File scan report
Verdict Malicious
Is Online
Thirty-two of the 70 antivirus engines that checked it flagged this unsigned DLL, with corroborated Crack hacking tool labels and four matching prior samples receiving the same…
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
Keep it only if you installed it on purpose for security testing. Otherwise delete it and run a full antivirus scan.
What to do now4 steps
This is a hacking tool. It is risky to keep and run, but finding it is not by itself a sign that the device is infected.
What to do
Don't use it unless you got it on purpose for security testing on systems you own. Let your antivirus remove this component, then repair or reinstall the program it belongs to from its official website. Don't delete or replace the file by hand.
If you didn't put it on the device yourself, delete it and run a full antivirus scan: something else may have brought it.
Tools like this often come with cracked or pirated software. If it came that way, treat the whole download as unsafe and scan everything it installed.
If you already used it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
32 of 70 flagged
- Flagged 32
- No detection 38
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
6 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Multiple independent engines identify OnlineFix64.dll as a crack or game-hacking tool, including ESET-NOD32 and several other vendors. The file is unsigned, and four files sharing its import-table fingerprint previously received the same Crack hacking tool assessment, outweighing the quieter sandbox and broad prevalence.
The strongest evidence is the corroborated hacking tool classification: 32 of the 70 antivirus engines that checked it flagged the DLL, including six major detections. ESET-NOD32 explicitly names HackTool.Crack, while several other engines independently use Crack, HackTool, game-hack, or riskware labels. Four prior files with the same import-table fingerprint were also assessed as Crack hacking tools, reinforcing that this is a consistent code lineage rather than an isolated rule-based alert. Observation from the test run did not return a malicious sandbox verdict, and the complete reputation check of seven observed hosts found no cached malicious or suspicious entries. Those counter-signals reduce concern about additional network-delivered malware but do not neutralize a confirmed crack tool, which remains risky regardless of intended use.
What We Detected
OnlineFix64.dll was flagged by 32 of the 70 antivirus engines that checked it, including six major antivirus engines. ESET-NOD32 reported Win64/HackTool.Crack.AA, while CTX, Antiy-AVL, alibabacloud, K7AntiVirus, Lionic, and others used Crack or HackTool labels. The DLL is unsigned, and four files sharing its import-table fingerprint previously received matching Crack hacking tool assessments.
Threat Behavior
The sandbox loaded the DLL through rundll32.exe and recorded offensive techniques T1548 and T1560, along with several more common execution and discovery techniques. It did not produce a malicious sandbox verdict, and the reputation check covered all seven observed hosts without finding cached malicious or suspicious classifications. One malware-specific YARA rule, FreddyBearDropper, also matched, although that isolated rule is supporting evidence rather than the main basis for this assessment.
What To Do Now
Do not run or distribute this DLL, especially on a system containing valuable accounts, game credentials, or personal data. Remove it while keeping security software enabled, then scan the containing folder and any system where it was loaded.
Where this verdict could be wrong3 caveats
- Eleven major antivirus engines did not flag the file, including BitDefender, Avast, and AVG.
- The completed sandbox produced no malicious verdict and the seven inspected hosts had no cached malicious or suspicious classification.
- The file is widely distributed, with 3,713 submitters and 41,997 submissions, and two community comments claim it is an official file; those unsupported comments do not outweigh corroborated hacking tool labels.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Eleven major antivirus engines did not flag the file.
- The completed sandbox did not issue a malicious runtime verdict.
- All seven observed hosts received a complete reputation check without a cached malicious or suspicious match.
- The file is broadly prevalent, with 3,713 submitters and 41,997 submissions.
- No malicious file it created was identified.
- Thirty-two of the 70 antivirus engines that checked it flagged the DLL, including six major detections.
- Multiple vendors independently identify it as a crack, hacking tool, or game-hacking component.
- The executable DLL has no verified publisher signature.
- Four code-similar files previously received matching Crack hacking tool assessments.
- The test run recorded privilege-related and archive-related offensive techniques.
- A malware-specific FreddyBearDropper YARA rule matched the file.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 7sandbox rule tags
- 14spawned processes
- 0network contacts
- 2filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How hacking tools are used
Hacking tools are programs that can switch off security software, test passwords or attack other computers. Security professionals use them on purpose; criminals also bundle them with malware.
Bottom line:Keep it only if you installed it on purpose, and check how it got onto the device if you didn't.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 4: FileSeen in the test run
OnlineFix64.dll
54a65b4e133c6a4ff7107b4b9c868e10c3ba606bb42d8c687054b0a64fafa944
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 4: ProcessSeen in the test run
rundll32.exe
"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\readme.dll",#1
Test run - Evidence 3 of 4: ProcessSeen in the test run
loaddll64.exe
C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\OnlineFix64.dll"
Test run - +1 more recorded observation
- 1
Files
Created or changed
- Evidence 4 of 4: Written fileSeen in the test run
Connect
\Device\ConDrv\\Connect
Test run
4 facts from the test run. See the full activity list.
Includes 7 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
32 of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 32
- Avira (major engine)APPL/AgentW64.ToolX
- ESET-NOD32 (major engine)Win64/HackTool.Crack.AA potentially unsafe application
- F-Secure (major engine)Program.APPL/AgentW64.ToolX
- Fortinet (major engine)Riskware/Application
- Ikarus (major engine)PUA.GameHack.0xdeadc0de
- Sophos (major engine)Generic Reputation PUA (PUA)
- TrellixENS (major engine)Artemis!485FA45F1886
- AhnLab-V3Packed/Win.VMProtect.R699164
File fingerprint
- Last analyzed
- Oct 9, 2026, 11:22 PM UTC
- SHA-256
54a65b4e133c6a4ff7107b4b9c868e10c3ba606bb42d8c687054b0a64fafa944- SHA-1
3833e8c37c6181ff148e0ca19f28145f9b80a8a9- MD5
485fa45f1886c44a1f2dbf7b8c132971
About this file
OnlineFix64.dll is a Win32 DLL file of 11.9 MB.
- Type and size
- Win32 DLL · 11.9 MB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 21, 2025On VirusTotal.
- Submitted by
- 3,713 distinct sources
- Packer
- None detected
- Entropy
- 7.79 of 8
First scanned
Includes every engine result (75), 3 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is OnlineFix64.dll a virus?
What is OnlineFix64.dll?
How many antivirus engines detected OnlineFix64.dll?
What should I do if I already used OnlineFix64.dll?
How do I remove OnlineFix64.dll?
What kind of program is OnlineFix64.dll?
What is the SHA-256 hash of OnlineFix64.dll?
How up to date is this analysis of OnlineFix64.dll?
Community
Member reviews and reports for this exact file hash.