File verdict·Decided by the MT AI Engine
Our call

Safe

Widely distributed audio library with 17 tier-1 engines clean, no malicious sandbox verdict, and consistent community NO_THREAT verdicts despite heuristic sandbox observations.

Trust score88High trust
MT AI confidence · 92%
libsoundio.dll
83.5 KB
b266f223cb08279b8dffbe753ddb
Antivirus engines
0 of 75 flagged
Code signing
Unsigned
Age
First seen 7y ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

92%Confidence
Very high
Reasoning

The file exhibits a clean profile across all major antivirus engines (Avast, BitDefender, Kaspersky, ESET, Fortinet, Emsisoft, Ikarus, DrWeb, F-Secure, GData, Avira, AVG) with zero tier-1 malicious detections. Its prevalence as a common_old file with nearly 3,000 unique submitters and 3,850 submissions over 7+ years indicates widespread, established distribution. Community analysis from FileScan.IO consistently reports NO_THREAT or INFORMATIONAL verdicts with 100% confidence. The sandbox heuristics (process injection, direct-IP C2) are observations from test-environment execution, not confirmed malicious behaviour; no malicious sandbox verdict, no malicious dropped children, and no malicious contacted hosts were recorded. The YARA rule match (pe_detect_tls_callbacks) is a structural detection, not a malware family signature. The file is consistent with a legitimate library.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines.tier1Malicious=0; tier1ReportedClean=17 (Avast, BitDefender, Kaspersky, ESET, Fortinet, Emsisoft, Ikarus, DrWeb, F-Secure, GData, Avira, AVG) — all major AV engines silent or clean

  2. prevalence.classification=common_old; 2,879 unique submitters, 3,850 submissions since 2019-02-15 — widely distributed, long-established file

  3. communityComments: 3 FileScan.IO analyses report NO_THREAT or INFORMATIONAL verdicts with 100% confidence

  4. behaviour.hasMaliciousSandboxVerdict=false; droppedChildren.hasMaliciousChild=false; contactedHosts.maliciousHosts=none — no confirmed malicious runtime artifacts

  5. yaraify.ruleCount=1 (pe_detect_tls_callbacks) — TLS callback detection rule, not malware family; MalwareBazaar.hit=false; CIRCL.hit=false

Points in its favour
  • 17 tier-1 antivirus engines report clean or undetected
  • 2,879 unique submitters, 3,850 submissions since 2019 — widely distributed, long-established
  • Community analysis (FileScan.IO) confirms NO_THREAT verdict with 100% confidence
  • No malicious sandbox verdict, no malicious dropped children, no malicious contacted hosts
  • Consistent with legitimate open-source audio library (libsoundio)
What to do

This file is safe. No action is required. The heuristic sandbox observations are consistent with legitimate library functionality in a test environment rather than active malware.

Threat family attribution

pe detect tls callbacks corroborated by 1 source

  • 1 YARA rule
    pe_detect_tls_callbacks
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
10

Adversary techniques mapped to the MITRE ATT&CK framework.

T1018T1055T1071T1082T1095T1129T1218.011T1497T1518.001T1562.001
Spawned processes
15
$(unnamed)
"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\readme.dll",#1
$(unnamed)
C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\readme.dll"
$(unnamed)
C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
$(unnamed)
C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\readme.dll",#1
$(unnamed)
C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\readme.dll",#1
$(unnamed)
C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\readme.dll,soundio_backend_count
$(unnamed)
C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\readme.dll,soundio_backend_name
$(unnamed)
C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\readme.dll,soundio_best_matching_channel_layout
+7 more processes captured.
Network activity
5
IP addresses5
  • 204.79.197.203
  • 20.189.173.22
  • 13.89.179.12
  • 20.42.65.92
  • 20.189.173.20
Filesystem & mutexes
40
Files written15
  • C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_rea_1e8dc90b09ebae8ffc9ebfdf8ae9b75731582fb_b7758387_0d01f5e1
  • C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_rea_1e8dc90b09ebae8ffc9ebfdf8ae9b75731582fb_b7758387_0d01f5e1\Report.wer
  • C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_rea_3b8f2b417e8b58448a49f9a384cbc42cc2bc411d_b7758387_1a49c1f0
  • C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_rea_3b8f2b417e8b58448a49f9a384cbc42cc2bc411d_b7758387_1a49c1f0\Report.wer
  • C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_rea_6afcd3b460963e6ca0d93cd3f62d931b3260ba43_b7758387_1a59b425
+10 more
Files deleted15
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER163E.tmp.csv
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER164E.tmp.txt
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER268C.tmp.csv
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER269C.tmp.txt
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER32E2.tmp.csv
+10 more
Mutexes created10
  • \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6692
  • \Sessions\1\BaseNamedObjects\Global\a74f167d-7535-4531-b2f3-3d90357d8b5f
  • \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2372
  • \Sessions\1\BaseNamedObjects\Global\6e600947-0eff-4742-b612-03120bba08e8
  • \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5520
+5 more
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen
  • 70f1b92b8440a361bedc03a9a8Never scanned
    never seen before
  • 257b5af66f81b59ef27f4f9935Never scanned
    never seen before
  • 2ab05ff2e69d97d2de90e24e24Never scanned
    never seen before
  • cc6bb6ea82848c294c1945bdcbNever scanned
    never seen before
  • 0f71f1627589c850d73d154320Never scanned
    never seen before
  • b000fd50ed69a745f98fde7a50Never scanned
    never seen before
  • 716d68d2b2ef10a37bb7f574abNever scanned
    never seen before
  • 98d27273ca924c116cedef42aaNever scanned
    never seen before
  • 98d954fce20e0d622c1e1b03c2Never scanned
    never seen before
  • 8f39fae9cf9e866f9a90d6c34dNever scanned
    never seen before
External threat intelligence

1 corroborating signal from researcher-curated sources

YARAify HIT·1 community rule matchedView on YARAify
  • pe_detect_tls_callbacks
Cross-referenced against MalwareBazaar (abuse.ch), YARAify, and the CIRCL hashlookup reference DB.
Signature matches

YARA + heuristic rules that fired

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

1 YARAify2 synthesis
MITRE ATT&CK profile
Defense evasion× 1C2× 1
YARAify (community)
Researcher-authored rules via abuse.ch
  • pe_detect_tls_callbacks
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • ProcessInjectionhigh

    MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.

    Evidence
    "C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\readme.dll",#1
  • DirectIpC2medium

    Sample contacted 5 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    204.79.197.203 · 20.189.173.22 · 13.89.179.12
Antivirus engine breakdown

0 detections across 75 engines

0 malicious0 suspicious75 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-238 engines
0flag
Mainstream engines with mixed FP rates
Low-trust20 engines
0flag
Heuristic / generic-AI engines (high FP rate)
All 75 engines report this file as clean.
Hash b266f223cb08… cross-referenced against 75 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

Unpacked
Section entropy10 sections
.text
6.17
.data
0.94
.rdata
5.92
.pdata
4.86
.xdata
3.71
.bss
0.00
.edata
4.62
.idata
4.45
.CRT
0.20
.tls
0.00
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old
Unique uploaders
2,879
Hundreds of people have uploaded this — common.
Total submissions
3,850
Includes repeat uploads by the same source.
First seen by VT
7y ago
Feb 15, 2019
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
here
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
2/15/2019, 10:06:55 AM
First seen (MalwareBazaar)
Last analysis (VT)
6/10/2026, 12:16:38 AM
Scanned here
6/10/2026, 9:28:16 AM
File name
libsoundio.dll
Size
83.5 KB
MIME type
(unknown)
Detected type
Win32 DLL
SHA-256
b266f223cb08279b8dd09e08538fc9468255d904b609c28775dbaeffbe753ddb
MD5
b492d241dbae5fd322b1779226a3f0a9
SHA-1
95a6e6de7f452ed7cb7bc02730cde999f27cca53
PE imphash
bc0846853d37b1d8af9019939a993f80
First seen (VT)
2/15/2019, 10:06:55 AM
Last analysis (VT)
6/10/2026, 12:16:38 AM
First scan (MalwareTips)
6/10/2026, 9:28:16 AM
Last scan (MalwareTips)
6/10/2026, 9:28:16 AM
Community reputation
+11trusted
Behavior tags
assemblypedlldetect-debug-environment64bitslong-sleeps
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.