Unknown
Unsigned 64-bit DLL with only one tier-1 ML detection and no supporting sandbox or external intel.
ef5c85d5a0ab9d9a18…7db98e8bebThe reasoning behind this verdict
The MT AI Engine weighs every signal from this scan — antivirus detections, sandbox behaviour, code signing, prevalence and historical matches — to reach a single, evidence-based verdict.
The engine set shows a single tier-1 ML.Attribute detection alongside three low-trust flags, producing mixed but weak signals. Absence of signing, zero-age rare_new prevalence, and complete lack of sandbox, network, or YARA data leave the sample in low-coverage territory. No similar-hash precedents or external-intel hits exist to anchor a stronger verdict. The combination points to unknown rather than safe or malicious.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines.tier1Malicious=1 (Symantec) with tier1FamilyConsensus.family=attribute (weak, 1 engine)
signing.signed=false and prevalence.classification=rare_new
similarHashes.length=0 and externalIntel.yaraify.ruleCount=0
allMaliciousLabels contain only generic ML.Attribute and confidence strings, no named family
- No sandbox malicious verdict
- No external intelligence hits
- No hacktool or test-file labels
- Unsigned DLL
- rare_new prevalence
- Single tier-1 ML detection
Do not execute until further samples or signing information become available; keep isolated and monitor for additional engine coverage.
What to do now
There isn't enough information to give this file a clear rating.
Be cautious — an unknown rating is not the same as a clean bill of health.
Only run it if it came directly from the official maker of the software.
When in doubt, don't open it — or scan it again later once it's more widely seen.
4 detections across 74 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How widely this file has been seen
Barely seen in the wild and first surfaced recently. This is the footprint of targeted malware the AV industry hasn't signatured yet — extra scrutiny is warranted.
Forensic fingerprint
- File name
- FrenchPacket - Copy.dll
- Size
- 3.21 MB
- MIME type
- (unknown)
- Detected type
- Win32 DLL
- SHA-256
- ef5c85d5a0ab9d9a18f2a1759d2fed952455adbc612813f79ee6717db98e8beb
- MD5
- f318ebbd36b5a76fea63904406521652
- SHA-1
- 8f37c6d1ef87545dbb8d5cb99d98b1f20fe28b23
- PE imphash
- 8aea40c5130ef3c5c292ae6480ecdb5b
- First seen (VT)
- 7/3/2026, 1:54:25 PM
- Last analysis (VT)
- 7/3/2026, 1:54:25 PM
- First scan (MalwareTips)
- 7/3/2026, 7:40:30 PM
- Last scan (MalwareTips)
- 7/3/2026, 7:40:30 PM
Safety FAQ
Common questions about FrenchPacket - Copy.dll, answered from the scan data above.
- We can't give FrenchPacket - Copy.dll a confident verdict yet — too few engines have an opinion on this exact file. Uncommon or brand-new files often show little coverage before vendors catch up, so treat it as untrusted: don't run it unless you're certain of the source.
- FrenchPacket - Copy.dll is a Windows executable program, about 3.2 MB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.
- 4 of 74 antivirus engines flagged FrenchPacket - Copy.dll, 4 of them as outright malicious. A small number of detections can include false positives, so we weigh which engines flagged it and what else the file does, not just the raw count.
- The SHA-256 hash of FrenchPacket - Copy.dll is ef5c85d5a0ab9d9a18f2a1759d2fed952455adbc612813f79ee6717db98e8beb, and its MD5 is f318ebbd36b5a76fea63904406521652. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
- This report reflects the scan run on July 3, 2026. Because a file's hash never changes, the identity of FrenchPacket - Copy.dll is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.