Suspicious
Unsigned DLL with process injection, direct-IP C2, and anti-debug YARA matches, but tier-1 engines silent on a 2043-day-old common file.
5a42440a18a75ce588…56d871db42The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The evidence presents a genuine conflict. On one hand, the behavioural indicators are severe: process injection, reflective code loading, anti-debug checks, and direct-IP C2 contact are hallmarks of evasive malware. Five community YARA rules converged on anti-debug and code-injection patterns, and FileScan.IO independently flagged it 'LIKELY_MALICIOUS' with 100% confidence. On the other hand, tier-1 engines (Kaspersky, BitDefender, ESET, Fortinet, Avast, Emsisoft, Ikarus, DrWeb, F-Secure, GData, Avira, AVG) all report clean, and the file has been widely distributed (2933 submitters, 4055 submissions) since 2020 without triggering signature-based detection. No malicious sandbox verdict was recorded, and dropped children are unknown, not malicious. The most likely explanations are: (1) a legitimate research or debugging tool (possibly OpenAL-related, given the filename 'soft_oal.dll') that uses anti-debug and code-injection patterns for legitimate purposes, or (2) sophisticated malware with evasion that bypasses signatures but is caught by heuristic and YARA analysis. The tier-1 silence and high prevalence favour (1), but the strong behavioural signals and community verdict favour (2). This is a borderline case requiring manual review.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
tier1Malicious=0; tier1ReportedClean=17 (Avast, BitDefender, Kaspersky, ESET, Fortinet, Emsisoft, Ikarus, DrWeb, F-Secure, GData, Avira, AVG) — no tier-1 consensus family, but also no tier-1 malicious flags
behaviour.offensiveTechniques: T1055 (process injection), T1055.003 (reflective DLL), T1562.001 (disable defences), T1620 (reflective code loading) — 4 offensive MITRE techniques
behaviour.contactedIps: 135.233.45.222 (direct-IP C2, no DNS) — bypasses reputation systems and domain blocklists
yaraify.ruleCount=5: Check_OutputDebugStringA_iat, DebuggerCheck__API, pe_detect_tls_callbacks, SEH__vectored, ThreadControl__Context — community researchers matched anti-debug and code-injection patterns
communityComments: FileScan.IO verdict 'LIKELY_MALICIOUS' (100% confidence) with tags anti-debug, lolbin, shell32, pedll — independent corroboration
- 17 tier-1 antivirus engines report clean (Kaspersky, BitDefender, ESET, Fortinet, Avast, Emsisoft, Ikarus, DrWeb, F-Secure, GData, Avira, AVG)
- Common_old prevalence: 4055 submissions from 2933 unique sources since 2020 — widely distributed without mass-detection
- No malicious sandbox verdict recorded
- No malicious dropped children (3 inspected, all unknown verdict)
- No malicious contacted hosts in our URL cache
- Process injection (T1055, T1055.003) — payload smuggled into legitimate process to bypass AV hooks
- Direct-IP C2 contact (135.233.45.222) without DNS — bypasses reputation systems and domain blocklists
- Anti-debug checks (OutputDebugStringA, DebuggerCheck API) — evasion technique to detect analysis environment
- Reflective code loading (T1620) — in-memory code execution to avoid disk detection
- Disable defences (T1562.001) — attempt to neutralise security controls
- Five community YARA rules matched — anti-debug, TLS callbacks, SEH vectored exception handling, thread context manipulation
This file requires manual security review due to conflicting signals. If encountered unexpectedly, isolate the system and perform a full malware scan. If you are a researcher or developer, verify the file's legitimate purpose (it may be an OpenAL library or debugging tool) before execution in any environment.
Check OutputDebugStringA iat corroborated by 1 source
- 5 YARA rulesCheck_OutputDebugStringA_iat, DebuggerCheck__API, pe_detect_tls_callbacks
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 135.233.45.222
- \Device\ConDrv\\Connect
- \Sessions\1\BaseNamedObjects\DBWinMutex
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache.
- 8df0190608b744da48b3…f5a6cbNever scannednever seen before
- 92bf2ae2683a42ed4c1f…21635bNever scannednever seen before
- 3c269b4937d5ae31eb0e…e7f261Never scannednever seen before
1 corroborating signal from researcher-curated sources
- Check_OutputDebugStringA_iat
- DebuggerCheck__API
- pe_detect_tls_callbacks
- SEH__vectored
- ThreadControl__Context
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
- Check_OutputDebugStringA_iat
- DebuggerCheck__API
- pe_detect_tls_callbacks
- SEH__vectored
- ThreadControl__Context
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\library.dll",#1Sample contacted 1 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence135.233.45.222
0 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Forensic fingerprint
- File name
- soft_oal.dll
- Size
- 1.69 MB
- MIME type
- (unknown)
- Detected type
- Win32 DLL
- SHA-256
- 5a42440a18a75ce588659158d74d26ab1850eabd34f3b25abd969a56d871db42
- MD5
- ff08ba3a9dfe6bd0b26f9055094c9550
- SHA-1
- 2dd9130b6dd4c49864635b1b7cc4a93ebcdd5e17
- PE imphash
- 31b92c8d254efbdb21daa422d2e38a77
- First seen (VT)
- 11/5/2020, 7:01:48 AM
- Last analysis (VT)
- 6/10/2026, 12:17:51 AM
- First scan (MalwareTips)
- 6/10/2026, 9:31:18 AM
- Last scan (MalwareTips)
- 6/10/2026, 9:31:18 AM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.