File scan report
Verdict Safe
Is steam_
Steam API DLL signed by Valve Corp. with zero engine detections and common-old prevalence.
Strong evidence · A verified publisher signature, and no engine flags it.
The file shows no malicious indicators and originates from a trusted publisher; it can be considered safe for normal use.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Valve Corp.
- Test run Completed
- First seen 4y ago
Chapter 02
Why we think so
0 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
75 of the 70 antivirus engines that checked it report clean. The file is signed by Valve Corp. and matches prior safe samples from the same signer.
Zero malicious detections across all engine tiers and a verified Valve Corp. signature establish a strong clean baseline. The single prior similar-hash verdict also returned safe under the same signer. While a rule-based mapped activity, the sandbox produced no malicious verdict and contacted-host reputation data is unavailable. Prevalence as widely seen and long established further supports legitimate distribution.
What We Detected
75 engines scanned the file; none flagged it malicious. The DLL carries a valid digital signature from Valve Corp. and matches a prior safe sample from the same signer.
Threat Behavior
The file is widely distributed (widely seen and long established) with nearly 2,000 unique sources.
What To Do Now
Keep security software enabled. The file can be used normally; no further action is required.
Where this verdict could be wrong1 caveat
- triggeredHeuristics[0].rule='one of our behaviour rules' fired on mapping, but sandbox evidence does not prove malicious intent.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Valve Corp. digital signature verified
- Zero detections across 75 engines
- Prior safe verdict on same signer
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 10sandbox rule tags
- 1spawned processes
- 0network contacts
- 1filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1055· Process injection
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1095· Custom network
- T1129· Loads modules
- T1218.011
- T1497· Sandbox evasion
Observed activity
Processes started
1Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\readme.dll",#1
Files
1Files the file created, changed or deleted.
- Written
\Device\ConDrv\\Connect
Chapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; signed by Valve Corp..
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Aug 30, 2026, 8:39 AM UTC
- SHA-256
46688ecd8849a86bf8b807c5de1adbb8b8dddaa48583d68b3518b72c77c15bd0- SHA-1
b11ad76960564848ec034ccfec5ff2f5eabf6f28- MD5
c2e2f3c626b1916dc07b8b08986fad49
About this file
steam_api.dll is a Win32 DLL file of 296.4 kB.
- Type and size
- Win32 DLL · 296.4 kB
- Signer
- Valve Corp.Valid code signature.
- First seen
- Jun 23, 2022On VirusTotal.
- Submitted by
- 1,966 distinct sources
- Packer
- None detected
- Entropy
- 7.69 of 8
First scanned
Antivirus consensus
0 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is steam_api.dll safe?
What is steam_api.dll?
How many antivirus engines detected steam_api.dll?
Is steam_api.dll digitally signed?
What is the SHA-256 hash of steam_api.dll?
Is it safe to use steam_api.dll?
How up to date is this analysis of steam_api.dll?
Community
Member reviews and reports for this exact file hash.