No it isn't. It does however appear in searches as a 12KB GuLoader DLL.
Here's the same filehash:
You must be registered to see the links
You're talking about what's in your HoD/app.7z/ folder. I'm talking about the folder above that that contains nsis7z.dll, StdUtils.dll and System.dll
The behaviour analysis on VirusTotal also matches a downloader. It checks to make sure it's not in a VM/Sandbox.
This seems suspicious. Why even wrap the app within this? You could just distribute your app.7z without it. What program are you using to make this self contained exe file?
First of all, you're right to be cautious and I totally understand your concerns. I'm a solo dev, and I'm learning those things on the go, so I could totally do something wrong without knowing or wanting. Even if try to be cautious on those things. Let me explain:
Those files (System.dll, StdUtils.dll, nsis7z.dll) are standard NSIS components:
Why the hash appears in malware databases: NSIS is one of the most widely used installer frameworks in the world (used by Discord, Spotify, VS Code, and thousands of other legitimate apps). Because of this, malware authors frequently abuse it to package their malware. The same legitimate System.dll appears in both clean and malicious packages. The hash matching doesn't indicate the file itself is malicious, just that it's widely used.
Why I use this packaging method: I use electron-builder (
You must be registered to see the links
) with the "portable" target. This automatically creates an NSIS-based self-extracting package - I don't manually add these DLLs, electron-builder bundles them automatically. This is well-documented behavior:
You must be registered to see the links
Why not distribute app.7z directly: The app.7z alone can't run - it needs the Electron runtime environment (node.dll, electron.exe, etc.) which are all inside that archive. The NSIS wrapper extracts everything to a temp folder and launches it.
Why not just distribute the HTML file directly? The game streams videos from the RedGifs API. Browsers block cross-origin requests (CORS) when opening local HTML files directly (file:// protocol). Before switching to Electron, I had to run python -m http.server 8000 to play - which was too technical for most players. Electron packages Chromium in a way that allows these API calls to work with a simple double-click.
I hope this addresses your concerns, but if you have a better packaging method you'd recommend, I'm genuinely open to suggestions.