File scan report
Verdict Safe
Is tbb.
This Intel threading library DLL is listed in a known-software reference database, is widely distributed since 2011 and was flagged by none of the 71 antivirus engines that…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
This file can be kept as part of the application it shipped with. Keep your antivirus enabled as usual.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Signer not verified
- Test run Completed
- First seen 15y ago
Chapter 02
Why we think so
1 point against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
It appears in a known-software reference database as a component of the game Crusader Kings II, and 366 sources have submitted it since it was first seen on Jun 28, 2011. Its signature claims Intel but failed verification because the certificate was revoked. That weakens proof of origin but is not a sign of malware here.
No antivirus engine, including 18 major antivirus engines, reported anything on this file. A known-software reference database lists this exact file as part of Crusader Kings II, which is a strong benign anchor. It has been widely distributed since 2011, with 366 distinct submitters. The embedded signature names Intel but fails verification because the certificate was revoked, so it cannot confirm the publisher. The sandbox only recorded the DLL being loaded through rundll32 and Windows error reporting, with no named injection target. Taken together, the evidence supports a legitimate runtime library.
What We Detected
None of the 71 antivirus engines that checked it flagged this DLL. It matches a known-software reference entry for the game Crusader Kings II and has been submitted by 366 sources since Jun 28, 2011. Its signature claims Intel but failed verification because the certificate was revoked.
Threat Behavior
In the sandbox runs, the DLL was loaded via rundll32 and Windows error reporting followed. No process injection target, persistence or malicious sandbox verdict was recorded. No complete host-reputation result is available for the few addresses seen.
What To Do Now
No action is needed if this file came with the game or another legitimate application. Keep your security software enabled and up to date.
Where this verdict could be wrong1 caveat
- The embedded Intel certificate has been revoked, so the signature cannot vouch for the file's origin. However, a known-software reference listing, 14 years of wide distribution and zero detections make tampering unlikely.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the file.
- Listed in a known-software reference database as part of Crusader Kings II.
- Widely distributed, with 366 submitters since 2011.
- No named injection target or malicious sandbox verdict was recorded.
- The embedded Intel signature failed verification because the certificate was revoked.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 12sandbox rule tags
- 1spawned processes
- 3network contacts
- 40filesystem & mutex artifacts
Includes 12 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; a signature that did not verify.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 6, 2026, 9:11 AM UTC
- SHA-256
2280e7acdef5e2ccf20454f11756a44e2cb3e2afd05d6d2d0ef5836c04e12e32- SHA-1
c36b39bafefa17a07d95ef7ca08bc6e1ef5f9fca- MD5
0140288cc9d146ad73e0b2e37bfb855e
About this file
tbb.dll is a Win32 DLL file of 142.6 kB.
- Type and size
- Win32 DLL · 142.6 kB
- Signer
- Intel(R) Software Products (unverified signature)Worth noting: Malware sometimes copies or steals a company's signature, so this does not mean that company made it.
- First seen
- Jun 28, 2011On VirusTotal.
- Submitted by
- 366 distinct sources
- Packer
- None detected
- Entropy
- 7.26 of 8
First scanned Updated
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is tbb.dll safe?
What is tbb.dll?
How many antivirus engines detected tbb.dll?
Is tbb.dll digitally signed?
What is the SHA-256 hash of tbb.dll?
Is it safe to use tbb.dll?
How up to date is this analysis of tbb.dll?
Community
Member reviews and reports for this exact file hash.