Overview

overview

4

Static

static

3

Bambu_Stud...51.exe

macos-10.15-amd64

4

resources/...x.html

macos-10.15-amd64

4

resources/...mon.js

macos-10.15-amd64

4

resources/...api.js

macos-10.15-amd64

4

resources/...ome.js

macos-10.15-amd64

4

resources/...min.js

macos-10.15-amd64

4

resources/...min.js

macos-10.15-amd64

4

resources/...on2.js

macos-10.15-amd64

4

resources/...umd.js

macos-10.15-amd64

4

resources/...umd.js

macos-10.15-amd64

4

resources/...api.js

macos-10.15-amd64

4

resources/...ive.js

macos-10.15-amd64

4

resources/...ent.js

macos-10.15-amd64

4

resources/...ule.js

macos-10.15-amd64

4

resources/...ams.js

macos-10.15-amd64

4

resources/...ist.js

macos-10.15-amd64

4

resources/...ils.js

macos-10.15-amd64

4

resources/...lar.js

macos-10.15-amd64

4

resources/...lar.js

macos-10.15-amd64

4

resources/...lar.js

macos-10.15-amd64

4

resources/...lar.js

macos-10.15-amd64

4

resources/...int.js

macos-10.15-amd64

4

resources/...dex.js

macos-10.15-amd64

4

resources/...int.js

macos-10.15-amd64

4

resources/...dex.js

macos-10.15-amd64

4

resources/...ses.js

macos-10.15-amd64

4

resources/...dex.js

macos-10.15-amd64

4

resources/...ses.js

macos-10.15-amd64

4

resources/...ore.js

macos-10.15-amd64

4

resources/...lts.js

macos-10.15-amd64

4

resources/...ter.js

macos-10.15-amd64

4

resources/...dex.js

macos-10.15-amd64

4

Analysis

  • max time kernel
    146s
  • max time network
    173s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240410-en
  • resource tags

    arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    16-04-2024 21:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    resources/web/guide/swiper/core/events/index.js

  • Size

    2KB

  • MD5

    1e9a00e21bc7af33bd2a93b121578629

  • SHA1

    e3052b373bc6de7e7bb54b98778a643ea22b5124

  • SHA256

    2eab0df6a24dcf12eb52b62813e39e996ddf24f8409cbd5c33a4c2c102e95815

  • SHA512

    bc95040def10ccbd8414855be24ca5051d321191a28a8bb0d90d41ea75b8705709c535003a974f176448ec618664943806fa73c7ffaddaa7123b03c7e9ddba7c

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 5 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/resources/web/guide/swiper/core/events/index.js\""
    1⤵
      PID:511
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/resources/web/guide/swiper/core/events/index.js\""
      1⤵
        PID:511
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/resources/web/guide/swiper/core/events/index.js
        1⤵
          PID:511
          • /bin/zsh
            /bin/zsh -c /Users/run/resources/web/guide/swiper/core/events/index.js
            2⤵
              PID:512
            • /Users/run/resources/web/guide/swiper/core/events/index.js
              /Users/run/resources/web/guide/swiper/core/events/index.js
              2⤵
                PID:512
              • /bin/sh
                sh /Users/run/resources/web/guide/swiper/core/events/index.js
                2⤵
                  PID:512
                • /bin/bash
                  sh /Users/run/resources/web/guide/swiper/core/events/index.js
                  2⤵
                    PID:512
                • /usr/sbin/spctl
                  /usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
                  1⤵
                    PID:616
                  • /bin/launchctl
                    /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                    1⤵
                      PID:623
                    • /bin/launchctl
                      /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                      1⤵
                        PID:624
                      • /usr/libexec/xpcproxy
                        xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                        1⤵
                          PID:631
                        • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                          /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                          1⤵
                            PID:631

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads