MB-4131c88b0dea6ba45cd633eed383240d41620e4467afa4e956d6c2dfafd58c1c
high
📛 Threat Title
Unknown: WindowsCodecs.dll
Description
File type: exe. Size: 28672 bytes. Tags: dll-sideloading, exe, loader, TELEPUZ, WindowsCodecs. Reporter: ghozt. First seen: 2026-09-25 04:06:37.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
4131c88b0dea6ba45cd633eed383240d41620e4467afa4e956d6c2dfafd58c1c
IOC database
- Type
- hash_sha256
- Value
4131c88b0dea6ba45cd633eed383240d41620e4467afa4e956d6c2dfafd58c1c- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
b9b0970281db5f279ad59b2ee7e379312ceec64e
IOC database
- Type
- hash_sha1
- Value
b9b0970281db5f279ad59b2ee7e379312ceec64e- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
4376f6e050ebd456f6640dc0ea408add
IOC database
- Type
- hash_md5
- Value
4376f6e050ebd456f6640dc0ea408add- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_imphash
3da1e1538edcd467227c7f51667e1b54
IOC database
- Type
- hash_imphash
- Value
3da1e1538edcd467227c7f51667e1b54- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 28672 bytes. Tags: dll-sideloading, exe, loader, TELEPUZ, WindowsCodecs. Reporter: ghozt. First seen: 2026-09-25 04:06:37.
Remediations (10)
-
web:cyberpress.org
The flaw exists within windowscodecs.dll , a library leveraged by numerous applications, including Microsoft Office, creating a widespread attack surface across Windows environments.
-
web:cyberpress.org
Microsoft's Windows Imaging Component harbors a critical remote code execution vulnerability that security researchers have determined is significantly harder to exploit than initially feared. Tracked as CVE-2025-50165, the flaw affects WindowsCodecs.dll , the core library that processes standard image formats, including PNG, GIF, and JPG. The Technical Mechanism Zscaler ThreatLabz first ...
-
web:cybersecuritynews.com
The research highlights the need to keep third-party libraries updated and to implement effective input validation for image processing operations. The Windows Imaging Component vulnerability can result in remote code execution (RCE) attacks under complex attack scenarios.
-
web:hijacklibs.net
windowscodecs.dll is loaded by 23 applications vulnerable to DLL Sideloading and Environment Variable-based DLL Hijacking. Find out on HijackLibs which apps are vulnerable, how you can detect malicious use of windowscodecs.dll , and how to remediate.
-
web:learn.microsoft.com
'The program cant start because WindowsCodecs.dll is missing from your computer. Try reinstalling the program to fix this problem.' But i have never touched that file. i dont even know what it is. Whats going on with my computer?
-
web:learn.microsoft.com
Download Microsoft Edge More info about Internet Explorer and Microsoft Edge windowscodecs.dll file missing Anonymous 2013-10-29T23:24:48+00:00 I'm sure this question has already been asked a hundred times but how do I re-install this program? My lap top is so out of wack right now it's pathetic.
-
web:winlibrary.org
Learn what windowscodecs.dll is, why errors appear, and how to fix them on Windows 10/11. Includes informational metadata like version, size and hashes.
-
web:www.eset.com
As WindowsCodecs.dll is a library, a host application would be considered vulnerable if it allows JPG images to be (re-)encoded, and exploitable only if an attacker has enough control over the application (address leak, heap manipulation).
-
web:www.welivesecurity.com
On November 20 th, 2025, Zscaler ThreatLabz published an article documenting the discovery of CVE‑2025‑50165, a high-impact remote code execution vulnerability present in WindowsCodecs.dll .
-
web:www.zscaler.com
CVE-2025-50165 is a critical remote code execution vulnerability in the Windows Graphics Component, specifically within windowscodecs.dll . With a CVSS score of 9.8, it affects Windows 11 and Windows Server 2025.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.