Overview

overview

4

Static

static

3

JetBrains_...ch.exe

macos-10.15-amd64

1

JetBrains_....2.dmg

macos-10.15-amd64

4

Analysis

  • max time kernel
    231s
  • max time network
    241s
  • platform
    macos-10.15_amd64
  • resource
    macos-20241101-en
  • resource tags

    arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    28/03/2025, 10:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JetBrains_PyCharm_Professional_2023.1.2/pycharm-professional-2023.1.2.dmg

  • Size

    670.6MB

  • MD5

    61e6ca28053b2c135b4e6f98202832aa

  • SHA1

    0aecf7bce88ae1f0e6111299ce9fbc4883d0c654

  • SHA256

    46d8c03dd18de5a87837f3a437ae05ad7ad1ba3d61d742cef5124a30f5aa1109

  • SHA512

    29e85989bce02138388740a14169b2cd745c66466a5870a0f1b90845867e8741bb165278c27ba3fa767afeaa0abe9ea404e52ea069676918ad7cbff6dd863ac7

  • SSDEEP

    12582912:ikLkHpL7HG6kzAUHzF10ZipcA/fOxx74bCvJPUvMrMj9Z4:dk06kEU8Za/01JsXRZ

Score
4/10
defense_evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 4 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    defense_evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"open /Volumes/PyCharm/PyCharm.app\""
    1⤵
      PID:506
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"open /Volumes/PyCharm/PyCharm.app\""
      1⤵
        PID:506
      • /usr/bin/sudo
        sudo /bin/zsh -c "open /Volumes/PyCharm/PyCharm.app"
        1⤵
          PID:506
          • /bin/zsh
            /bin/zsh -c "open /Volumes/PyCharm/PyCharm.app"
            2⤵
              PID:507
            • /usr/bin/open
              open /Volumes/PyCharm/PyCharm.app
              2⤵
                PID:507
            • /usr/libexec/xpcproxy
              xpcproxy com.jetbrains.pycharm.2324
              1⤵
                PID:510
              • /Volumes/PyCharm/PyCharm.app/Contents/MacOS/pycharm
                /Volumes/PyCharm/PyCharm.app/Contents/MacOS/pycharm
                1⤵
                  PID:510
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.replayd
                  1⤵
                    PID:511
                  • /usr/libexec/xpcproxy
                    xpcproxy com.apple.ReportMemoryException
                    1⤵
                      PID:512
                    • /usr/libexec/replayd
                      /usr/libexec/replayd
                      1⤵
                        PID:511
                      • /usr/libexec/ReportMemoryException
                        /usr/libexec/ReportMemoryException
                        1⤵
                          PID:512
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.spindump
                          1⤵
                            PID:515
                          • /usr/sbin/spindump
                            /usr/sbin/spindump
                            1⤵
                              PID:515
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.spindump_agent
                              1⤵
                                PID:516
                              • /usr/libexec/spindump_agent
                                /usr/libexec/spindump_agent
                                1⤵
                                  PID:516
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.installd
                                  1⤵
                                    PID:524
                                  • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                                    /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                                    1⤵
                                      PID:524
                                    • /usr/libexec/xpcproxy
                                      xpcproxy com.apple.DesktopServicesHelper.713922E8-1625-42B8-8B14-414198DB9E64
                                      1⤵
                                        PID:526
                                      • /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
                                        /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
                                        1⤵
                                          PID:526
                                        • /usr/libexec/xpcproxy
                                          xpcproxy com.apple.storedownloadd
                                          1⤵
                                            PID:529
                                          • /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
                                            /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
                                            1⤵
                                              PID:529
                                            • /usr/libexec/xpcproxy
                                              xpcproxy com.apple.system_installd
                                              1⤵
                                                PID:531
                                              • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
                                                /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
                                                1⤵
                                                  PID:531
                                                • /usr/libexec/xpcproxy
                                                  xpcproxy com.apple.Safari.CacheDeleteExtension 502
                                                  1⤵
                                                    PID:534
                                                  • /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
                                                    /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
                                                    1⤵
                                                      PID:534
                                                    • /usr/libexec/xpcproxy
                                                      xpcproxy com.apple.DiagnosticReportCleanup.plist
                                                      1⤵
                                                        PID:535
                                                      • /usr/libexec/xpcproxy
                                                        xpcproxy com.apple.ReportMemoryException
                                                        1⤵
                                                          PID:536
                                                        • /usr/libexec/ReportMemoryException
                                                          /usr/libexec/ReportMemoryException
                                                          1⤵
                                                            PID:536
                                                          • /usr/libexec/xpcproxy
                                                            xpcproxy com.apple.Safari.CacheDeleteExtension 502
                                                            1⤵
                                                              PID:538

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads