File scan report
Verdict Safe
Is d3dcompiler_
This Microsoft-signed Direct3D shader compiler library has no detections from any of 75 engines and has been widely distributed with games and applications since 2020.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
This library is a standard Microsoft graphics component and can be kept. Obtain it only through the application or game that ships it.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Microsoft Corporation
- Test run Completed
- First seen 6y ago
Chapter 02
Why we think so
1 point against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 70 antivirus engines that checked it flagged this DLL, and it carries a valid Microsoft Corporation signature. It has been seen from thousands of independent sources over several years. One sandbox run returned a malicious label while another returned clean, but no hostile runtime artefact was recorded.
The file is Microsoft's Direct3D shader compiler library with a valid Microsoft Corporation signature, and none of the 70 antivirus engines that checked it flagged it. It has been submitted by more than 3,700 independent sources since 2020 and is listed in a known-software reference set as part of a game. The sandbox results were split: one run labelled it evasive and another returned clean. No process injection target, persistence or malicious network host was recorded. The crash reports in the sandbox runs reflect the library being launched directly through rundll32, which is not how it is meant to be used. Prior files from this signer on our platform were all judged clean.
What We Detected
None of the 70 antivirus engines that checked it flagged this file. The DLL carries a valid Microsoft Corporation signature, and it is common, long-established software distributed alongside games and graphics applications.
Threat Behavior
Across seven sandbox runs, one run returned an evasive-malicious label while another returned clean. No injection into another process was recorded, and no persistence was observed. Network contacts were Apple and Microsoft service hosts, and our host reputation check found nothing malicious among the 40 hosts it inspected. The crash reports seen in the runs come from executing a library that is not designed to run on its own.
What To Do Now
No action is needed if this file came with a game or application you installed. Keep your security software enabled and running as usual.
Where this verdict could be wrong1 caveat
- One sandbox run labelled the file as evasive malicious, but another run returned clean. No injection target or other hard runtime artefact was recorded, so the split result is consistent with a library loaded out of context.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Valid Microsoft Corporation digital signature
- No detections from any of 75 antivirus engines
- Widely distributed since 2020, with thousands of independent sources
- Listed in a known-software reference set as a game component
- Previous files from this signer on our platform were all judged clean
- One sandbox run labelled the library as evasive, although another run returned clean
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 7 isolated tests; 1 test environment rated what it did as risky.
Test run summary
Capture complete- 7isolated sandbox runs
- 22sandbox rule tags
- 15spawned processes
- 24network contacts
- 40filesystem & mutex artifacts
Includes the sandbox verdicts, 22 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; signed by Microsoft Corporation.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 18, 2026, 5:07 PM UTC
- SHA-256
44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47- SHA-1
2256644f69435ff2fee76deb04d918083960d1eb- MD5
7641e39b7da4077084d2afe7c31032e0
About this file
d3dcompiler_47.dll says it is Direct3D HLSL Compiler for Redistribution (Microsoft® Windows® Operating System), 4.5 MB.
- Claims to be
- Direct3D HLSL Compiler for Redistribution (Microsoft® Windows® Operating System)From the file's own version information, written by whoever built it.
- Original name
- d3dcompiler_47.dllMatches the shared file name.
- Type and size
- Win32 DLL · 4.5 MB
- Signer
- Microsoft CorporationValid code signature.
- First seen
- Mar 20, 2020On VirusTotal.
- Submitted by
- 3,758 distinct sources
- Packer
- None detected
- Entropy
- 6.09 of 8
First scanned Updated
Verdict history
- Malicious
- Safeafter a new scan
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is d3dcompiler_47.dll safe?
What is d3dcompiler_47.dll?
How many antivirus engines detected d3dcompiler_47.dll?
Is d3dcompiler_47.dll digitally signed?
What is the SHA-256 hash of d3dcompiler_47.dll?
Is it safe to use d3dcompiler_47.dll?
How up to date is this analysis of d3dcompiler_47.dll?
Community
Member reviews and reports for this exact file hash.