MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Suspicious

Unsigned 64-bit DLL with one tier-1 detection and mixed imphash history shows borderline signals.

tl0101dg26zh
Trust score48Caution
MT AI confidence · 65%
vray_v41003_fix.dlr
3.5 KB
5586668d58c8320d23…13b64aa5f2
Antivirus engines
4 of 74 flagged
Code signing
Unsigned
Age
First seen 7y ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

65%Confidence
High
Reasoning

The engine set is sparse (4 malicious out of 66) yet includes a tier-1 detection, preventing a clean low-trust FP dismissal. Absence of code signing and any trusted-publisher history removes the benign-signed-installer safety net. Sandbox execution produced only ambient techniques and no malicious host contact, lowering immediate risk. Historical imphash matches split between safe and suspicious, so the file cannot be confidently cleared or condemned.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. TrendMicro-HouseCall tier1 detection: Trojan.Win64.Gen.TL0101DG26ZH

  2. signing.verified=false, signerStats.found=false

  3. similarHashes[0].verdict=suspicious (imphash match)

  4. engines.malicious=4 with tier1Malicious=1

  5. behaviour.hasMaliciousSandboxVerdict=false, offensiveCount=0

Points in its favour
  • Zero offensive MITRE techniques
  • No malicious sandbox verdict
  • Medium prevalence over 7 years
Points against
  • Unsigned DLL
  • Tier-1 engine detection present
  • Filename suggests crack/patch utility
What to do

Treat as untrusted; do not load in production environments without additional verification or sandbox testing.

Threat family attribution

tl0101dg26zh corroborated by 2 sources

  • VT (74 engines)
    tl0101dg26zh
  • MT AI Engine
    tl0101dg26zh
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
6

Adversary techniques mapped to the MITRE ATT&CK framework.

T1027.002T1033T1082T1218.011T1497T1518.001
Spawned processes
8
$(unnamed)
"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\init.dll",#1
$(unnamed)
C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\init.dll"
$(unnamed)
C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
$(unnamed)
C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\init.dll",#1
$(unnamed)
C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\init.dll",#1
$(unnamed)
C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\init.dll,CanAutoDefer
$(unnamed)
C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\init.dll,LibClassDesc
$(unnamed)
C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\init.dll,LibDescription
Filesystem & mutexes
1
Files written1
  • \Device\ConDrv\\Connect
No researcher-database hits
External threat-intel sources were not collected for this scan.
Antivirus engine breakdown

4 detections across 74 engines

4 malicious0 suspicious70 clean
Tier-117 engines
1flag
Top commercial AVs (low FP rate)
Tier-238 engines
1flag
Mainstream engines with mixed FP rates
Low-trust19 engines
2flag
Heuristic / generic-AI engines (high FP rate)
Cynet
malicious
Malicious (score: 100)
Malwarebytes
malicious
Malware.Heuristic.2126
McAfeeD
malicious
ti!5586668D58C8
TrendMicro-HouseCall
malicious
Trojan.Win64.Gen.TL0101DG26ZH
Hash 5586668d58c8… cross-referenced against 74 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

Unpacked
Section entropy2 sections
.text
6.00
.data
5.64
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium
Unique uploaders
23
Moderate upload volume.
Total submissions
27
Includes repeat uploads by the same source.
First seen by VT
7y ago
Apr 1, 2019
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
4/1/2019, 1:09:04 PM
First seen (MalwareBazaar)
—
Last analysis (VT)
7/1/2026, 11:03:16 PM
Scanned here
7/3/2026, 9:54:53 AM
File name
vray_v41003_fix.dlr
Size
3.5 KB
MIME type
(unknown)
Detected type
Win32 DLL
SHA-256
5586668d58c8320d234edcebc9bc861b997b716d7e61d77a9afb0013b64aa5f2
MD5
cb89019b27a4eed1c7ba33f3149eb65c
SHA-1
92a0b7b33ef7c20e0fed8e776dc5e2950d991711
PE imphash
6e19abb36f191604c3793aee28e89b75
First seen (VT)
4/1/2019, 1:09:04 PM
Last analysis (VT)
7/1/2026, 11:03:16 PM
First scan (MalwareTips)
7/3/2026, 9:54:53 AM
Last scan (MalwareTips)
7/3/2026, 9:54:53 AM
Behavior tags
pedll64bitsdetect-debug-environment
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.