» libEGL.dll
Overview
Analysis
File Details

libEGL.dll

ANGLE libEGL Dynamic Link Library

Qingdao Ruanmei Network Technology Co.,Ltd.

libEGL.dll is the ANGLE library provides runtime WebGL and other OpenGL content by translating OpenGL calls to DirectX calls and is recompiled by Qingdao Ruanmei Network Technology Co.,Ltd.. The module libEGL.dll by Qingdao Ruanmei Network Technology Co.,Ltd has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. Note, this is a common distributed file and although it has been detected it might not be a threat is un-coupled from its distribution source.

File name:

libEGL.dll

Publisher:

Qingdao Ruanmei Network Technology Co.,Ltd. (signed and verified)

Product:

ANGLE libEGL Dynamic Link Library

Version:

2.1.0.1a1b30c37e13

MD5:

3c6bda8484a055be0462fd74581d419e

SHA-1:

ccf8c5dd60b60a1784fa7b6a8add0d371361f9fe

SHA-256:

e0a014d580ee31600ffc15aad1a25ea6e15f1cf5c5b12da38e9c83855de289a9

Scanner detections:

1 / 68

Status:

Adware

Explanation:

This is the ANGLE library provides runtime WebGL and other OpenGL content by translating OpenGL calls to DirectX calls. While the file itself is not dangerous, it is part of a program that has been detected.

Analysis date:

1/13/2025 3:59:01 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP (M)

17.3.14.20

File size:

91.7 KB (93,856 bytes)

Product version:

2.1.0.1a1b30c37e13

Original file name:

libEGL.dll

File type:

Dynamic link library (Win32 DLL)

Common path:

C:\Program Files\ruanmei\qiyu\2.1.0.0\libegl.dll

Digital Signature

Signed by:

Qingdao Ruanmei Network Technology Co.,Ltd.

Authority:

VeriSign, Inc.

Valid from:

3/13/2016 8:00:00 AM

Valid to:

8/27/2017 7:59:59 AM

Subject:

CN="Qingdao Ruanmei Network Technology Co.,Ltd.", OU=IT, O="Qingdao Ruanmei Network Technology Co.,Ltd.", L=Qingdao, S=Shandong, C=CN

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

50284BE9AB1A229C8F2C9FDD7B7E4AE4

File PE Metadata

Compilation timestamp:

11/8/2016 6:42:55 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

14.0

Entry address:

0x17F4

Entry point:

55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 65, 03, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 9E, FE, FF, FF, 83, C4, 0C, 5D, C2, 0C, 00, 55, 8B, EC, A1, 18, 30, 01, 10, 83, E0, 1F, 6A, 20, 59, 2B, C8, 8B, 45, 08, D3, C8, 33, 05, 18, 30, 01, 10, 5D, C3, 55, 8B, EC, 8B, 45, 08, 56, 8B, 48, 3C, 03, C8, 0F, B7, 41, 14, 8D, 51, 18, 03, D0, 0F, B7, 41, 06, 6B, F0, 28, 03, F2, 3B, D6, 74, 19, 8B, 4D, 0C, 3B, 4A, 0C, 72, 0A, 8B, 42, 08, 03, 42, 0C, 3B, C8, 72, 0C, 83, C2, 28, 3B, D6, 75, EA, 33, C0, 5E, 5D, C3... 
[+]

Entropy:

6.5761

Developed / compiled with:

Microsoft Visual C++

Code size:

42.5 KB (43,520 bytes)

Remove libEGL.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.