tbb12[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
tbb12.dll
Size 313KB
Sample260828-rmqlgadb95
SHA256 204db22d3704e12023c2122f0a549028dfa96a4b2bffafe054144faae0831146
MD5 f14bf33ac98f9f646a4379a7235ea08c
SHA1 2193bf32598d8469d0bd96aba1bcdde3682789ff
SHA512 45874971882a46e51e16e7c28f08d45f8d2ef96c8319cf6f21eaf602967c6e8cc43528597b6169cfc512a3d10f6e9b0a6f2f088e98653b9d357996688fbd8c90
SSDEEP 3072:lIE7Jyz964oXz+D0xgiQLNSlsn+G2O4i5VAJYYHHzsd8+uvHnbkSMFCW:ltJyzXoGlNR+G2O4BJBzsd8fvHnbp
TLSH
T16F64160ABA980496D91A927CCA334A59E3F27C541391C3CF2260477EEF7BFD6663D214
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tbb12.dll

File Explorer

tbb12.dll

.dll 313KB

tbb12.dll

IMPHASH 6ce04e3cae279293682126442b346690
SHA256 204db22d3704e12023c2122f0a549028dfa96a4b2bffafe054144faae0831146
MD5 f14bf33ac98f9f646a4379a7235ea08c
SHA1 2193bf32598d8469d0bd96aba1bcdde3682789ff
SHA512 45874971882a46e51e16e7c28f08d45f8d2ef96c8319cf6f21eaf602967c6e8cc43528597b6169cfc512a3d10f6e9b0a6f2f088e98653b9d357996688fbd8c90
SSDEEP 3072:lIE7Jyz964oXz+D0xgiQLNSlsn+G2O4i5VAJYYHHzsd8+uvHnbkSMFCW:ltJyzXoGlNR+G2O4BJBzsd8fvHnbp
TLSH
T16F64160ABA980496D91A927CCA334A59E3F27C541391C3CF2260477EEF7BFD6663D214
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

120136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

ReleaseSemaphore CreateSemaphoreExA SetEvent WaitForSingleObjectEx CloseHandle CreateEventExA TlsSetValue DeleteFiber TlsGetValue GetModuleFileNameA SetErrorMode GetModuleHandleExA GetLastError LoadLibraryA GetProcAddress FreeLibrary TlsAlloc TlsFree GetCurrentThreadStackLimits EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetEnvironmentVariableA GetCurrentThreadId lstrcmpA SwitchToThread DeleteCriticalSection GetSystemInfo GetCurrentProcess GetProcessAffinityMask GetCurrentThread GetNativeSystemInfo ResumeThread SwitchToFiber ConvertThreadToFiberEx IsThreadAFiber CreateFiber InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable InitOnceComplete SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead

msvcp140

?__ExceptionPtrCurrentException@@YAXPEAX@Z _Thrd_yield ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Query_perf_frequency ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter _Mtx_destroy_in_situ _Mtx_init_in_situ ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Mtx_unlock

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy _purecall __std_terminate strrchr __std_type_info_destroy_list _CxxThrowException memset __C_specific_handler __current_exception_context __current_exception __std_exception_copy __std_exception_destroy memmove

api-ms-win-crt-heap-l1-1-0

malloc free _aligned_malloc _aligned_free _callnewh

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _initterm_e _cexit _control87 _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv strerror _seh_filter_dll terminate _beginthreadex _initterm abort

api-ms-win-crt-string-l1-1-0

_wcsdup strnlen strspn strncpy_s strncat strncpy

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

fflush __stdio_common_vsprintf __stdio_common_vfprintf __acrt_iob_func fputs

?abort_bounded_queue_monitors@r1@detail@tbb@@YAXPEAVconcurrent_monitor@123@@Z ?acquire@r1@detail@tbb@@YAXAEAVqueuing_rw_mutex@d1@23@AEAVscoped_lock@4523@_N@Z ?acquire@r1@detail@tbb@@YAXAEAVrtm_mutex@d1@23@AEAVscoped_lock@4523@_N@Z ?acquire_reader@r1@detail@tbb@@YAXAEAVrtm_rw_mutex@d1@23@AEAVscoped_lock@4523@_N@Z ?acquire_writer@r1@detail@tbb@@YAXAEAVrtm_rw_mutex@d1@23@AEAVscoped_lock@4523@_N@Z ?allocate@r1@detail@tbb@@YAPEAXAEAPEAVsmall_object_pool@d1@23@_K@Z ?allocate@r1@detail@tbb@@YAPEAXAEAPEAVsmall_object_pool@d1@23@_KAEBUexecution_data@523@@Z ?allocate_bounded_queue_rep@r1@detail@tbb@@YAPEAE_K@Z ?allocate_memory@r1@detail@tbb@@YAPEAX_K@Z ?assertion_failure@r1@detail@tbb@@YAXPEBDH00@Z ?attach@r1@detail@tbb@@YA_NAEAVtask_arena_base@d1@23@@Z ?cache_aligned_allocate@r1@detail@tbb@@YAPEAX_K@Z ?cache_aligned_deallocate@r1@detail@tbb@@YAXPEAX@Z ?cache_line_size@r1@detail@tbb@@YA_KXZ ?call_itt_notify@r1@detail@tbb@@YAXHPEAX@Z ?cancel_group_execution@r1@detail@tbb@@YA_NAEAVtask_group_context@d1@23@@Z ?capture_fp_settings@r1@detail@tbb@@YAXAEAVtask_group_context@d1@23@@Z ?constraints_default_concurrency@r1@detail@tbb@@YAHAEBUconstraints@d1@23@_J@Z ?constraints_threads_per_core@r1@detail@tbb@@YAHAEBUconstraints@d1@23@_J@Z ?construct@r1@detail@tbb@@YAXAEAVqueuing_rw_mutex@d1@23@@Z ?core_type_count@r1@detail@tbb@@YAI_J@Z ?create@r1@detail@tbb@@YAXAEAVglobal_control@d1@23@@Z ?create_itt_sync@r1@detail@tbb@@YAXPEAXPEB_W1@Z ?current_context@r1@detail@tbb@@YAPEAVtask_group_context@d1@23@XZ ?current_suspend_point@r1@detail@tbb@@YAPEAUsuspend_point_type@123@XZ ?deallocate@r1@detail@tbb@@YAXAEAVsmall_object_pool@d1@23@PEAX_K@Z ?deallocate@r1@detail@tbb@@YAXAEAVsmall_object_pool@d1@23@PEAX_KAEBUexecution_data@523@@Z ?deallocate_bounded_queue_rep@r1@detail@tbb@@YAXPEAE_K@Z ?deallocate_memory@r1@detail@tbb@@YAXPEAX@Z ?destroy@r1@detail@tbb@@YAXAEAVglobal_control@d1@23@@Z ?destroy@r1@detail@tbb@@YAXAEAVtask_group_context@d1@23@@Z ?downgrade@r1@detail@tbb@@YA_NAEAVscoped_lock@rtm_rw_mutex@d1@23@@Z ?downgrade_to_reader@r1@detail@tbb@@YA_NAEAVscoped_lock@queuing_rw_mutex@d1@23@@Z ?enqueue@r1@detail@tbb@@YAXAEAVtask@d1@23@AEAVtask_group_context@523@PEAVtask_arena_base@523@@Z ?enqueue@r1@detail@tbb@@YAXAEAVtask@d1@23@PEAVtask_arena_base@523@@Z ?execute@r1@detail@tbb@@YAXAEAVtask_arena_base@d1@23@AEAVdelegate_base@523@@Z ?execute_and_wait@r1@detail@tbb@@YAXAEAVtask@d1@23@AEAVtask_group_context@523@AEAVwait_context@523@1@Z ?execution_slot@r1@detail@tbb@@YAGPEBUexecution_data@d1@23@@Z ?fill_core_type_indices@r1@detail@tbb@@YAXPEAH_J@Z ?fill_numa_indices@r1@detail@tbb@@YAXPEAH@Z ?finalize@r1@detail@tbb@@YA_NAEAVtask_scheduler_handle@d1@23@_J@Z ?get@r1@detail@tbb@@YAXAEAVtask_scheduler_handle@d1@23@@Z ?global_control_active_value@r1@detail@tbb@@YA_KH@Z ?initialize@r1@detail@tbb@@YAXAEAVtask_arena_base@d1@23@@Z ?initialize@r1@detail@tbb@@YAXAEAVtask_group_context@d1@23@@Z ?is_group_execution_cancelled@r1@detail@tbb@@YA_NAEAVtask_group_context@d1@23@@Z ?is_tbbmalloc_used@r1@detail@tbb@@YA_NXZ ?is_writer@r1@detail@tbb@@YA_NAEBVscoped_lock@queuing_rw_mutex@d1@23@@Z ?isolate_within_arena@r1@detail@tbb@@YAXAEAVdelegate_base@d1@23@_J@Z ?itt_make_task_group@r1@detail@tbb@@YAXW4itt_domain_enum@d1@23@PEAX_K12W4string_resource_index@d0@23@@Z ?itt_metadata_ptr_add@r1@detail@tbb@@YAXW4itt_domain_enum@d1@23@PEAX_KW4string_resource_index@d0@23@1@Z ?itt_metadata_str_add@r1@detail@tbb@@YAXW4itt_domain_enum@d1@23@PEAX_KW4string_resource_index@d0@23@PEBD@Z ?itt_region_begin@r1@detail@tbb@@YAXW4itt_domain_enum@d1@23@PEAX_K12W4string_resource_index@d0@23@@Z ?itt_region_end@r1@detail@tbb@@YAXW4itt_domain_enum@d1@23@PEAX_K@Z ?itt_relation_add@r1@detail@tbb@@YAXW4itt_domain_enum@d1@23@PEAX_KW4itt_relation@d0@23@12@Z ?itt_set_sync_name@r1@detail@tbb@@YAXPEAXPEB_W@Z ?itt_task_begin@r1@detail@tbb@@YAXW4itt_domain_enum@d1@23@PEAX_K12W4string_resource_index@d0@23@@Z ?itt_task_end@r1@detail@tbb@@YAXW4itt_domain_enum@d1@23@@Z ?max_concurrency@r1@detail@tbb@@YAHPEBVtask_arena_base@d1@23@@Z ?notify_bounded_queue_monitor@r1@detail@tbb@@YAXPEAVconcurrent_monitor@123@_K1@Z ?notify_by_address@r1@detail@tbb@@YAXPEAX_K@Z ?notify_by_address_all@r1@detail@tbb@@YAXPEAX@Z ?notify_by_address_one@r1@detail@tbb@@YAXPEAX@Z ?notify_waiters@r1@detail@tbb@@YAX_K@Z ?numa_default_concurrency@r1@detail@tbb@@YAHH@Z ?numa_node_count@r1@detail@tbb@@YAIXZ ?observe@r1@detail@tbb@@YAXAEAVtask_scheduler_observer@d1@23@_N@Z ?parallel_pipeline@r1@detail@tbb@@YAXAEAVtask_group_context@d1@23@_KAEBVfilter_node@523@@Z ?release@r1@detail@tbb@@YAXAEAVscoped_lock@queuing_rw_mutex@d1@23@@Z ?release@r1@detail@tbb@@YAXAEAVscoped_lock@rtm_mutex@d1@23@@Z ?release@r1@detail@tbb@@YAXAEAVscoped_lock@rtm_rw_mutex@d1@23@@Z ?reset@r1@detail@tbb@@YAXAEAVtask_group_context@d1@23@@Z ?resume@r1@detail@tbb@@YAXPEAUsuspend_point_type@123@@Z ?set_end_of_input@r1@detail@tbb@@YAXAEAVbase_filter@d1@23@@Z ?spawn@r1@detail@tbb@@YAXAEAVtask@d1@23@AEAVtask_group_context@523@@Z ?spawn@r1@detail@tbb@@YAXAEAVtask@d1@23@AEAVtask_group_context@523@G@Z ?submit@r1@detail@tbb@@YAXAEAVtask@d1@23@AEAVtask_group_context@523@PEAVarena@123@_K@Z ?suspend@r1@detail@tbb@@YAXP6AXPEAXPEAUsuspend_point_type@123@@Z0@Z ?terminate@r1@detail@tbb@@YAXAEAVtask_arena_base@d1@23@@Z ?throw_exception@r1@detail@tbb@@YAXW4exception_id@d0@23@@Z ?try_acquire@r1@detail@tbb@@YA_NAEAVqueuing_rw_mutex@d1@23@AEAVscoped_lock@4523@_N@Z ?try_acquire@r1@detail@tbb@@YA_NAEAVrtm_mutex@d1@23@AEAVscoped_lock@4523@@Z ?try_acquire_reader@r1@detail@tbb@@YA_NAEAVrtm_rw_mutex@d1@23@AEAVscoped_lock@4523@@Z ?try_acquire_writer@r1@detail@tbb@@YA_NAEAVrtm_rw_mutex@d1@23@AEAVscoped_lock@4523@@Z ?upgrade@r1@detail@tbb@@YA_NAEAVscoped_lock@rtm_rw_mutex@d1@23@@Z ?upgrade_to_writer@r1@detail@tbb@@YA_NAEAVscoped_lock@queuing_rw_mutex@d1@23@@Z ?wait@r1@detail@tbb@@YAXAEAVtask_arena_base@d1@23@@Z ?wait@r1@detail@tbb@@YAXAEAVwait_context@d1@23@AEAVtask_group_context@523@@Z ?wait_bounded_queue_monitor@r1@detail@tbb@@YAXPEAVconcurrent_monitor@123@_K_JAEAVdelegate_base@d1@23@@Z ?wait_on_address@r1@detail@tbb@@YAXPEAXAEAVdelegate_base@d1@23@_K@Z ?what@bad_last_alloc@r1@detail@tbb@@UEBAPEBDXZ ?what@missing_wait@r1@detail@tbb@@UEBAPEBDXZ ?what@user_abort@r1@detail@tbb@@UEBAPEBDXZ TBB_runtime_interface_version TBB_runtime_version