libcrypto appears safe. 74 of 74 antivirus engines report it clean. It carries a verified digital signature from CD PROJEKT S.A.. As a habit, only open files you downloaded from the official source, since attackers sometimes distribute trojanised copies of legitimate software under the same name.

libcrypto is a file, about 3.1 MB. Our analysis found no threat indicators for it. It carries a verified digital signature from CD PROJEKT S.A.. A file's name can be reused by different files, so we identify it by its cryptographic hash (below).

How many antivirus engines detected libcrypto?

None — all 74 antivirus engines we queried report libcrypto as clean. That's reassuring, though brand-new malware can briefly evade detection before vendors add signatures, so we also weigh the file's behaviour and reputation.

Is libcrypto digitally signed?

Yes — libcrypto carries a valid digital signature from CD PROJEKT S.A., which confirms the file hasn't been tampered with since that publisher signed it. A valid signature is a positive signal, but note that malware is occasionally signed with stolen or abused certificates, so it isn't proof of safety on its own.

What is the SHA-256 hash of libcrypto?

The SHA-256 hash of libcrypto is 869f1cef88360f2da7662ab689e805f0f63ccafd9d3b62ec98cc73a48d2b064f, and its MD5 is 3b8542f069f6637850f80b58162c91f1. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.

Is it safe to open libcrypto?

Based on this scan, yes — libcrypto shows no threat indicators and is properly signed. The important caveat is source: make sure you downloaded it from the official website or a trusted store, because attackers sometimes distribute malware-laced copies under a legitimate file's name. If your own antivirus flags it while we report it clean, that is most often a false positive, but verify the source before overriding your antivirus.

How up to date is this analysis of libcrypto?

This report reflects the scan run on July 13, 2026. Because a file's hash never changes, the identity of libcrypto is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.

File verdict·Decided by the MT AI Engine

Our call

Safe

Item: libcrypto
Rating: 4.5
Author: MalwareTips File Scanner

Widely submitted signed DLL with zero malicious detections and clean sandbox behaviour.

Verified · CD PROJEKT S.A.

Trust score88High trust

libcrypto

3.1 MB

869f1cef88360f2da7…a48d2b064f

Antivirus engines

0 of 74 flagged

Code signing

Signed by CD PROJEKT S.A.

Age

First seen 12mo ago

MT AI Engine · Verdict analysis

The reasoning behind this verdict

The MT AI Engine weighs every signal from this scan — antivirus detections, sandbox behaviour, code signing, prevalence and historical matches — to reach a single, evidence-based verdict.

85%Confidence

Very high

Reasoning

Zero detections across 62 reporting engines, including 11 tier-1 clean reports, combined with verified signing and common_old prevalence strongly indicate a legitimate library. The sandbox observed T1055 process injection techniques via rundll32, but returned no malicious verdict and no malicious children or host contacts. The triggered heuristic is therefore outweighed by the absence of any corroborating malicious signals.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

engines: 0 malicious detections out of 74 total (11 tier-1 clean)
signing.verified=true, signer='CD PROJEKT S.A.'
prevalence.classification='common_old' (483 sources, 526 submissions)
behaviour.hasMaliciousSandboxVerdict=false, droppedChildren.hasMaliciousChild=false
triggeredHeuristics[0].rule='MalwareTips.Synth.ProcessInjection' but sandbox shows no malicious outcome

Points in its favour

Zero malicious engine detections
Verified signature from CD PROJEKT S.A.
Common_old prevalence with hundreds of submitters
Clean sandbox verdict despite process-loading activity

Recommended action

Keep the file; it shows no malicious indicators across engines, signing, and sandbox analysis.

What to do now

This file looks safe based on everything we checked.

This file is safe to use.
Good habit: only download files from the official website or an app store.
Keep your antivirus and Windows updates switched on so you stay protected.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK

Adversary techniques mapped to the MITRE ATT&CK framework.

T1016· Network reconT1027· Obfuscated codeT1027.002· Obfuscated codeT1036T1055· Process injectionT1056· KeyloggingT1057· Lists programsT1071· Remote server (C2)T1082· System reconT1083· Scans your filesT1129· Loads modulesT1140· DeobfuscationT1218.011T1497· Sandbox evasionT1518.001· Checks your AVT1542.003T1562.001· Disables security

Spawned processes

$(unnamed)

"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\libcrypto-1_1-x64.dll",#1

$(unnamed)

C:\Windows\system32\WerFault.exe -u -p 6796 -s 520

$(unnamed)

C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\libcrypto-1_1-x64.dll"

$(unnamed)

C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

$(unnamed)

C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\libcrypto-1_1-x64.dll",#1

$(unnamed)

C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libcrypto-1_1-x64.dll",#1

$(unnamed)

C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4288 -s 432

$(unnamed)

C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\libcrypto-1_1-x64.dll,ACCESS_DESCRIPTION_free

+7 more processes captured.

Filesystem & mutexes

Files written15

C:\ProgramData\Microsoft\Windows\WER\Temp
C:\ProgramData\Microsoft\Windows\WER\Temp\c89db345-0d43-41f2-87bd-f8b96be9d443
C:\ProgramData\Microsoft\Windows\WER\ReportQueue
C:\ProgramData\Microsoft\Windows\WER\Temp\adac8696-8dd5-42d4-93a7-3debdcfd4284
C:\ProgramData\Microsoft\Windows\WER\ReportArchive

+10 more

Files deleted14

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC803.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD022.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD284.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC803.tmp.dmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD022.tmp.WERInternalMetadata.xml

+9 more

Mutexes created10

Local\WERReportingForProcess6796
Global\AmiProviderMutex_InventoryApplicationFile
Global\664bae7b-3308-4ad9-bc26-d6518643f2dc
\Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex
\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4288

+5 more

Dropped payload

Files this sample writes at runtime

This file drops 6 children at runtime. None are currently flagged malicious in our cache.

6 unseen

91ae88c3c93c1cb445d7…71eeb0Never scanned
never seen before
3f31bdaa97ea4c1b09f2…06d8b2Never scanned
never seen before
4625d148a2cebb341310…03459eNever scanned
never seen before
a7ac801c5bdb4c02ad6f…412019Never scanned
never seen before
d47869c21fc9b20cd49c…39bc0dNever scanned
never seen before
aa9df7127ca026ce319e…754ee6Never scanned
never seen before

No researcher-database hits

External threat-intel sources were not collected for this scan.

Signature matches

YARA & heuristic rule matches

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

1 synthesis

MITRE ATT&CK profile

Defense evasion× 1

MalwareTips synthesis rules

Our own detection rules, applied to the scan data and sandbox behaviour

ProcessInjection
T1055
high
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence
"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\libcrypto-1_1-x64.dll",#1

Antivirus engine breakdown

0 detections across 74 engines

0 malicious0 suspicious74 clean

Tier-117 engines

0flag

Top commercial AVs (low FP rate)

Tier-240 engines

0flag

Mainstream engines with mixed FP rates

Low-trust17 engines

0flag

Heuristic / generic-AI engines (high FP rate)

All 74 engines report this file as clean.

Hash 869f1cef8836… cross-referenced against 74 AV engines via our AV network.

PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 7.65Unpacked

Section entropy8 sections

.text

6.00

.rdata

5.17

.data

2.67

.pdata

5.84

.idata

3.10

.00cfg

0.43

.rsrc

1.82

.reloc

4.41

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

483

Hundreds of people have uploaded this — common.

Total submissions

526

Includes repeat uploads by the same source.

First seen

12mo ago

Jul 19, 2025

Prevalence quadrant

Rare · New

Targeted malware lives here

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Trusted legitimate binaries

File identity

Forensic fingerprint

File biography

First seen (VT)

7/19/2025, 12:24:47 AM

First seen (MalwareBazaar)

—

Last analysis (VT)

7/11/2026, 1:01:35 AM

Scanned here

7/13/2026, 4:19:14 PM

File name: libcrypto
Size: 3.12 MB
MIME type: (unknown)
Detected type: Win32 DLL
SHA-256: 869f1cef88360f2da7662ab689e805f0f63ccafd9d3b62ec98cc73a48d2b064f
MD5: 3b8542f069f6637850f80b58162c91f1
SHA-1: a7b72d643a72e353f9600f5ac1c1578be0e2f492
PE imphash: 9e838455ae7ea799f93ad26b13f1cafa
First seen (VT): 7/19/2025, 12:24:47 AM
Last analysis (VT): 7/11/2026, 1:01:35 AM
First scan (MalwareTips): 7/13/2026, 4:19:14 PM
Last scan (MalwareTips): 7/13/2026, 4:19:14 PM
Code signer: CD PROJEKT S.A.verified

Behavior tags

64bitschecks-user-inputoverlaypedlldetect-debug-environment

Frequently asked

Safety FAQ

Common questions about libcrypto, answered from the scan data above.

libcrypto appears safe. 74 of 74 antivirus engines report it clean. It carries a verified digital signature from CD PROJEKT S.A.. As a habit, only open files you downloaded from the official source, since attackers sometimes distribute trojanised copies of legitimate software under the same name.
libcrypto is a file, about 3.1 MB. Our analysis found no threat indicators for it. It carries a verified digital signature from CD PROJEKT S.A.. A file's name can be reused by different files, so we identify it by its cryptographic hash (below).
None — all 74 antivirus engines we queried report libcrypto as clean. That's reassuring, though brand-new malware can briefly evade detection before vendors add signatures, so we also weigh the file's behaviour and reputation.
Yes — libcrypto carries a valid digital signature from CD PROJEKT S.A., which confirms the file hasn't been tampered with since that publisher signed it. A valid signature is a positive signal, but note that malware is occasionally signed with stolen or abused certificates, so it isn't proof of safety on its own.
The SHA-256 hash of libcrypto is 869f1cef88360f2da7662ab689e805f0f63ccafd9d3b62ec98cc73a48d2b064f, and its MD5 is 3b8542f069f6637850f80b58162c91f1. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
Based on this scan, yes — libcrypto shows no threat indicators and is properly signed. The important caveat is source: make sure you downloaded it from the official website or a trusted store, because attackers sometimes distribute malware-laced copies under a legitimate file's name. If your own antivirus flags it while we report it clean, that is most often a false positive, but verify the source before overriding your antivirus.
This report reflects the scan run on July 13, 2026. Because a file's hash never changes, the identity of libcrypto is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.

Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…

Loading reports…

Scan another

Check a different file

URL instead?

Check if a link is safe

Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.