File scan report
Verdict Suspicious
Is Rockey4
Four of the 71 antivirus engines that checked it flagged this unsigned DLL, with Kaspersky naming Convagent and Rising offering a matching family label.
Read the whole reasonShow less
Why Suspicious? 4 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't use it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already used it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
4 of 71 flagged
- Flagged 4
- No detection 67
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 6y ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Major consensus is absent, one sandbox produced no malware verdict or high-risk techniques, and the contacted IP was not reputation-checked, leaving materially mixed evidence.
Kaspersky identified the DLL as a Convagent backdoor, but it is the sole major malicious vote among 17 major antivirus engines. Three additional detections exist, although two are generic and only Rising repeats the Convagent family. One completed sandbox recorded six techniques common in legitimate software and no malware verdict, persistence, dropped hashes, or high-risk techniques. It did contact 162.159.36.2 directly, but no complete host-reputation result is available because the contacted-host check was not saved. The unsigned status removes a useful publisher assurance, while the unpacked PE structure and absence of external-intelligence hits reduce corroboration. A single safe import-table fingerprint match without a matching signer is too weak to resolve these conflicting signals.
What We Detected
Four of the 71 antivirus engines that checked it flagged Rockey4ND_X64.dll. Kaspersky reported VHO:Backdoor.Win32.Convagent.gen, Rising reported Backdoor.Convagent, and Cynet and McAfeeD supplied generic detections. Kaspersky is the only major antivirus engine detecting it, so there is no strong independent major family consensus.
Threat Behavior
One completed sandbox run recorded six MITRE techniques common in legitimate software, including T1027, T1071, and T1497, but no high-risk techniques, persistence indicators, dropped hashes, or malware verdict. The DLL contacted 162.159.36.2 directly. The host-reputation cross-check was not completed or saved, so that no complete contacted-host reputation result was available or malicious.
Additional Context
The DLL is unsigned even though signing is applicable, and no publisher history is available. Static PE analysis found no packer, no likely packing, and no high-entropy code. CIRCL, MalwareBazaar, and YARAify supplied no corroborating hit. One prior safe sample shares the import-table fingerprint, but it has no matching signer and therefore may only share a common build framework.
What To Do Now
Do not load or register this DLL on a production system until its source and expected vendor can be verified. Keep security software enabled, let your antivirus remove the file if it arrived unexpectedly, and obtain a fresh copy from the software vendor's official distribution channel.
Where this verdict could be wrong4 caveats
- Kaspersky, a major antivirus engine, identified Backdoor.Win32.Convagent, and Rising independently used the same Convagent family name.
- The sandbox contacted 162.159.36.2 directly; because no contacted-host reputation result was saved, no complete host-reputation result is available.
- The DLL is unsigned despite code signing being applicable, so no publisher identity or clean signer history can be established.
- A similar import-table fingerprint received a prior safe decision, but matchKind=import-table fingerprint with signerCoMatch=false is weak because unrelated binaries can share build frameworks.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 4/71 engines reported a malicious result
- Major antivirus engines do not agree on one malware family
- No sandbox returned a malicious verdict in one completed run
- No offensive techniques were mapped and no persistence indicators were recorded
- The file does not appear packed and no code section has packed-level entropy
- Kaspersky major detection names Backdoor.Win32.Convagent
- Rising independently repeats the Convagent family label
- Unsigned Win32 DLL with no established signer history
- File tags include detect-debug-environment and long-sleeps
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 6sandbox rule tags
- 6spawned processes
- 0network contacts
- 1filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Checked whether it was running on a test computer.
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 4: FileSeen in the test run
Rockey4ND_X64.dll
ef476d7bee99c375eb77b04657200b441bedd20c5aa6c7310923455bf9cdd00b
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 4: ProcessSeen in the test run
rundll32.exe
"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\attachment.dll",#1
Test run - Evidence 3 of 4: ProcessSeen in the test run
loaddll64.exe
C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\library.dll"
Test run - +1 more recorded observation
- 1
Files
Created or changed
- Evidence 4 of 4: Written fileSeen in the test run
Connect
\Device\ConDrv\\Connect
Test run
4 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
6MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1071· Application protocol
- T1129· Loads modules
- T1218.011
- T1497· Sandbox evasion
Observed activity
Processes started
6Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\attachment.dll",#1loaddll64.exeC:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\library.dll"cmd.exeC:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\library.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\library.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\library.dll,Rockeyrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\library.dll",Rockey
Files
1Files the file created, changed or deleted.
- Written
\Device\ConDrv\\Connect
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
162.159.36.2
Chapter 04
Technical details
4 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 4
- Kaspersky (major engine)VHO:Backdoor.Win32.Convagent.gen
- CynetMalicious (score: 100)
- McAfeeDti!EF476D7BEE99
- RisingBackdoor.Convagent!8.123DC (CLOUD)
File fingerprint
- Last analyzed
- Sep 8, 2026, 9:11 AM UTC
- SHA-256
ef476d7bee99c375eb77b04657200b441bedd20c5aa6c7310923455bf9cdd00b- SHA-1
11944e556314d72715859da6ada272fbc073adfb- MD5
ffed1e3f37db77c65d2ec9df08eb784a
About this file
Rockey4ND_X64.dll is a Win32 DLL file of 92.7 kB.
- Type and size
- Win32 DLL · 92.7 kB
- Signer
- UnsignedNo code signature.
- First seen
- Sep 21, 2020On VirusTotal.
- Submitted by
- 4 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 5.47 of 8
First scanned
Antivirus consensus
4 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines1flagged
- Tier-235 engines0flagged
- Low-trust18 engines3flagged
View all 75 engine results
- CynetMalicious: Malicious (score: 100)
- KasperskyMalicious: VHO:Backdoor.Win32.Convagent.gen
- McAfeeDMalicious: ti!EF476D7BEE99
- RisingMalicious: Backdoor.Convagent!8.123DC (CLOUD)
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- MicrosoftClean
- MicroWorld-eScanClean
- PaloaltoClean
- PandaClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Rockey4ND_X64.dll safe, or is it malware?
What is Rockey4ND_X64.dll?
How many antivirus engines detected Rockey4ND_X64.dll?
What should I do if I already used Rockey4ND_X64.dll?
What is the SHA-256 hash of Rockey4ND_X64.dll?
How up to date is this analysis of Rockey4ND_X64.dll?
Community
Member reviews and reports for this exact file hash.