File scan report
Verdict Safe
Is lib
Nothing harmful found: none of the 71 antivirus engines that checked it flag it.
Strong evidence · Widely seen for a long time, and nothing harmful found.
This file is safe. It is the standard OpenGL ES graphics library used by graphics drivers and 3D applications. No action is required unless you have specific concerns about its source.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
0 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This file is the standard OpenGL ES 2.0 graphics library (libGLESv2.dll) distributed by graphics vendors and 3D applications. All 17 major antivirus engines report it clean, and it has been submitted 2,962 times by 2,430 unique sources over 369 days with zero malicious reputation.
libGLESv2.dll is a canonical graphics library from the Khronos Group OpenGL ES standard. The file shows no malicious detections (0/71 engines), with 17 major antivirus engines explicitly reporting it clean. Its prevalence is widely seen and long established (2,962 submissions, 2,430 unique sources), indicating it is an established, widely-distributed commodity file. The triggered 'one of our behaviour rules' rule-based reflects legitimate graphics-driver behaviour: graphics DLLs routinely inject themselves into application processes to provide rendering services. PE analysis shows normal entropy and no packing. No complete contacted-host reputation result was available. No dropped malicious files it created, and no external YARA or CIRCL hits. The combination of universal major silence, high prevalence, and legitimate graphics-library function strongly indicates this is a benign file.
What We Detected
libGLESv2.dll is a 5.4 MB Windows DLL identified as the OpenGL ES 2.0 graphics library. It has been submitted 2,962 times by 2,430 unique sources over 369 days. All 71 reporting antivirus engines classify it as undetected or harmless, including 17 major antivirus engines (Avast, BitDefender, Kaspersky, ESET-NOD32, Fortinet, Ikarus, DrWeb, F-Secure, GData, Emsisoft, Avira, AVG, and others).
Threat Behavior
However, this is expected behaviour for graphics libraries: they legitimately inject themselves into application address spaces to provide OpenGL ES rendering services. The sandbox execution shows the DLL exporting real OpenGL ES entry points (EGL_AcquireExternalContextANGLE, EGL_BindAPI, EGL_BindTexImage), not obfuscated malware functions. PE analysis shows normal entropy (6.41 in .text section, 5.73 in .rdata), no packing, and no high-entropy code.
What To Do Now
No action is required. This file is a legitimate graphics library commonly bundled with graphics drivers (NVIDIA, AMD, Intel) and 3D applications. It is safe to use. If you encountered it as an unexpected download or attachment, verify it came from a trusted graphics vendor or application installer.
Where this verdict could be wrong2 caveats
- If this were a trojanised graphics DLL (e.g., malware masquerading as libGLESv2), we would expect at least 1–2 major antivirus engines to flag it, given the 17 major antivirus engines reporting. The universal silence from major antivirus engines is strong counter-evidence to a malicious classification.
- Sandbox execution shows rundll32 loading the DLL with export names like 'EGL_AcquireExternalContextANGLE' and 'EGL_BindAPI' — these are real OpenGL ES entry points, not obfuscated malware exports.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- All 17 major antivirus engines report the file clean (Avast, BitDefender, Kaspersky, ESET-NOD32, Fortinet, Ikarus, DrWeb, F-Secure, GData, Emsisoft, Avira, AVG, and others)
- Prevalence: widely seen and long established classification with 2,962 submissions from 2,430 unique sources over 369 days
- Filename matches canonical OpenGL ES 2.0 library (Khronos Group standard)
- PE analysis: normal entropy, no packing, no high-entropy code
- Sandbox execution shows legitimate OpenGL ES export functions, not obfuscated malware
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 5sandbox rule tags
- 14spawned processes
- 0network contacts
- 2filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
5MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1055· Process injection
- T1071· Application protocol
- T1218.011
Observed activity
Processes started
14Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\init.dll",#1loaddll64.exeC:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\attachment.dll"cmd.exeC:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\attachment.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\attachment.dll,EGL_AcquireExternalContextANGLErundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\attachment.dll,EGL_BindAPI
Show all 14 entries for processes started
rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\attachment.dll,EGL_BindTexImagerundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",EGL_AcquireExternalContextANGLErundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",EGL_BindAPIrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",EGL_BindTexImagerundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",glWeightPointerOESrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",glWaitSyncrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",glWaitSemaphoreEXTrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\attachment.dll",glViewport
Files
1Files the file created, changed or deleted.
- Written
\Device\ConDrv\\Connect
Mutexes
1Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jun 10, 2026, 1:35 PM UTC
- SHA-256
9b203e40323b49dad29546a52b8b67d200bba8ff4cab9709a79cede23ba847d4- SHA-1
9912e11aa9c351be136474e0d0975e7964b1e124- MD5
11a4a07f31e4a91fff678c019b7736af
About this file
libGLESv2.dll is a Win32 DLL file of 5.4 MB.
- Type and size
- Win32 DLL · 5.4 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 6, 2025On VirusTotal.
- Submitted by
- 2,430 distinct sources
- Packer
- None detected
- Entropy
- 6.13 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is libGLESv2.dll safe?
What is libGLESv2.dll?
How many antivirus engines detected libGLESv2.dll?
What is the SHA-256 hash of libGLESv2.dll?
Is it safe to use libGLESv2.dll?
How up to date is this analysis of libGLESv2.dll?
Community
Member reviews and reports for this exact file hash.