the DLL from its expected application or vendor channel. If it appeared unexpectedly, verify its source and hash before loading it into a process.
Where this verdict could be wrong4 caveats
- The DLL is unsigned, so no verified publisher identity supports it.
- The test run mapped T1620, which can indicate reflective code loading, although no injected target process or other corroborating hostile action was recorded.
- McAfeeD flagged the sample with a hash-like generic label, but no higher-trust engine or named malware family corroborated it.
- One import-table fingerprint-related file previously received a suspicious assessment; matches on the import table alone can also join unrelated binaries built with the same framework.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No higher-trust antivirus engine flagged the file.
- The file has broad, established prevalence across 194 sources and 303 submissions.
- The completed sandbox run recorded no hostile assessment, persistence, injected process, or file it created.
- Both observed hosts were covered by reputation checks and neither was known malicious or suspicious.
- No malware-specific researcher rule, known-family hit, packing, or high-entropy code was found.
- The DLL has no verified digital signature.
- The test run mapped reflective code loading behavior.
- One less reliable antivirus engine produced a generic detection.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 9sandbox rule tags
- 5spawned processes
- 0network contacts
- 10filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
9MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1036
- T1070· Covers its tracks
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1083· Scans your files
- T1218.011
- T1497.001· Sandbox evasion
- T1620· In-memory loading
Observed activity
Processes started
5Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\<USER>\Desktop\juul.dll",#1loaddll32.exeC:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\juul.dll"cmd.exeC:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\juul.dll",#1rundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\juul.dll",#1WidgetService.exe"C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.2.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
Files
10Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed - Written
C:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed\4c44aeab-cf31-45e7-8a53-3ae99b2a0795.dat - Written
C:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed\4c44aeab-cf31-45e7-8a53-3ae99b2a0795.dat.~tmp - Written
C:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed\4c44aeab-cf31-45e7-8a53-3ae99b2a0795.dat~RF6cfddb.TMP - Written
C:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed\4c44aeab-cf31-45e7-8a53-3ae99b2a0795.dat~RF6d05f9.TMP - Written
\Device\ConDrv\\Connect
Show all 10 entries for files
- Deleted
C:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed - Deleted
C:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed\4c44aeab-cf31-45e7-8a53-3ae99b2a0795.dat - Deleted
C:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed\4c44aeab-cf31-45e7-8a53-3ae99b2a0795.dat~RF6cfddb.TMP - Deleted
C:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed\4c44aeab-cf31-45e7-8a53-3ae99b2a0795.dat~RF6d05f9.TMP
Sandbox background — not the file
4The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
svc.ha-teams.office.com - VM host
teams-mrc-ww-perf.tm-4.office.com - VM host
162.159.36.2
Chapter 04
Technical details
1 of the 69 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- McAfeeDti!429961CB7B85
File fingerprint
- Last analyzed
- Oct 11, 2026, 5:41 AM UTC
- SHA-256
429961cb7b8512b6825dba90e3fba5f6a2ebe5a17ea71431b0184dfc9c8687ba- SHA-1
938c9383e98f5d91b2425156c97095fdac1d0096- MD5
5b0b656fe58de4c67428947e85e3daf5
About this file
juul.dll is a Win32 DLL file of 464.9 kB.
- Type and size
- Win32 DLL · 464.9 kB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 14, 2026On VirusTotal.
- Submitted by
- 194 distinct sources
- Packer
- None detected
- Entropy
- 6.54 of 8
First scanned
Antivirus consensus
1 of 69 engines flagged this file
6 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-116 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- McAfeeDMalicious: ti!429961CB7B85
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is juul.dll safe?
What is juul.dll?
How many antivirus engines detected juul.dll?
What is the SHA-256 hash of juul.dll?
Is it safe to use juul.dll?
How up to date is this analysis of juul.dll?
Community
Member reviews and reports for this exact file hash.