0f561db6723a721bd54c7f303072846023bb5b39be0846fcf098ae4b93f7df98

max time kernel
73s
max time network
104s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
02/07/2026, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bcf454acf82e4504149f7ffe07081dbc.svg
Size 6KB
Sample260702-mcjb7aet7p
SHA256 0f561db6723a721bd54c7f303072846023bb5b39be0846fcf098ae4b93f7df98
MD5 bcf454acf82e4504149f7ffe07081dbc
SHA1 734b511206fe97aeffce8e9564e2734163dc8c13
SHA512 1d4ce182c4e8fb4041f27b9f6bf62009397108433796bb2ccf595ad7d47f1ddbd522c071a9f0708b32fb09c588d3ecf2d9b7f4111d26d4d73719ca018c69b120
SSDEEP 96:+VpIyuAQd6tfcjTz5bNhVFDYTEC81Wx1kTHjM1mFbHRsC0mm0PmMSQK:sfuiSbNfBS10jM1kWCfM9QK
TLSH
T168D1BA6D2378463CF832A2B8D3357131695E44EE2600B354FA6E8834BB255ED95B7CE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/bcf454acf82e4504149f7ffe07081dbc.svg\""
1⤵
PID:471

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/bcf454acf82e4504149f7ffe07081dbc.svg\""
1⤵
PID:471

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/bcf454acf82e4504149f7ffe07081dbc.svg
1⤵
PID:471
- /bin/zsh
  /bin/zsh -c /Users/run/bcf454acf82e4504149f7ffe07081dbc.svg
  2⤵
  PID:473
- /Users/run/bcf454acf82e4504149f7ffe07081dbc.svg
  /Users/run/bcf454acf82e4504149f7ffe07081dbc.svg
  2⤵
  PID:473
- /bin/sh
  sh /Users/run/bcf454acf82e4504149f7ffe07081dbc.svg
  2⤵
  PID:473
- /bin/bash
  sh /Users/run/bcf454acf82e4504149f7ffe07081dbc.svg
  2⤵
  PID:473

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:464

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:460

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:455

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:457

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:467

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads