MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Safe

Single low-trust engine flag on an unsigned old DLL with no tier-1 detections or behavioural signals.

Trust score82Moderate trust
MT AI confidence · 78%
vray_v50003_fix.dlr
3.5 KB
def1f20dfa543c6deb…c5601c0ba0
Antivirus engines
1 of 76 flagged
Code signing
Unsigned
Age
First seen 6y ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

78%Confidence
High
Reasoning

The engine profile shows onlyLowTrustFlagging with tier1Malicious at zero, a pattern strongly associated with false positives. The file has been known for over six years with no sandbox or network indicators of malice. Absence of signing, RAG matches, or triggered heuristics further supports a benign classification despite the isolated low-trust label.

Key signals · 4

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines.tier1Malicious=0 and onlyLowTrustFlagging=true (APEX low_trust 'Malicious' label)

  2. signing.signed=false and signerStats.found=false

  3. prevalence.classification=medium (19 uniqueSources, 22 submissions)

  4. externalIntel.yaraify.ruleCount=0 and no contactedHosts.maliciousHosts

Points in its favour
  • 70 undetected engines
  • No tier-1 malicious detections
  • No behavioural or network indicators
What to do

Proceed with normal use; the single low-trust flag is consistent with known false-positive patterns on older unsigned files.

Sources disagree

1 contradiction resolved by the scoring engine

Only low-trust / heuristic engines flagged this file
1 engine from the heuristic / generic-AI set flagged it. No tier-1 engine agreed.
Verdict treated these as likely false positives.
No researcher-database hits
External threat-intel sources were not collected for this scan.
Antivirus engine breakdown

1 detection across 76 engines

1 malicious0 suspicious75 clean
Tier-118 engines
0flag
Top commercial AVs (low FP rate)
Tier-240 engines
0flag
Mainstream engines with mixed FP rates
Low-trust18 engines
1flag
Heuristic / generic-AI engines (high FP rate)
APEX
malicious
Malicious
Hash def1f20dfa54… cross-referenced against 76 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

Unpacked
Section entropy2 sections
.text
5.74
.data
5.62
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium
Unique uploaders
19
Moderate upload volume.
Total submissions
22
Includes repeat uploads by the same source.
First seen by VT
6y ago
Jun 16, 2020
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
6/16/2020, 8:36:17 PM
First seen (MalwareBazaar)
—
Last analysis (VT)
10/4/2022, 11:53:37 AM
Scanned here
7/3/2026, 9:50:39 AM
File name
vray_v50003_fix.dlr
Size
3.5 KB
MIME type
(unknown)
Detected type
Win32 DLL
SHA-256
def1f20dfa543c6deb58f1fdf4818eac5ee88317714fdc9746cd6ac5601c0ba0
MD5
672266f6dbabc0e4442e0b71e41064f7
SHA-1
bd13e93054512bb432c2c4523e0d3d5502ef7791
PE imphash
6e19abb36f191604c3793aee28e89b75
First seen (VT)
6/16/2020, 8:36:17 PM
Last analysis (VT)
10/4/2022, 11:53:37 AM
First scan (MalwareTips)
7/3/2026, 9:50:39 AM
Last scan (MalwareTips)
7/3/2026, 9:50:39 AM
Behavior tags
64bitspedll
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.