Safe
Widely distributed OpenSSL library signed by Python Software Foundation; 17 tier-1 engines clean; 4+ year history with zero detections.
976ce72efd0a8aeeb6…7cdb149541The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The evidence strongly supports a benign classification. All 17 tier-1 antivirus engines (Kaspersky, BitDefender, ESET-NOD32, Avast, Fortinet, and others) report the file clean or undetected. The file is signed by Python Software Foundation, a trusted publisher on our curated list. Prevalence data shows 11,568 submissions from 181 unique sources over 4+ years with zero malicious detections — a clear indicator of a legitimate, widely distributed library. The T1055 process-injection heuristic fired, but the evidence is a benign rundll32.exe command loading a DLL from the Desktop, a common pattern for legitimate DLL testing. No malicious sandbox verdict, no malicious children, and no malicious contacted hosts further support the benign classification. The file's presence in malware research repositories (vx-underground, virus.exchange) reflects its use as a reference sample for comparative analysis, not evidence of malice.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
tier1Malicious=0; 17 tier-1 engines (Kaspersky, BitDefender, ESET-NOD32, Avast, Fortinet, etc.) all report clean/undetected
signing.verified=true, trustedPublisher.matched=true for 'Python Software Foundation'
prevalence: common_old, 181 submitters, 11,568 submissions since 2022-09-06 — 4+ year history with zero malicious detections
T1055 heuristic fired but evidence is benign rundll32.exe DLL-load pattern; no malicious sandbox verdict, no malicious children, no malicious contacted hosts
File is libcrypto (OpenSSL crypto library), high entropy expected for compiled cryptographic code; no packer, not packed
- Signed by Python Software Foundation (trusted publisher)
- 17 tier-1 antivirus engines report clean
- 11,568 submissions over 4+ years with zero malicious detections
- No malicious sandbox verdict, no malicious children, no malicious contacted hosts
- Consistent with legitimate OpenSSL library bundled in Python
This file is safe. It is a legitimate OpenSSL cryptographic library signed by Python Software Foundation and widely distributed with zero malicious detections across 4+ years and 11,500+ submissions. No action is required.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- C:\ProgramData\Microsoft\Windows\WER\Temp
- C:\ProgramData\Microsoft\Windows\WER\Temp\20d1bed9-3757-4387-8155-e7e8371ef456
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue
- C:\ProgramData\Microsoft\Windows\WER\Temp\1d7d2bac-a7eb-4853-b052-cfb5c61a09f6
- C:\ProgramData\Microsoft\Windows\WER\ReportArchive
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER5644.tmp
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER5DD6.tmp
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F1F.tmp
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER5644.tmp.dmp
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER5DD6.tmp.WERInternalMetadata.xml
- Local\WERReportingForProcess4148
- Global\AmiProviderMutex_InventoryApplicationFile
- Global\c5e8368a-5afa-4fca-977a-2735c16de783
- DBWinMutex
- \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7124
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- f30b38da8cd556e36f1c…a0ea5fNever scannednever seen before
- 2a77405e04c7e07c0e5c…757486Never scannednever seen before
- c182c23df455e94eb25f…daed64Never scannednever seen before
- 362fcd6c89d5d0bebb38…0613fcNever scannednever seen before
- ea0cfa8e968623b11813…cd95e6Never scannednever seen before
- 823e22ecbe77e72d2c51…e3d841Never scannednever seen before
- a289a786099746cdf2d2…31d186Never scannednever seen before
- 4c598c2eec9f38bc7d12…27e552Never scannednever seen before
- 71d0efdcf3d505d52786…d78c81Never scannednever seen before
- 53d690f150cdca161714…3646d3Never scannednever seen before
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\attachment.dll",#1
0 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Forensic fingerprint
- File name
- libcrypto
- Size
- 3.28 MB
- MIME type
- (unknown)
- Detected type
- Win32 DLL
- SHA-256
- 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
- MD5
- 6f4b8eb45a965372156086201207c81f
- SHA-1
- 8278f9539463f0a45009287f0516098cb7a15406
- PE imphash
- 11f2ed72076bbf7871eb95fd5b4e84b0
- First seen (VT)
- 9/6/2022, 7:17:00 AM
- Last analysis (VT)
- 6/6/2026, 11:09:39 AM
- First scan (MalwareTips)
- 7/10/2026, 11:55:00 PM
- Last scan (MalwareTips)
- 7/10/2026, 11:55:00 PM
- Code signer
- Python Software Foundationverified
Safety FAQ
Common questions about libcrypto, answered from the scan data above.
- libcrypto appears safe. 75 of 75 antivirus engines report it clean. It carries a verified digital signature from Python Software Foundation. As a habit, only open files you downloaded from the official source, since attackers sometimes distribute trojanised copies of legitimate software under the same name.
- libcrypto is a file, about 3.3 MB. Our analysis found no threat indicators for it. It carries a verified digital signature from Python Software Foundation. A file's name can be reused by different files, so we identify it by its cryptographic hash (below).
- None — all 75 antivirus engines we queried report libcrypto as clean. That's reassuring, though brand-new malware can briefly evade detection before vendors add signatures, so we also weigh the file's behaviour and reputation.
- Yes — libcrypto carries a valid digital signature from Python Software Foundation, which confirms the file hasn't been tampered with since that publisher signed it. A valid signature is a positive signal, but note that malware is occasionally signed with stolen or abused certificates, so it isn't proof of safety on its own.
- The SHA-256 hash of libcrypto is 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541, and its MD5 is 6f4b8eb45a965372156086201207c81f. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
- Based on this scan, yes — libcrypto shows no threat indicators and is properly signed. The important caveat is source: make sure you downloaded it from the official website or a trusted store, because attackers sometimes distribute malware-laced copies under a legitimate file's name. If your own antivirus flags it while we report it clean, that is most often a false positive, but verify the source before overriding your antivirus.
- This report reflects the scan run on July 10, 2026. Because a file's hash never changes, the identity of libcrypto is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.