libcef.dll threat report

MD5 42a91de6ce2dc0b5fe2eb68b863bcc6c
Latest seen 2024-04-06 23:01:46 (2 years ago)
First seen 2024-04-06 23:01:46 (2 years ago)
Size 185 MB

This report summarizes the file identity, detection status, publisher metadata, observed locations, and technical indicators for libcef.dll. ThreatInfo currently classifies this sample as Trojan.Heur!.

GridinSoft Anti-Malware detection

GridinSoft already detects this file

The latest ThreatInfo record shows libcef.dll detected as Trojan.Heur!. You can download GridinSoft Anti-Malware to scan the system and remove this detection if the file is present on your device.

Detection name
Trojan.Heur!
Last analysis
2024-04-06 23:01:46 (2 years ago)
File hash
42a91de6ce2dc0b5fe2eb68b863bcc6c
Download Anti-Malware

libcef.dll is a Windows file recorded in the ThreatInfo database. It is associated with Chromium Embedded Framework (CEF) Dynamic Link Library. The current detection status is Trojan.Heur!, based on the latest analysis from 2024-04-06 23:01:46 (2 years ago).

If libcef.dll appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Trojan.Heur!.

Product Name: Chromium Embedded Framework (CEF) Dynamic Link Library
MD5: 42a91de6ce2dc0b5fe2eb68b863bcc6c
Size: 185 MB
First Published: 2024-04-06 23:01:46 (2 years ago)
Latest Published: 2024-04-06 23:01:46 (2 years ago)
Status: Trojan.Heur! (on last analysis)
Analysis Date: 2024-04-06 23:01:46 (2 years ago)
libcef.dll detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

Signed By: Bytedance Pte. Ltd.
Status: Valid

The signature on libcef.dll is reported as valid. A valid signature helps confirm publisher identity, but it does not automatically make the file safe if the installer was bundled, abused, or downloaded from an untrusted source.

%localappdata%\capcut\apps\2.9.1.990

ThreatInfo has observed libcef.dll in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

100.0%

The strongest geographic signal for this file is Brazil with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

Windows 10 100.0%

The most common operating system signal for libcef.dll is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

libcef.dll is identified as pe for 64 systems. The subsystem is Windows CUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Subsystem: Windows CUI
PE Type: pe
OS Bitness: 64
Image Base: 0x0000000180000000
Entry Address: 0x0442a150

PE Sections:

Name Size of data MD5
.text 163432448 182278e567d7794f7ff48e4e4039b56a
.rdata 23311360 467eecc836f94b799a848c29c3f67c3e
.data 858624 5a13c7d51460604691786719d99b4a1e
.pdata 5607424 befb404072fe19a23db171e27c0ca323
.00cfg 512 c5afd770c5c5632bcf1f42717a206251
.gxfg 17408 fc50fac2901e46ab2c918024c69338ed
.retplne 512 b3bbd65c84a2444d363cc9b0f471fd7e
.rodata 2560 e2c4d0fc2f920c030a8fb73f17cb6c40
.tls 1024 613103b6e6f3d1dbefa183b6216f295f
.voltbl 512 20c22515d345615c5f7d7e64d0cb9ca3
CPADinfo 512 60d3ea61d541c9be2e845d2787fb9574
LZMADEC 4608 05e9eab8428a551a281ab278073669fa
_RDATA 512 bf5fdad4c90c34e3e31a338d8f2d7bd5
malloc_h 512 b6c3f353acebeb6bdf43f972b2144a20
.rsrc 148480 a52ccc384c0540f6153671ab362653a2
.reloc 1498112 f832f1bfc69a04f806f2cd4c11315ef4

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

More information: