Analysis
-
max time kernel
98s -
max time network
101s -
platform
macos_amd64 -
resource
macos-20220504-en -
submitted
08-05-2022 17:10
Behavioral task
behavioral1
Sample
OTKPblTb 3512 - 341053.pdf
Resource
macos-20220504-en
General
-
Target
OTKPblTb 3512 - 341053.pdf
-
Size
325KB
-
MD5
4fc2ac9dd403c8ed1f1830020ed24bc5
-
SHA1
f194b156b3705492f35cab495c2f6126d5b693db
-
SHA256
8cd69137791ee2158c0431e02114f850cb63ddfbd8f0c8301ab10750238d36c3
-
SHA512
8026275eaf0f1dba3204a273074aadf9cab6b8b16e5ba46c3f9718111d118ff9c307c58510df0def0de9b4c782db53dc1a148adac343fa16f3904e6e24588063
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/OTKPblTb 3512 - 341053.pdf\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/OTKPblTb 3512 - 341053.pdf\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/OTKPblTb 3512 - 341053.pdf\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/OTKPblTb 3512 - 341053.pdf"1⤵
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/OTKPblTb 3512 - 341053.pdf"1⤵
-
/bin/zsh/bin/zsh -c "/Users/run/OTKPblTb 3512 - 341053.pdf"2⤵
-
/bin/zsh/bin/zsh -c "/Users/run/OTKPblTb 3512 - 341053.pdf"2⤵
-
/Users/run/OTKPblTb/Users/run/OTKPblTb 3512 - 341053.pdf2⤵
-
/Users/run/OTKPblTb/Users/run/OTKPblTb 3512 - 341053.pdf2⤵
-
/usr/sbin/spctl/usr/sbin/spctl --status1⤵
-
/usr/sbin/spctl/usr/sbin/spctl --test-devid-status1⤵
-
/usr/bin/syslog/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.tailspind1⤵
-
/usr/libexec/tailspind/usr/libexec/tailspind1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵
-
/usr/sbin/spindump/usr/sbin/spindump1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump_agent1⤵
-
/usr/libexec/spindump_agent/usr/libexec/spindump_agent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.20281⤵
-
/Applications/Safari.app/Contents/MacOS/Safari/Applications/Safari.app/Contents/MacOS/Safari1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.History1⤵
-
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.WebKit.WebContent.9621A616-D4CA-4A26-B775-4EC1539E54B7 5361⤵
-
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.SafariLaunchAgent1⤵
-
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.WebKit.WebContent.17E0D37F-B122-40B9-8175-FBCEE5274007 5361⤵
-
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari/mds/mdsDirectory.dbFilesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari/mds/mdsDirectory.dbFilesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari/mds/mdsDirectory.db_Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari/mds/mdsObject.dbFilesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari/mds/mdsObject.db_Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/AutoFillQuirks.plistFilesize
36KB
MD50e97fc2d7544eb365c42e2d75768e360
SHA1926d52c4fe960e171998238871be62d2b3cadde3
SHA256f21f9c4f7816a27fbfe67c57fdd0021adc7945cdb36f475499515ba18bde0d3d
SHA512f94eceef1453ea01ac5e7b3707ca351342440a87d52a93543530d8e8ae2540e6a4fd81c9e6fa6fe61f3aced3d4f3917a28607f85f5dfcaf4eef76350f4b70722
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CloudHistoryRemoteConfiguration.plistFilesize
1012B
MD50c29425555c7ff0ca114b1fd0dc39c50
SHA1d7d808e8be92462f4c3ceba66734f0e9bb26acdd
SHA25652826afeec974bb7bacb85bdc01dc4f23bf917d65e04773d7cad393f7866f3fd
SHA512d9c8364a85f4b4a96caac1409f32f9d6b2f8ae19201e0abd2d449a3eedadd471e99e44bc92deb5d8fb60287da64a88e61b45f759e7b9a383a9bbe5f5fd242f95
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownExtensions.plistFilesize
2KB
MD599707b6e8b1daa434de2a176a458f85c
SHA196324f62483dd7ac8683d1850d694bb900eb3419
SHA256f282d8a52bfdcd208792a47c074e59a1e16d627d53094e11fc73e595aec7ddad
SHA512e8018018f91a5ce5c418f5c6445dc11a44b40aa6f619958d496b18507b3fe309415bf9ab293e9c7c0b3e4ba109213d0216d39c0304a7bc3cce301db0a729430c
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Preferences.plistFilesize
76B
MD5cdc65b5f112547eafae0f16f9c149426
SHA1aeaf9908a5b6ff3e2f7b738abf5fe9e79108ba01
SHA2561c6d085d871a855ce4a3902bab4b9b92631b8ee8f0b7f6536768a2aaf427b45c
SHA512e8b0e4ce6a760a718a19976d3cfe9063f04fb4bf179947aeca84e94c83f21459fb9dc0ffabea8f633bd2d0ba94fe1e15d8c97e9604fde8bd0dea961eb83bddb7