File scan report
Verdict Safe
Is libcrypto safe? Yes, no threats found.
No engine detected this established, correctly signed CD PROJEKT library, while isolated sandbox technique mappings lacked a malicious verdict or corroborating threat intelligence.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 4
- Code signing CD PROJEKT S.A.
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
4 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 70 antivirus engines that checked it were free of detections, including 17 major antivirus engines, and the DLL carries a verified CD PROJEKT S.A. signature. One sandbox mapped process-injection and defense-impairment techniques, but issued no malicious verdict; those mappings are outweighed by the sample's broad prevalence, valid signature, and lack of corroboration.
The DLL received no malicious or suspicious detection from 74 engines, with all 17 participating major antivirus engines reporting no detection. Its signature verifies to CD PROJEKT S.A., and no claimed-brand conflict was identified. The sample is well established, appearing across 618 sources and 670 submissions over 431 days. A completed sandbox mapped activity to and T1562.001, but did not issue a malicious verdict or observe persistence. No malicious child, known-malware intelligence hit, YARA rule match, packing indicator, or family consensus corroborates those behavioral mappings. No complete contacted-host reputation result is available, although the sandbox recorded no network contacts.
What We Detected
No malicious or suspicious detections appeared among 74 antivirus engines, including 17 major antivirus engines. The DLL has a verified digital signature from CD PROJEKT S.A., no brand mismatch, and substantial prevalence across 618 sources and 670 submissions.
Threat Behavior
One completed sandbox mapped activity to MITRE T1055 and T1562.001, partly from execution through rundll32. These technique mappings can be associated with hostile activity, but they do not establish intent by themselves; the sandbox issued no malicious verdict and recorded no persistence indicators. Six written child hashes were inspected without a malicious result, although all six remain unclassified. No network contacts were recorded during the run, and a separate complete host-reputation cross-check is unavailable.
What To Do Now
Use the DLL only when it came with an expected CD PROJEKT installation or update, and retain security software. If it appeared unexpectedly or outside the legitimate application directory, verify the parent installation and the file's signature before loading it.
Where this verdict could be wrong3 caveats
- The completed sandbox mapped activity to and T1562.001, including rundll32 execution; these are risk-relevant technique mappings even though the sandbox issued no malicious verdict.
- A signer history of 1 earlier file provides too little history to establish an independently strong publisher track record.
- droppedChildren inspected six hashes, but a count of 6 dropped files without a saved verdict means their lack of a malicious child verdict is not equivalent to confirmed benign children.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/70 engines reported a malicious or suspicious detection.
- Verified signature from CD PROJEKT S.A.
- Observed across 618 sources and submitted 670 times.
- No packing, high-entropy code, persistence, or external-intelligence match was identified.
- Sandbox technique mapping includes process injection.
- Sandbox technique mapping includes defense impairment.
- The DLL was exercised through rundll32 during analysis.
- Signer history contains only one prior sample.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 17sandbox rule tags
- 10spawned processes
- 0network contacts
- 39filesystem & mutex artifacts
Includes 17 mapped techniques, every process, file, registry and network entry and 6 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; signed by CD PROJEKT S.A..
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 23, 2026, 4:33 AM UTC
- SHA-256
869f1cef88360f2da7662ab689e805f0f63ccafd9d3b62ec98cc73a48d2b064f- SHA-1
a7b72d643a72e353f9600f5ac1c1578be0e2f492- MD5
3b8542f069f6637850f80b58162c91f1
About this file
libcrypto is a Win32 DLL file of 3.3 MB.
- Type and size
- Win32 DLL · 3.3 MB
- Signer
- CD PROJEKT S.A.Valid code signature.
- First seen
- Jul 19, 2025On VirusTotal.
- Submitted by
- 618 distinct sources
- Packer
- None detected
- Entropy
- 7.65 of 8
First scanned Updated
Includes every engine result (74), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is libcrypto safe?
What is libcrypto?
How many antivirus engines detected libcrypto?
Is libcrypto digitally signed?
What is the SHA-256 hash of libcrypto?
Is it safe to use libcrypto?
How up to date is this analysis of libcrypto?
Community
Member reviews and reports for this exact file hash.