File scan report
Verdict Suspicious
Is steam_
This Steam API library carries a Valve signature that fails verification because the file was altered after signing, though none of the 71 antivirus engines that checked it flag…
Read the whole reasonShow less
Why Suspicious? A community rule for known malware matched it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Treat this as an unofficial, modified Steam library and use one only from a source you trust. Where possible, replace it with the original file by verifying the game's files through Steam.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't use it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already used it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Signer not verified
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
3 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The file presents itself as Valve's Steam API library, but its signature no longer matches its contents, which means it was modified after Valve signed it. None of the 71 antivirus engines that checked it flag it, it has been widely shared since June 2024, and one community malware rule matched it. Modified copies like this usually come from game cracks or emulators, so the exact code cannot be trusted.
The signature claims Valve Corp. but failed verification as tampered, so the file is not the original Valve library. The antivirus engines shows 0 of the 71 antivirus engines that checked it flagging it, including all 18 major antivirus engines that returned a result. It has circulated widely, with 2,752 sources since it was first seen on Jun 27, 2024. One malware-specific community YARA rule matched, but no engine detections or runtime findings back it up. The sandbox summary showed only behaviour common in legitimate software, with no process injection and no network contacts recorded for the sample.
What We Detected
This 64-bit DLL presents itself as the Steam API library and carries a signature claiming Valve Corp. The signature fails verification because the file was modified after it was signed. None of the 71 antivirus engines that checked it flagged it. One malware-specific community YARA rule matched, alongside several generic rules that ordinary software also triggers.
Threat Behavior
The combined sandbox summary recorded only techniques common in legitimate software. It showed no injection into other processes, no persistence and no network contacts by the sample. No host-reputation check of network activity is available. The file has been widely distributed since it was first seen on Jun 27, 2024. That spread fits a modified Steam library of the kind bundled with cracked or emulated games.
What To Do Now
Do not treat this file as an official Valve component. If it came with a game from an unofficial source, consider restoring the original files through Steam's file integrity check. Keep your antivirus enabled and scan the folder it came from.
Where this verdict could be wrong2 caveats
- None of the 71 antivirus engines that checked it flags the file, and it has circulated among 2,752 sources since June 2024. Together these suggest a modified game library such as a Steam emulator or crack component, not a malware payload.
- Only one malware-specific YARA rule matched, and it describes a PowerShell-based dropper, which matches the profile of this DLL poorly.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the file
- Widely circulated among 2,752 sources since June 2024
- No process injection, persistence or network contacts in the sandbox summary
- The Valve signature fails verification because the file was altered after signing
- One community malware-detection rule matched the file
- Modified game libraries are often distributed through unofficial download sources
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 9sandbox rule tags
- 14spawned processes
- 0network contacts
- 2filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Note: Listed the programs running on the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 4: FileSeen in the test run
steam_api.dll
d00a9b72e696cf5c88a5b4bbc4d7d308f9bac51a8c4712d6b26cfd863938a25f
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 4: ProcessSeen in the test run
rundll32.exe
"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\readme.dll",#1
Test run - Evidence 3 of 4: ProcessSeen in the test run
loaddll64.exe
C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\steam_api64.dll"
Test run - +1 more recorded observation
- 1
Files
Created or changed
- Evidence 4 of 4: Written fileSeen in the test run
Connect
\Device\ConDrv\\Connect
Test run
4 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
9MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1218.011
- T1574.002· Execution hijack
- T1614
Observed activity
Processes started
14Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\readme.dll",#1loaddll64.exeC:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\steam_api64.dll"cmd.exeC:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\steam_api64.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\steam_api64.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\steam_api64.dll,CAddAppDependencyResult_t_RemoveCallResultrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\steam_api64.dll,CAddAppDependencyResult_t_SetCallResult
Show all 14 entries for processes started
rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\steam_api64.dll,CAddUGCDependencyResult_t_RemoveCallResultloaddll64.exeC:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\library.dll"cmd.exeC:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\library.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\library.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\library.dll,CAddAppDependencyResult_t_RemoveCallResultrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\library.dll,CAddAppDependencyResult_t_SetCallResultrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\library.dll,CAddUGCDependencyResult_t_RemoveCallResultloaddll64.exeC:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\readme.dll"
Files
1Files the file created, changed or deleted.
- Written
\Device\ConDrv\\Connect
Mutexes
1Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; a signature that did not verify.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Aug 30, 2026, 8:40 AM UTC
- SHA-256
d00a9b72e696cf5c88a5b4bbc4d7d308f9bac51a8c4712d6b26cfd863938a25f- SHA-1
28a1552db71394dea425f63fb51a7f170f5e276e- MD5
87ea1775f0cee3649dbb31043eb51fc0
About this file
steam_api.dll is a Win32 DLL file of 732.5 kB.
- Type and size
- Win32 DLL · 732.5 kB
- Signer
- Valve Corp. (unverified signature)Worth noting: Malware sometimes copies or steals a company's signature, so this does not mean that company made it.
- First seen
- Jun 27, 2024On VirusTotal.
- Submitted by
- 2,752 distinct sources
- Packer
- None detected
- Entropy
- 7.68 of 8
First scanned Updated
Verdict history
- Safe
- Suspiciousafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Behavioral heuristics matched patterns associated with malware. Corroborating evidence determines how much weight they carry.
Showing the 5 saved rule names of 10 matched.
- cobalt_strike_tmp01925d3fgeneric
- DebuggerCheck__APIgeneric
- DetectEncryptedVariantsgeneric
- FreddyBearDropper
- golang_bin_JCorn_CSC846generic
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is steam_api.dll safe, or is it malware?
What is steam_api.dll?
How many antivirus engines detected steam_api.dll?
What should I do if I already used steam_api.dll?
Is steam_api.dll digitally signed?
What is the SHA-256 hash of steam_api.dll?
How up to date is this analysis of steam_api.dll?
Community
Member reviews and reports for this exact file hash.