File verdict·Decided by the MT AI Engine

Our call

Safe

Item: libSkiaSharp.dll
Rating: 4.5
Author: MalwareTips File Scanner

Microsoft-signed graphics library (libSkiaSharp.dll) with zero malicious detections across 71 engines and consistent safe history.

Verified · Microsoft Corporation

Trust score88High trust

MT AI confidence · 92%

libSkiaSharp.dll

9.0 MB

9a0d95e8caaa852c70…75a8a1dbcd

Antivirus engines

0 of 75 flagged

Code signing

Signed by Microsoft Corporation

Age

First seen 2y ago

MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

92%Confidence

Very high

Reasoning

The evidence strongly supports a safe classification. Zero malicious detections across 71 engines, including 17 tier-1 vendors (Avast, BitDefender, ESET, Kaspersky, Fortinet, etc.), combined with a verified Microsoft signature and 100% safe history in our signer database, establish high confidence. The file is widely distributed (3,000+ submitters, 4,257 submissions) and classified as common_old, indicating established legitimacy. Triggered heuristics (process injection, anti-debugging YARA rules) are consistent with defensive patterns in legitimate graphics libraries undergoing sandbox testing, not malware consensus. No malicious sandbox verdicts, contacted hosts, or dropped children were observed.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

engines: 0/71 malicious; tier1Malicious=0; tier1ReportedClean=17 (Avast, BitDefender, ESET, Kaspersky, Fortinet, Emsisoft, Ikarus, DrWeb, F-Secure, GData)
signing.verified=true, signer='Microsoft Corporation', trustedPublisher.matched=true
signerStats: 2/2 safe (100% safeRate); similarHashes shows 2/2 prior 'safe' verdicts for Microsoft-signed files (matchKind=signer)
prevalence: common_old (3000 submitters, 4257 submissions) — widely distributed commodity library
triggeredHeuristics: T1055 (process injection) and YARA matches are anti-debugging/environment-detection patterns typical of legitimate graphics libraries, not malware consensus

Points in its favour

Verified Microsoft Corporation signature (trusted publisher)
Zero malicious detections across 71 engines; 17 tier-1 vendors report clean
100% safe history in signer database (2/2 prior samples)
Common_old prevalence (3,000+ submitters, 4,257 submissions)
No malicious sandbox verdict, contacted hosts, or dropped children

What to do

This file is safe. No further action is needed. It is a legitimate Microsoft-signed graphics library commonly used in .NET applications.

Threat family attribution

Check OutputDebugStringA iat corroborated by 1 source

8 YARA rules
Check_OutputDebugStringA_iat, DebuggerCheck__API, golang_bin_JCorn_CSC846

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK

Adversary techniques mapped to the MITRE ATT&CK framework.

T1027T1027.002T1045T1047T1055T1057T1059T1063T1071T1082T1083T1129T1198T1218.011T1497T1497.001T1518.001T1562.001T1574.002

Spawned processes

$(unnamed)

"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\library.dll",#1

$(unnamed)

C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\readme.dll"

$(unnamed)

C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

$(unnamed)

C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\readme.dll",#1

$(unnamed)

C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\readme.dll",#1

$(unnamed)

C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\readme.dll,KeepSkiaCSymbols

$(unnamed)

C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\readme.dll,gr_backendrendertarget_delete

$(unnamed)

C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7924 -s 316

+7 more processes captured.

Filesystem & mutexes

Files written15

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AE7.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AE7.tmp.dmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B85.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B85.tmp.WERInternalMetadata.xml
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C41.tmp

+10 more

Files deleted8

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AE7.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AE7.tmp.dmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B85.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C41.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WER26DE.tmp

+3 more

Mutexes created10

\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7924
\Sessions\1\BaseNamedObjects\Global\b47e9359-e272-4f7e-a1f7-d44899f370bb
\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8084
\Sessions\1\BaseNamedObjects\Global\10d5090b-434d-431f-9d55-31f7994bceb7
\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3956

+5 more

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen

60daa1f8d5664f16c590…689649Never scanned
never seen before
f83b1162efd10d21cb66…7804b3Never scanned
never seen before
c5ef5fa77451515eaaeb…acd15aNever scanned
never seen before
876f1644ca7b4b87da12…c4e39fNever scanned
never seen before
f180f31cef1f81920e8f…c47a9bNever scanned
never seen before
48bce9874974a2253126…156770Never scanned
never seen before
c0ebd7f9805c1916f8dc…40d6a1Never scanned
never seen before
d149a2b61a05e56e5beb…1eb865Never scanned
never seen before
028946662c15c863298f…0c1782Never scanned
never seen before
6fea58b29d59f7a310a0…85d629Never scanned
never seen before

External threat intelligence

1 corroborating signal from researcher-curated sources

YARAify HIT·8 community rules matchedView on YARAify

Check_OutputDebugStringA_iat
DebuggerCheck__API
golang_bin_JCorn_CSC846by Justin Cornwell
CSC-846 Golang detection ruleset
HUNTING_SUSP_TLS_SECTIONby chaosphere
Detect PE files with .tls section that can be used for anti-debugging
MD5_Constantsby phoul (@phoul)
Look for MD5 constants

Cross-referenced against MalwareBazaar (abuse.ch), YARAify, and the CIRCL hashlookup reference DB.

Signature matches

YARA + heuristic rules that fired

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

5 YARAify1 synthesis

MITRE ATT&CK profile

Defense evasion× 1

YARAify (community)

Researcher-authored rules via abuse.ch

Check_OutputDebugStringA_iat
DebuggerCheck__API
golang_bin_JCorn_CSC846
HUNTING_SUSP_TLS_SECTION
MD5_Constants

MalwareTips synthesis rules

Our heuristics on VT data + sandbox behaviour

ProcessInjection
T1055
high
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence
"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\library.dll",#1

Antivirus engine breakdown

0 detections across 75 engines

0 malicious0 suspicious75 clean

Tier-117 engines

0flag

Top commercial AVs (low FP rate)

Tier-238 engines

0flag

Mainstream engines with mixed FP rates

Low-trust20 engines

0flag

Heuristic / generic-AI engines (high FP rate)

All 75 engines report this file as clean.

Hash 9a0d95e8caaa… cross-referenced against 75 AV engines via our AV network.

PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 7.49Unpacked

Section entropy10 sections

.text

6.45

.rdata

5.67

.data

5.63

.pdata

6.49

.00cfg

0.43

.gehcont

0.44

.tls

0.02

.voltbl

1.03

_RDATA

2.47

.reloc

5.45

0.0Packed threshold 7.28.0

Prevalence

How often this file shows up in the wild

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

3,000

Hundreds of people have uploaded this — common.

Total submissions

4,257

Includes repeat uploads by the same source.

First seen by VT

2y ago

Nov 11, 2024

Prevalence quadrant

Rare · New

Targeted malware lives here

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Trusted legitimate binaries

File identity

Forensic fingerprint

File biography

First seen (VT)

11/11/2024, 12:02:35 PM

First seen (MalwareBazaar)

—

Last analysis (VT)

6/10/2026, 12:15:22 AM

Scanned here

6/10/2026, 9:41:32 AM

File name: libSkiaSharp.dll
Size: 8.98 MB
MIME type: (unknown)
Detected type: Win32 DLL
SHA-256: 9a0d95e8caaa852c70d085af6a40a744242172ad9ea3fd6bc7599875a8a1dbcd
MD5: ef1fabce43fe32ca83260481253f5476
SHA-1: ad988af9826e5aacc7b8e5ed6d220b229d70060e
PE imphash: ffe661c0b06e35c1f2a6559c922e2926
First seen (VT): 11/11/2024, 12:02:35 PM
Last analysis (VT): 6/10/2026, 12:15:22 AM
First scan (MalwareTips): 6/10/2026, 9:41:32 AM
Last scan (MalwareTips): 6/10/2026, 9:41:32 AM
Code signer: Microsoft Corporationverified
Community reputation: +1trusted

Behavior tags

detect-debug-environmentsignedcalls-wmipedll64bitschecks-biosoverlay

Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…

Loading reports…

Scan another

Check a different file

URL instead?

Check if a link is safe

Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.