Is libHarfBuzzSharp.dll safe? Yes, no threats found.

What We Detected

libHarfBuzzSharp.dll is a 1.8 MB Windows DLL file signed by Microsoft Corporation. It was first submitted on May 22, 2025 and has been analyzed by 71 antivirus engines, with zero reporting it as malicious or suspicious. All 16 major antivirus engines (including Kaspersky, BitDefender, ESET-NOD32, Fortinet, Avira, F-Secure, GData, Emsisoft, DrWeb, Avast, and AVG) report the file as clean.

Threat Behavior

Two rule-based rules fired during analysis: (1) 'one of our behaviour rules' (MITRE T1055) — triggered because the sandbox executed rundll32.exe to load the DLL and call its exports, which is standard testing behavior, not malware injection; (2) 'one of our behaviour rules' (MITRE T1562.001) — triggered because the sample contacted IP 162.159.36.2, which is Cloudflare's public DNS resolver, not a remote control server. No malicious sandbox verdict was recorded. The file dropped 10 programs it started during testing, all of which were benign (WerFault.exe, conhost.exe, cmd.exe — Windows error reporting and console utilities). No complete contacted-host reputation result was available, and no malicious files it created were identified.

Prevalence & Reputation

This file has been submitted 2,561 times by 2,148 unique sources over 384 days, classifying it as 'widely seen and long established' — an established, widely-distributed file. The absence of malicious detections or reputation damage across this large submission volume is strong evidence of legitimacy. A prior MalwareTips verdict on a similar file (signed by Microsoft Corporation) was rated safe.

What To Do Now

No action is required. This file is a legitimate Microsoft-signed library used in .NET applications for text shaping and rendering. It is safe to use and poses no security risk. The rule-based alerts are false positives common to sandbox analysis of DLL files.