File scan report
Verdict Safe
Is winhttp.
Unsigned 18 kB DLL with zero engine detections and clean sandbox behaviour.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
The sample shows no malicious indicators from engines or sandbox; treat as safe unless additional context suggests otherwise.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 69 flagged
- Flagged 0
- No detection 69
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 3mo ago
Chapter 02
Why we think so
1 point against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No antivirus engine flagged the file. Sandbox execution produced no malicious indicators and no children were malicious.
All 69 antivirus engines that checked it returned clean results, including 16 major antivirus engines. The file is unsigned and only one day old, yet the sandbox recorded only techniques common in legitimate software and no malicious verdict. The single triggered rule is medium severity and can occur with legitimate software. Medium prevalence across five sources further supports a benign classification.
What We Detected
74 engines scanned the 18 kB Win32 DLL; none returned a malicious or suspicious result. The file is unsigned and first appeared on Jul 22, 2026.
Threat Behavior
Sandbox execution showed 14 MITRE techniques common in legitimate software and zero offensive techniques. One external IP was contacted directly without DNS resolution, triggering a medium-severity heuristic, but no malicious verdict was issued and no malicious files it created were dropped.
What To Do Now
The file can be treated as clean for most purposes.
Where this verdict could be wrong1 caveat
- One of our behaviour rules is medium severity and can trigger on legitimate software that hard-codes IPs; absence of domains alone is not decisive.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero engine detections across 74 scanners
- Clean sandbox verdict
- No malicious files it created
- Unsigned DLL
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 14sandbox rule tags
- 9spawned processes
- 0network contacts
- 7filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
14MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.005· Obfuscated code
- T1033· Reads user info
- T1036
- T1059· Runs commands
- T1070· Covers its tracks
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1129· Loads modules
- T1218.011
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1574· Execution hijack
Observed activity
Processes started
9Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\winhttp.dll",#1loaddll64.exeC:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\winhttp.dll"cmd.exeC:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\winhttp.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\winhttp.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\winhttp.dll,DllMainrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\winhttp.dll,WinHttpAddRequestHeaders
Show all 9 entries for processes started
rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\winhttp.dll,WinHttpCloseHandlerundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\winhttp.dll",DllMainrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\winhttp.dll",WinHttpAddRequestHeaders
Files
7Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\AdobeGCInvoker\winhttp.dll - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\AdobeGCInvoker\AdobeGCInvoker.exe - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\AdobeGCInvoker\Adobe.Acrobat.Dependencies.manifest - Written
C:\Users\user\AppData\Local\Microsoft\Windows\AdobeGCInvoker\ - Written
C:\Users\user\AppData\Local\Microsoft\Windows\AdobeGCInvoker\winhttp.dll - Written
C:\Users\user\AppData\Local\Microsoft\Windows\AdobeGCInvoker\winhttp.dll\:Zone.Identifier:$DATA
Show all 7 entries for files
- Written
\Device\ConDrv\\Connect
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- 255a65d30841ab4082bd…c12309Not checkedno saved verdict
Chapter 04
Technical details
None of the 69 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jul 23, 2026, 12:46 PM UTC
- SHA-256
5f63675b27263c446278bac88dc24345106b44294da8c20adfaa012fa4296e6e- SHA-1
b7c309770f9097f05a532babd11d432b0eb5cff2- MD5
eb4ce706240023cda8317b50043af383
About this file
winhttp.dll is a Win32 DLL file of 18.4 kB.
- Type and size
- Win32 DLL · 18.4 kB
- Signer
- UnsignedNo code signature.
- First seen
- Jul 22, 2026On VirusTotal.
- Submitted by
- 5 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 5.03 of 8
First scanned
Antivirus consensus
0 of 69 engines flagged this file
5 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-235 engines0flagged
- Low-trust17 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is winhttp.dll safe?
What is winhttp.dll?
How many antivirus engines detected winhttp.dll?
What is the SHA-256 hash of winhttp.dll?
Is it safe to use winhttp.dll?
How up to date is this analysis of winhttp.dll?
Community
Member reviews and reports for this exact file hash.