libcef.dll: the Chromium Embedded Framework library, or a planted loader?

What libcef.dll does

CEF is an open-source project based on Google Chromium that lets other programs embed a full web browser: a browser control inside a native program, a program whose interface is written in web technologies, or web pages drawn off-screen. libcef.dll is its main library. The CEF documentation's default Windows layout places it next to the program's executable together with icudtl.dat, chrome_100_percent.pak, chrome_200_percent.pak, resources.pak, snapshot_blob.bin, v8_context_snapshot.bin and a locales folder. A program that uses CEF has to show CEF's BSD license, usually on an About or Credits page.

Because a program loads libcef.dll from its own folder by name, the file is a target for DLL sideloading. An attacker copies a legitimate, signed program that uses CEF into a folder of their choice and puts a malicious libcef.dll beside it. Windows starts the signed program, and the program loads the attacker's file. HijackLibs lists three programs known to load libcef.dll this way: NVIDIA Share.exe from NVIDIA GeForce Experience, QnWallpaper.exe and QnwPlayer.exe.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of libcef.dll

Five questions decide it: where the file is, what sits next to it, how large it is, what it says about itself and who signed it. A library never shows in Task Manager under its own name, so use these checks.

1. List every copy and where it sits. Copies under Program Files, Program Files (x86) or a program's folder in AppData\Local are normal, one per program that uses CEF. Look closer at copies in Downloads, Desktop, Temp, C:\Users\Public, ProgramData or a folder with a random name.

   Get-ChildItem -Path C:\ -Filter libcef.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Look at what sits next to it. A genuine CEF folder holds the program's .exe and the CEF resource files: icudtl.dat, resources.pak and other .pak files, the .bin snapshot files and a locales folder. A libcef.dll beside a lone signed .exe and an unknown data file, such as an extra sqlite3.dll, is the pattern of a planted loader.
3. Compare the size. The CEF library is large: the copies in the public catalogue range from about 11 MB to 69 MB. The fake libcef.dll in the documented DarkGate campaign was 1,514 KB. A file of a megabyte or two under this name is not a CEF build.
4. Read the version resource. A CEF build describes itself as Chromium Embedded Framework (CEF) Dynamic Link Library. Many genuine copies leave the company field empty, so this check alone does not clear or condemn a file: fake files can copy the text fields too.

   (Get-Item "C:\path\to\libcef.dll").VersionInfo | Format-List CompanyName, FileDescription, FileVersion

5. Check the digital signature. Programs from established makers usually sign the libcef.dll they ship. Status Valid with the program maker's name is a good sign. NotSigned or HashMismatch on a copy outside a program you installed means you should treat it as hostile. A signed .exe next to it proves nothing about the DLL.

   Get-AuthenticodeSignature "C:\path\to\libcef.dll" | Format-List Status, SignerCertificate

A valid signature clears that one file. It says nothing about the other files in the folder: in a sideloading attack the malicious code is often in a second, encrypted file that the fake libcef.dll only decrypts and starts.

Do you need libcef.dll?

Keep every copy inside the programs you installed: without it those programs cannot open their web-based windows or do not start at all. A copy that failed the checks above belongs to no program you use, and the safe way out is to remove the whole folder it came with and scan the PC.

1. Leave the copies of installed programs alone. A copy in a program's install folder belongs to that program. If it is damaged or flagged, the program's repair or reinstall restores its own copy; deleting it only breaks the program.
2. Uninstall a program you do not recognise. Open Settings, Apps, Installed apps, look for a program you did not install around the date the file appeared, and uninstall it. If the libcef.dll sits in a folder no installed program uses, end any process started from that folder in Task Manager and delete the whole folder, not only the DLL.
3. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds. Look at Protection history afterwards for anything found in Downloads, Temp, AppData or ProgramData.
4. Run the offline scan. Loaders started through sideloading often install further malware that hides while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.

   Start-MpWDOScan

5. Check what starts with Windows. Open Task Manager, Startup apps, and Task Scheduler. Disable and remove entries that start a program from AppData, ProgramData, Temp or C:\Users\Public that you do not recognise, after the scan.
6. Change passwords if the loader ran. DarkGate and similar loaders give attackers remote access and can steal saved browser passwords and session cookies. Change your important passwords from a clean device and sign out of other sessions.

Warning signs

Documented abuse of libcef.dll

Security researchers have documented a malicious libcef.dll being loaded through a genuine, signed program that normally uses the CEF library.

The signed .exe proves nothing about the libcef.dll next to it. Judge the DLL by its own size, signature and folder.

Programs that have been made to load a fake libcef.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted libcef.dll. Usually the attacker copies the program into another folder and puts a fake libcef.dll next to it: Windows looks in the program's own folder first. A libcef.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine libcef.dll belongs: C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience

Source: the HijackLibs entry for libcef.dll, 6 public reports.

Known versions of libcef.dll

A public DLL catalogue lists 15 versions of libcef.dll, from 1.0.0.1 to 3.3071.1639.0, by Unknown. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix libcef.dll errors on uGetFix

Questions people ask