File scan report
Verdict Safe
Is Accessibility.
This small .NET DLL has no detections from 75 engines, appears in a known-software reference database, has been widely submitted since 2019, and showed clean sandbox behaviour.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
No action is needed; the file looks like an ordinary .NET library. Keep your antivirus protection enabled.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 7y ago
Chapter 02
Why we think so
1 point against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 70 antivirus engines that checked it flagged this 12 KB .NET library. It matches a known-good software reference entry and has been submitted by about 1,300 sources since first seen on Oct 15, 2019. The sandbox runs showed no high-risk behaviour.
No engine flagged the file, including 17 major antivirus engines that reported clean results. A known-software reference database lists the same file name tied to a game product. About 1,300 submitters have sent it since first seen on Oct 15, 2019, which fits a widely distributed library. The sandbox runs recorded no injection, no network contacts and no dropped files, and the combined sandbox verdict was clean. The lack of a signature is the only mild caveat, and it is common for small game-related libraries. Similar-file history is weak here because it rests on shared import tables only.
What We Detected
A 12 KB Win32 .NET DLL with no packer and normal entropy. None of the 70 antivirus engines that checked it flagged it, and it matches a known-software reference entry.
Threat Behavior
Four sandbox runs showed only loading of the DLL through the Windows library loader, with no injection, network contacts or dropped files. The host reputation check was not available.
What To Do Now
No action is needed. Keep your security software enabled as usual.
Where this verdict could be wrong3 caveats
- The file is unsigned, so no publisher identity backs it.
- Tags include detect-debug-environment and checks-user-input, though these are common in ordinary .NET game libraries.
- The contacted-host reputation check was not available, though the sandbox recorded no network contacts.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No detections from any of 75 engines
- Matches a known-good software reference entry
- Submitted by about 1,300 sources since 2019
- Sandbox runs gave a clean combined verdict with no injection or network contacts
- The file is unsigned, so no publisher identity is attached to it.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 7sandbox rule tags
- 4spawned processes
- 0network contacts
- 1filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
7MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1056· Keylogging
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1218.011
- T1497· Sandbox evasion
- T1574.002· Execution hijack
Observed activity
Processes started
4Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\<USER>\Desktop\init.dll",#1loaddll32.exeC:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\library.dll"cmd.exeC:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\library.dll",#1rundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\library.dll",#1
Files
1Files the file created, changed or deleted.
- Written
\Device\ConDrv\\Connect
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Chapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 25, 2026, 9:21 AM UTC
- SHA-256
c36813bdf03fbad922e6558756c3cc2956e6f74457003947fa4e91952445e19f- SHA-1
bd0a92569b2a14f52bea0dc52fae7238332c3b8c- MD5
63c434b864ff270ce9fef43917dc8621
About this file
Accessibility.dll is a Win32 DLL file of 12.3 kB.
- Claims to be
- Accessibility.dll (Mono Common Language Infrastructure)From the file's own version information, written by whoever built it.
- Original name
- Accessibility.dllMatches the shared file name.
- Type and size
- Win32 DLL · 12.3 kB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 15, 2019On VirusTotal.
- Submitted by
- 1,300 distinct sources
- Packer
- None detected
- Entropy
- 4.50 of 8
First scanned
Antivirus consensus
0 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
These identify the compiler, runtime or installer used to build the file. They are not packing and are not a risk signal on their own.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Accessibility.dll safe?
What is Accessibility.dll?
How many antivirus engines detected Accessibility.dll?
What is the SHA-256 hash of Accessibility.dll?
Is it safe to use Accessibility.dll?
How up to date is this analysis of Accessibility.dll?
Community
Member reviews and reports for this exact file hash.