File scan report
Verdict Malicious
Is Unity
A large DLL posing as Unity's runtime carries a ruined Unity signature, and four engines describe it as a hijack loader that kicks off PowerShell when loaded.
Read the whole reasonShow less
Moderate evidence · Several antivirus engines agree.
If you already used it, follow the steps below.
What to do now4 steps
This file is harmful. Don't run it, and remove it.
If you haven't used it
Don't use this component. Let your antivirus remove this component, then repair or reinstall the program it belongs to from its official website. Don't delete or replace the file by hand.
If you already used it
Disconnect the device from the internet, then run a full antivirus scan. Microsoft Defender Offline (Windows Security > Virus & threat protection > Scan options) also finds malware that hides while Windows runs.
If you typed passwords on the device after running it, change them from another device you trust.
If the scan keeps finding it, or the device still acts strangely, scan again with a second-opinion scanner from another company; if that doesn't fix it, back up your personal files and reinstall Windows.
If you already ran it, do these in order.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
4 of 58 flagged
- Flagged 4
- No detection 54
- No result 17
- Code signing Signer not verified
- Test run Completed
- First seen 10d ago
Chapter 02
Why we think so
6 points against it and 2 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This 25 MB DLL copies the name of the runtime Unity games load, but its signature claiming Unity Technologies no longer matches the file, meaning it was altered after signing. Four of the 58 antivirus engines that checked it flag it as a DLL-hijack loader or generic trojan, and a sandbox run shows it being loaded by rundll32 and launching PowerShell to read display settings. A legitimate Unity runtime would not arrive in this state.
The strongest fact is the broken signature: the file claims to come from Unity Technologies, but the signature does not match the bytes, so the copy was modified after it was signed and the publisher name proves nothing. That matters more than usual here because UnityPlayer.dll is exactly the kind of module other programs load automatically from their own folder, which makes a tampered copy a plausible hijack payload. Four engines name it a loader or generic trojan, including Sophos with a generic trojan detection and Malwarebytes with an OXLoader label, and the accompanying tags mention debugger detection, long sleeps and the invalid signature. Loading the file in a sandbox ran it through rundll32 at export #1, after which cmd and PowerShell were started to query video-controller refresh rate — behaviour a game runtime has no reason to perform. The remaining coverage points the same way with less force: reputation is negative, 37 sources submitted it within its first weeks, and no previous reports on this hash exist to lean on.
What We Detected
The sample is a 64-bit Windows DLL of about 25 MB that describes itself as UnityPlayer.dll, the module Unity-based games load at start-up. It carries a signature naming Unity Technologies, but verification fails: the signature does not match the file, which means the contents were changed after it was signed. The publisher name therefore cannot be trusted, and no publisher history applies to it. Nothing indicates packing — the overall entropy is moderate, no packer or wrapper was identified and the code section is not high-entropy — so the file is readable as built, and the alterations sit inside normal-looking code.
Four of the 58 antivirus engines that checked it flagged it: Sophos with a generic trojan detection, Malwarebytes with a Trojan.OXLoader label, Rising with a cloud DLL-hijack detection and Webroot with a generic malware label. Two of those come from less established engines, but Sophos is a high-signal vendor and the detection themes agree: a loader that is intended to be loaded by someone else.
Threat Behavior
In the sandbox runs the module was loaded the way an attacker or a hijacked host program would load it: through rundll32 with export ordinal 1. That call then started cmd and PowerShell to read the video controller's current refresh rate, a hardware query that a trusted game runtime has no need to make. The file also writes PowerShell policy-test artefacts and creates a program markers named with a compatibility/encapsulation suffix, and its public tags mention debugger-environment detection and long sleeps, both typical of code that waits for analysis to end.
No malicious destination was found among the contacts recorded for the run — the only two contacts are the analysis machine's own background traffic — and no dropped file has been found malicious. The remaining picture is a modified, signed-in-name-only copy of a widely loaded game module whose detections all describe hijacking or a loader.
What To Do Now
Do not run, register or place this file next to a game or any other application that loads UnityPlayer.dll, because that is precisely how it would be picked up. Delete it, then obtain a genuine Unity runtime by reinstalling the game or the Unity engine from its official source, and check that the new copy's signature verifies. Keep security software switched on and let it let your antivirus remove the file.
Where this verdict could be wrong3 caveats
- Only 4 of the 58 antivirus engines that checked it flagged the file and most of the labels are generic, so several vendors saw nothing worth a signature.
- Kaspersky, BitDefender, Avast, AVG and Microsoft's engine either timed out or returned no result here, so some of the highest-signal engines never weighed in.
- No sandbox run produced a malicious verdict, no named injection target was recorded, and the only network contacts look like the analysis environment's own traffic.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Most engines (54 of 75) flagged nothing, and well-known vendors such as ESET, Fortinet, Emsisoft, G DATA and Dr.Web reported the file as clean.
- The cross-check of the one recorded contact found no known-malicious destination, and no dropped file we hold a verdict for was judged harmful.
- The digital signature claims Unity Technologies but no longer matches the file, so the contents were changed after signing.
- The name imitates the runtime module Unity games load automatically from their own folder, a natural target for hijacking.
- Four engines flag it, with labels describing a DLL-hijack loader and a generic trojan.
- When loaded in a sandbox it started PowerShell to query display hardware, which a game runtime has no reason to do.
- Its public tags mention debugger detection and long sleeps, and its community reputation is negative.
- It was submitted by 37 distinct sources within its first few weeks of appearing, and no previous reports on this exact file exist to compare against.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 26sandbox rule tags
- 12spawned processes
- 0network contacts
- 7filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Moderate concern: Hid files or windows on the test computer.
Note: Read the user name of the test computer.
Note: Listed the programs running on the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as recording keystrokes; no keylogging was confirmed.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as downloading a file, but no download was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How trojans work
A trojan pretends to be something useful or harmless so that you run it. Once open, it does its real job in the background, from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
UnityPlayer.dll
b438f60bbe5b641515957371f07c3dde11702ab19e413e1deb0164354ebdaae2
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
rundll32.exe
"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\UnityPlayer.dll",#1
Test run - Evidence 3 of 5: ProcessSeen in the test run
cmd
cmd /c powershell "Get-WmiObject Win32_VideoController | Select-Object -ExpandProperty CurrentRefreshRate"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
StartupProfileData-NonInteractive
C:\Users\<USER>\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Test run - Evidence 5 of 5: Written fileSeen in the test run
powershell.exe.log
C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
Includes 26 mapped techniques, every process, file, registry and network entry and 2 dropped files.
Show the technical evidenceChapter 04
Technical details
4 of the 58 antivirus engines that checked it flag it; a signature that did not verify.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 4
- Sophos (major engine)Mal/Generic-S
- MalwarebytesTrojan.OXLoader
- RisingTrojan.Dllhijack!8.19856 (CLOUD)
- WebrootWin.Malware.Gen
File fingerprint
- Last analyzed
- Nov 7, 2026, 1:08 PM UTC
- SHA-256
b438f60bbe5b641515957371f07c3dde11702ab19e413e1deb0164354ebdaae2- SHA-1
c5fa462e0d02500a536976f072a4210d4f09d8a6- MD5
ac8547f5af42dc6932367ebcb162fb0e
About this file
UnityPlayer.dll is a Win32 DLL file of 26.0 MB.
- Type and size
- Win32 DLL · 26.0 MB
- Signer
- Unity Technologies Aps (unverified signature)Worth noting: Malware sometimes copies or steals a company's signature, so this does not mean that company made it.
- First seen
- Oct 27, 2026On VirusTotal.
- Submitted by
- 37 distinct sources
- Packer
- None detected
- Entropy
- 6.44 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 9 questions people ask most about this file.
Is UnityPlayer.dll a virus?
What is UnityPlayer.dll?
How many antivirus engines detected UnityPlayer.dll?
What should I do if I already used UnityPlayer.dll?
How do I remove UnityPlayer.dll?
What kind of malware is UnityPlayer.dll?
Is UnityPlayer.dll digitally signed?
What is the SHA-256 hash of UnityPlayer.dll?
How up to date is this analysis of UnityPlayer.dll?
Community
Member reviews and reports for this exact file hash.