Tbb dll (Intel(R) Threading Building Blocks library) Intel Corporation 文件恶意软件分析

Tbb.dll (Intel(R) Threading Building Blocks library) 文件分析

更新于 1 day ago

检查者 Malware Check

tbb.dll

哈希类型	值	操作
MD5	4792a8c74e7897048d6bbe15485c3e35
SHA1	a1e453d63f9a49bcf454158e5c40118701334cb8
SHA256	7cc7b31ae53f53475955084c408d9c48b7e18d88293ae0a8b80d1a37b3e9af11
SHA512	3d33e2c6764b638e15a031419263de8b0b6c6446cb1f6059c75685804d874acb08b493fd42946b304c1b6088b91bbfe2b97911e083d629c400d6a743af6d9c52
ImpHash	21285fba501c90992f0ce86a1acda562

哈希类型

值

操作

MD5

4792a8c74e7897048d6bbe15485c3e35

SHA1

a1e453d63f9a49bcf454158e5c40118701334cb8

SHA256

7cc7b31ae53f53475955084c408d9c48b7e18d88293ae0a8b80d1a37b3e9af11

SHA512

3d33e2c6764b638e15a031419263de8b0b6c6446cb1f6059c75685804d874acb08b493fd42946b304c1b6088b91bbfe2b97911e083d629c400d6a743af6d9c52

ImpHash

21285fba501c90992f0ce86a1acda562

PE 分析

基本信息

▼

映像基址	`0x180000000`
入口点	`0x180020ae0`
编译时间	2020-09-15 01:10:03
校验和	0x0003e2db (实际: 0x000398d0)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (DLL) (GUI) x86-64, for MS Windows`
PDB 路径	`C:\Users\m_bol\Perforce\m_bolduc_win2\_external_libs\tbb\2020_u2\oneTBB-2020_U2-modified\oneTBB-2020_U2-modified\build\vs2013\x64\Release\tbb.pdb`
数字签名	No valid SignedData structure was found.
导入	9 库 KERNEL32, MSVCP140, VCRUNTIME140, api-ms-win-crt-string-l1-1-0, api-ms-win-crt-heap-l1-1-0, api-ms-win-crt-runtime-l1-1-0, api-ms-win-crt-stdio-l1-1-0, api-ms-win-crt-environment-l1-1-0, BlueStar_2024_3_2
导出	243 函数
资源	2 资源
节	6 节

版本信息

▼

CompanyName	Intel Corporation
FileDescription	Intel(R) Threading Building Blocks library
FileVersion	2020, 2, 0, 0
LegalCopyright	Copyright 2005-2020 Intel Corporation. All Rights Reserved.
LegalTrademarks
OriginalFilename	tbb.dll
ProductName	Intel(R) Threading Building Blocks for Windows
ProductVersion	2020, 2, 0, 0
PrivateBuild
SpecialBuild
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	135,168 bytes	134,656 bytes	6.24 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`560CF4ADF60BFE482998DFB04907B0DA`
`.rdata`	`0x00022000`	61,440 bytes	61,440 bytes	5.10 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`3451A685AE716656419B4C96297C9EBD`
`.data`	`0x00031000`	24,576 bytes	13,312 bytes	3.40 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`6486C9566CF61BD2211FE4AF0B51FA11`
`.pdata`	`0x00037000`	12,288 bytes	11,264 bytes	5.21 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`0BFB7F8CDA13496AD7BCE83C2C842625`
`.rsrc`	`0x0003a000`	4,096 bytes	1,536 bytes	4.10 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`B84EDC0F2F5A236BF8013B80D91F0D55`
`.reloc`	`0x0003b000`	4,367 bytes	4,608 bytes	3.77 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`2D2FF0D9BADEC248AE9942898BEEF376`

资源分析

▼

资源总数: 2 (1,369 字节)

资源类型	数量	总大小	百分比
RT_VERSION	1	988 字节	72.2%
RT_MANIFEST	1	381 字节	27.8%

证书链分析

▼

证书 Information

产品	Intel(R) Threading Building Blocks for Windows
描述	Intel(R) Threading Building Blocks library
文件版本	2020, 2, 0, 0
原始名称	tbb.dll
版权	Copyright 2005-2020 Intel Corporation. All Rights Reserved.

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	tbb.dll
文件类型	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
扫描器版本	1.0.218.174
数据库版本	2025-06-21 16:00:27 UTC

Tbb.dll (Intel(R) Threading Building Blocks library) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别