The RldOrigin.dll File Analysis

Updated 4 months ago

Checked by Malware Check

RldOrigin.dll

Technical Analysis

File Name	RldOrigin.dll
File Type	Win32 DLL
Magic Bytes	`PE32 executable (DLL) (GUI) Intel 80386, for MS Windows`
SSDEEP Hash	12288:wDNOb4MxMiNTS+OeO+OeNhBBhhBB62C0pFx5ffO48qpms/+Dh+SpD1e:w4b4MxZT+0HxcamK+DhJU
Scanner Version	1.0.249.174
Database Version	2026-06-28 01:00:15 UTC

⚠

Suspicious File Detected

Detected by 37 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

53%

Detection Rate

503,300

File Size (bytes)

37/70

Engines Detected

2026-06-28

Analysis Date

Scan Another File

The uploaded file itself is not retained or shared with third parties. File names, hashes, and analysis results may appear in public reports. For confidential material, contact Support before uploading. How we use your data.

File Identification

Hash Type	Value	Action
MD5	c488ac7827019f22f43aa1a4a60a94fb
SHA1	b6de7340890e9fe7be83f969efd7503cc7c2f884
SHA256	5c74f5981e721ea4f058513e1cd0d1cb1312b1832f1c027cc464c51809ea35e1
SHA512	315057aaa3d555d6a1335dd56d22bdea7b65dcb203c9c2c7b091bc88967bfc368a40416864a068f5aeac296ec5a3691163a23d4fd115260f3cc7485abbc25b08
ImpHash	f8aed7b9239f0f463eedfc8e8c8f244c

Security Engines with Detections (37 of 70)

Bkav

W32.Malware.D4A7EF44 Malicious

Lionic

Trojan.Win32.Crack.4!c Malicious

Elastic

malicious (high confidence) Malicious

CTX

dll.trojan.crack Malicious

Skyhigh

BehavesLike.Win32.Downloader.gc Malicious

Cylance

Unsafe Malicious

Sangfor

Trojan.Win32.Agent.Vwsr Malicious

K7AntiVirus

Trojan ( 7000001c1 ) Malicious

K7GW

Trojan ( 7000001c1 ) Malicious

CrowdStrike

win/malicious_confidence_70% (D) Malicious

Symantec

ML.Attribute.HighConfidence Malicious

ESET-NOD32

Win32/HackTool.Crack.DK potentially unsafe application Malicious

APEX

Malicious Malicious

TrendMicro-HouseCall

PUA_FLYST.SM Malicious

Paloalto

generic.ml Malicious

Sophos

Troj/Agent-AJTQ Malicious

TrendMicro

PUA_FLYST.SM Malicious

McAfeeD

ti!5C74F5981E72 Malicious

Trapmine

malicious.moderate.ml.score Malicious

Jiangmin

Trojan/Agentb.awq Malicious

Google

Detected Malicious

Varist

W32/ABRisk.WNEA-3374 Malicious

Antiy-AVL

HackTool/Win32.Crack Malicious

Xcitium

Malware@#1pd8zggev7o3f Malicious

ZoneAlarm

Troj/Agent-AJTQ Malicious

GData

Win32.Trojan.Agent.2GI4UP Malicious

Cynet

Malicious (score: 100) Malicious

AhnLab-V3

Trojan/Win32.Agent.R123162 Malicious

DeepInstinct

MALICIOUS Malicious

Malwarebytes

Crack.Trojan.HackTool.DDS Malicious

Panda

PUP/Crack Malicious

Rising

Malware.Heuristic!ET#96% (CLOUD) Malicious

Yandex

Trojan.Agentb!AxkGrG3vnyM Malicious

TrellixENS

PUP-XBK-EB Malicious

SentinelOne

Static AI - Suspicious PE Malicious

Fortinet

Riskware/Agent.AJTQ!tr Malicious

alibabacloud

HackTool:Win/Crack.DH Malicious

33 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼

Image Base	`0x10000000`
Entry Point	`0x10021a56`
Compilation Time	2014-10-18 22:27:50
Checksum	0x00000000 (Actual: 0x0007fe07)
OS Version	5.1
PEiD Signatures	`PE32 executable (DLL) (GUI) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	4 libraries WS2_32, KERNEL32, USER32, ADVAPI32
Exports	1 functions
Resources	1 Resources
Sections	7 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	218,284 bytes	218,624 bytes	6.67 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`6501B010F7246E5B10295D5927ABF7F0`
`.rdata`	`0x00037000`	60,100 bytes	60,416 bytes	5.13 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`18758A7C30B53B165B50832B3CC634B6`
`.data`	`0x00046000`	27,840 bytes	14,336 bytes	4.67 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E569B2B175809744A88CC7ABA2D5802D`
`.rsrc`	`0x0004d000`	480 bytes	512 bytes	4.72 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`436E6DA939E30227FCFFB33BF3B96C4D`
`.RLD0`	`0x0004e000`	16,780 bytes	16,896 bytes	6.73 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`739BEDA7D106374BD54B795ECC60D113`
`.RLD1`	`0x00053000`	173,264 bytes	173,568 bytes	7.64 (Packed/Encrypted)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`F0DD641E7F019043F84D0A02D0EC0127`
`.reloc`	`0x0007e000`	16,976 bytes	17,408 bytes	6.50 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`18C07248C57C91D794A543CCE9EB61A2`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

3 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 1 (381 bytes)

Resource Type	Count	Total Size	Percentage
RT_MANIFEST	1	381 bytes	100%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

Security engines flagged this file. Review the detections and verify the exact download before running it.

1
Weekly Quick Scans: Set a reminder to run a scan every Sunday. Most infections are caught within the first week, so regular checks give you peace of mind.
2
Update Everything: Those annoying update popups exist for a reason — they patch security holes. Windows, browsers, Adobe, Java — keep them all current.
3
Download Smart: Stick to official websites and app stores. If a "free" version of paid software sounds too good to be true, it probably comes with unwanted extras.
4
Think Before You Click: Malware loves email attachments and "urgent" links. Even if an email looks like it's from your bank or a friend, verify suspicious requests through a different channel.

Proactive Protection

37 security engines flagged this file. Could be a real threat, or could be a false alarm — common with keygens, game trainers, and legitimate system utilities. Check if the file has a valid digital signature and whether it came from the official source.

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Signed in via Gridinsoft Portal · View profile

Your Score for

5 4 3 2 1

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now