File scan report
Verdict Safe
Is Microsoft.
No antivirus engine flagged this established Microsoft-signed file, and the completed sandbox run, host checks, prevalence, and signer history provide strong benign evidence.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Microsoft Corporation
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 71 antivirus engines that checked it flagged the file, and its signature verifies to trusted publisher Microsoft Corporation. It is widely established, the completed sandbox run returned clean, all observed hosts received full reputation coverage without adverse results, and five signer-matched files previously received benign assessments.
The strongest evidence is the verified Microsoft Corporation signature combined with no detections among 75 antivirus engines. The file is established across 1,502 submitters, which substantially reduces concern about an impersonating newly distributed sample. One completed sandbox run returned clean and mapped no techniques reserved for malware or offensive tools. All 14 distinct observed hosts were covered by the reputation check, with no malicious or suspicious results, while five contacts were identified as analysis-environment background traffic. Five prior signer-matched files also received benign assessments, reinforcing the publisher evidence.
What We Detected
None of the 71 antivirus engines that checked it flagged the file, including the major antivirus engines. Its digital signature verifies to Microsoft Corporation, a trusted publisher, and 29 of 30 historical samples associated with this signer received benign assessments. The file is also well established, with 1,502 submitters and 2,102 submissions.
Threat Behavior
One completed sandbox run returned clean and showed no high-risk MITRE techniques. It recorded possible injection into an updater process, but there was no malicious sandbox outcome, persistence indicator, malicious file it created, or supporting engine detection. The reputation check covered all 14 distinct observed hosts and found no malicious or suspicious entries; five listed contacts were background activity from the analysis environment. Six YARA rules matched only broad properties such as anti-debug checks, compiler traits, a digital certificate, TLS callbacks, and an overlay, with no malware-specific rule matches.
What To Do Now
The evidence supports normal use when the file came from Microsoft software or another expected trusted installation source. If its origin is unexpected, verify the signature still reports Microsoft Corporation before running it and keep security software enabled.
Where this verdict could be wrong4 caveats
- The sandbox recorded possible injection into updater.exe, but it mapped no offensive techniques and returned a clean result.
- One of 30 historical samples associated with the signer was marked malicious, so signer history is strong but not perfect.
- Six community YARA rules matched, but every match was a generic capability, compiler, certificate, anti-debug, or file-property rule rather than a malware-specific signature.
- An untrusted community annotation alleged several threats, but the comment field showed instruction-like contamination and its claims lack independent corroboration.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the file.
- The digital signature verifies to trusted publisher Microsoft Corporation.
- The file is established across 1,502 submitters and 2,102 submissions.
- The completed sandbox run returned clean and showed no high-risk techniques.
- All 14 distinct observed hosts were checked without malicious or suspicious reputation results.
- The sandbox recorded possible injection into an updater process, although no malicious outcome or high-risk technique corroborated it.
- The executable includes anti-debug and overlay-related traits that can also occur in ordinary signed software.
- One of 30 historical samples associated with this signer was previously marked malicious.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 4sandbox rule tags
- 3spawned processes
- 2network contacts
- 4filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
4MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1071· Application protocol
- T1082· System recon
- T1129· Loads modules
Observed activity
Processes started
3Programs the file ran, with their command lines.
executable.exe"C:\Users\<USER>\Desktop\executable.exe"dd9729a2f62a8c742aacce3ee721df1cbd1ce549477decb3c64f9ed6dfb9c1ee.exe%SAMPLEPATH%\dd9729a2f62a8c742aacce3ee721df1cbd1ce549477decb3c64f9ed6dfb9c1ee.exesoftware.exe"C:\Users\user\Desktop\software.exe"
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
20.22.113.133 - IP address
23.32.75.30
Files
2Files the file created, changed or deleted.
- Written
\Device\ConDrv - Written
\Device\ConDrv\\Connect
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\DBWinMutex\Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex
Sandbox background — not the file
18The analysis machine's own processes and connections, recorded in every run.
- VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google2424_108520456\bin\updater.exe - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM injection target
C:\Program Files\Google2424_108520456\bin\updater.exe - VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft
Show all 18 entries for sandbox background — not the file
- VM host
bg.microsoft.map.fastly.net - VM host
x1.c.lencr.org - VM host
crl.root-x1.letsencrypt.org.edgekey.net - VM host
e8652.dscx.akamaiedge.net - VM host
a83f:8110:0:0:100:0:1800:0 - VM host
192.168.0.153 - VM host
20.69.140.28 - VM host
23.196.145.221 - VM host
23.55.140.42 - VM host
a83f:8110:2be1:b71c:1784:8713:6e1a:fa65 - VM host
192.168.0.27 - VM host
104.71.214.69
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- bc821255b37508dbdcff…b33c27Not checkedno saved verdict
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by Microsoft Corporation.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 10, 2026, 12:33 PM UTC
- SHA-256
dd9729a2f62a8c742aacce3ee721df1cbd1ce549477decb3c64f9ed6dfb9c1ee- SHA-1
482fe3a0f2e701c69f40134e71faf5c134cd1fae- MD5
301a5357ec4151273a737a57a211c7a5
About this file
Microsoft.Spark.Worker.dll is a Win32 EXE file of 149.5 kB.
- Type and size
- Win32 EXE · 149.5 kB
- Signer
- Microsoft CorporationValid code signature.
- First seen
- Aug 18, 2025On VirusTotal.
- Submitted by
- 1,502 distinct sources
- Packer
- None detected
- Entropy
- 5.63 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Community YARA rules matched, but all of them are generic capability, anti-debug or compiler rules that ordinary software also matches. Worth noting, not on their own cause for alarm.
- DebuggerCheck__APIgeneric
- golang_bin_JCorn_CSC846generic
- NETgeneric
- pe_detect_tls_callbacksgeneric
- PE_Digital_Certificategeneric
- Sus_Obf_Enc_Spoof_Hide_PEgeneric
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is Microsoft.Spark.Worker.dll safe?
What is Microsoft.Spark.Worker.dll?
How many antivirus engines detected Microsoft.Spark.Worker.dll?
Is Microsoft.Spark.Worker.dll digitally signed?
What is the SHA-256 hash of Microsoft.Spark.Worker.dll?
Is it safe to run Microsoft.Spark.Worker.dll?
How up to date is this analysis of Microsoft.Spark.Worker.dll?
Community
Member reviews and reports for this exact file hash.