Safe
FFmpeg codec library (avcodec-60.dll) with zero tier-1 detections, 2210 submissions, and legitimate export functions; heuristic T1055 trigger is sandbox testing artifact.
a9002e019e8eed38be…438f671894The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The file exhibits a clean engine consensus: 0 malicious detections across 70 reporting engines, with 17 high-trust vendors explicitly reporting it undetected. The filename and exports (av_ac3_parse_header, av_adts_header_parse, av_bsf_alloc) match the legitimate FFmpeg codec library, which has been submitted 2,210 times over 467 days with consistent clean verdicts. The triggered heuristic (T1055 Process Injection) reflects sandbox methodology — testing DLL exports via rundll32 — rather than malicious code injection. No malicious sandbox verdicts, contacted hosts, or dropped children were observed. External community analysis (FileScan.IO) confirms 'NO_THREAT' with 100% confidence.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines: 0/70 malicious; tier1Malicious=0; tier1ReportedClean=17 (Avast, BitDefender, Kaspersky, ESET, Fortinet, Emsisoft, Ikarus, GData, F-Secure, DrWeb, Avira, AVG all undetected)
File: avcodec-60.dll, FFmpeg codec library; prevalence common_old (1905 submitters, 2210 submissions, 467 days old)
Behaviour: T1055 heuristic fired on rundll32.exe export testing (av_ac3_parse_header, av_adts_header_parse, av_bsf_alloc); no malicious sandbox verdict, no malicious hosts contacted, no dropped children
External intel: FileScan.IO community verdict 'NO_THREAT' 100/100 confidence; no YARA/CIRCL hits
Unsigned but consistent with legitimate open-source codec distribution; no brand mismatch, no adversarial filename flags
- Zero malicious detections across 70 engines; 17 tier-1 vendors all report clean
- Legitimate FFmpeg codec library (avcodec-60.dll) with known exports
- Common_old prevalence: 2,210 submissions, 1,905 unique sources, 467 days in circulation
- No malicious sandbox verdicts, no malicious host contact, no dropped children
- Community analysis (FileScan.IO) confirms 'NO_THREAT' with 100% confidence
This file is safe. It is a legitimate FFmpeg audio codec library with zero tier-1 detections and 2,210 clean submissions. The heuristic trigger is a false positive from sandbox testing. No action required.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- \Device\ConDrv\\Connect
- \Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\avcodec-60.dll",#1
0 detections across 74 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Forensic fingerprint
- File name
- avcodec-60.dll
- Size
- 3.64 MB
- MIME type
- (unknown)
- Detected type
- Win32 DLL
- SHA-256
- a9002e019e8eed38becdab73c01b6d2e85850657ff752c31bb8f68438f671894
- MD5
- 0da8020a95d29fd7c7ef020f38845115
- SHA-1
- 2ffce00bdbae0aafbc9affe163d24484f909fc72
- PE imphash
- 7b6e311053ac5834fd8781b5f873c0f9
- First seen (VT)
- 2/27/2025, 8:45:37 PM
- Last analysis (VT)
- 5/4/2026, 10:33:32 PM
- First scan (MalwareTips)
- 6/10/2026, 9:36:41 AM
- Last scan (MalwareTips)
- 6/10/2026, 9:36:41 AM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.