Overview

overview

4

Static

static

1

Ricoh_IM_C....0.dmg

macos-10.15-amd64

4

Ricoh_IM_C...er.pkg

macos-10.15-amd64

4

Analysis

  • max time kernel
    84s
  • max time network
    270s
  • platform
    macos-10.15_amd64
  • resource
    macos-20250619-en
  • resource tags

    arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    10/08/2026, 06:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Ricoh_IM_C3000_C3500_C4500_LIO_1.13.0.0/Ricoh_IM_C3000_C3500_C4500_LIO_Driver.pkg
  • Size 3.5MB
  • Sample260810-g5b6pasfre
  • SHA256 a673c70223bec786db0eb86c670bedb2fa34e8ffa79f501526f872c418f9c17a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
defense_evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 8 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    defense_evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
    1⤵
      PID:468
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
      1⤵
        PID:468
      • /usr/bin/sudo
        sudo /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
        1⤵
          PID:468
          • /bin/zsh
            /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
            2⤵
              PID:469
            • /usr/sbin/installer
              installer -pkg /Users/run/setup.pkg -target /
              2⤵
                PID:469
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.installd
              1⤵
                PID:493
              • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                1⤵
                  PID:493
                • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
                  /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Root/Library/Printers/RICOH/Utilities/AutoSetupToolRV1.app
                  1⤵
                    PID:495
                  • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
                    /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Root/Library/Printers/RICOH/Filters/commandfilterRV1.app
                    1⤵
                      PID:496
                    • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
                      /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Root/Library/Printers/RICOH/Filters/pstopsRV2.app
                      1⤵
                        PID:497
                      • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
                        /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Root/Library/Printers/Generic/Filters/pstopsRV1.app
                        1⤵
                          PID:498
                        • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
                          /System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
                          1⤵
                            PID:499
                          • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove
                            /System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Root /
                            1⤵
                              PID:500
                            • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
                              /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c
                              1⤵
                                PID:501
                              • /usr/libexec/xpcproxy
                                xpcproxy com.apple.nsurlstoraged
                                1⤵
                                  PID:506
                                • /usr/libexec/nsurlstoraged
                                  /usr/libexec/nsurlstoraged --privileged
                                  1⤵
                                    PID:506
                                  • /usr/libexec/xpcproxy
                                    xpcproxy com.apple.StreamingUnzipService 198
                                    1⤵
                                      PID:509
                                    • /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                                      /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                                      1⤵
                                        PID:509

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            RICOH.balanceadjustment.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Boms/RICOH.balanceadjustment.pkg.bom
                                            • Size 36KB
                                            • SHA256 0b0dea976b0501f7b504689bd57a39f1d0fe8384879c3677d579b76d86bae586
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            com.RICOH.print.IM_C3000_C3500_C4500.ICCs.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Boms/com.RICOH.print.IM_C3000_C3500_C4500.ICCs.pkg.bom
                                            • Size 34KB
                                            • SHA256 511838cdd82461a892709876e97ec9a45dcb7d1a51d820ab16e4cbe572ed045d
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            com.RICOH.print.IM_C3000_C3500_C4500.icons.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Boms/com.RICOH.print.IM_C3000_C3500_C4500.icons.pkg.bom
                                            • Size 34KB
                                            • SHA256 23320c81b201691203896238ff03310c90905a255b3fc2f4d15967ed9b355717
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            com.RICOH.print.IM_C3000_C3500_C4500.ppds.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Boms/com.RICOH.print.IM_C3000_C3500_C4500.ppds.pkg.bom
                                            • Size 34KB
                                            • SHA256 0b6b05c8c67cfd7afb85a2dfa6fca2eb3a61226b322559900ad3305610406d50
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.autosetuptool.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Boms/ricoh.autosetuptool.pkg.bom
                                            • Size 34KB
                                            • SHA256 18c39173cc0f0e71d8419945071e80140bee3132f18918677ddbf65a600b8efa
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.backgroundnumbering.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Boms/ricoh.backgroundnumbering.pkg.bom
                                            • Size 36KB
                                            • SHA256 804a7daa7e09ca5cd8bf521d087d50f18821b13f809c4e0419980e01b6eb7f79
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.commandfilter.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Boms/ricoh.commandfilter.pkg.bom
                                            • Size 34KB
                                            • SHA256 938cfa513d18d694ed0941173b85e63db7ae92a2a9fcb6584d7e841ea73930a4
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.copycontrol.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Boms/ricoh.copycontrol.pkg.bom
                                            • Size 43KB
                                            • SHA256 78baaa273447a1f5697c41be62f723af006a91c811f8efdde31314ba401fe7dc
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.cupsfilter.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Boms/ricoh.cupsfilter.pkg.bom
                                            • Size 34KB
                                            • SHA256 00cdf6275006be88f1c41cf73af3b6f93fb1a42f147c725b7f3d2746d502939d
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.gencupsfilter.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Boms/ricoh.gencupsfilter.pkg.bom
                                            • Size 34KB
                                            • SHA256 e354f2f502ae08d739c483abf2277d709b0c52d19b07347faa6cb84102219c03
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.genjoblog.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Boms/ricoh.genjoblog.pkg.bom
                                            • Size 36KB
                                            • SHA256 820e04ec24ace1c9f6356273357fdceaa3783cb267ac257ad94620cb79d783af
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.genuserAuthentication.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Boms/ricoh.genuserAuthentication.pkg.bom
                                            • Size 37KB
                                            • SHA256 69dbc141ded152dd985f48cb8dda8361aacf87dc5011b1f626e16f2084f5db10
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.joblog.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Boms/ricoh.joblog.pkg.bom
                                            • Size 36KB
                                            • SHA256 bd83c98456f49472463e5c6e669bbb7829365ed9f1ed9c7a223f065dd641fb79
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.userAuthentication.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Boms/ricoh.userAuthentication.pkg.bom
                                            • Size 37KB
                                            • SHA256 17f7c3a15ba8938f59ee4ed18e94247cccd64cec7955edf48be0628f23de901c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Info.plist
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Root/Library/Printers/Generic/Filters/pstopsRV1.app/Contents/Info.plist
                                            • Size 1KB
                                            • SHA256 794fea4adf038dc465e7ff2986cb14ed4b65218b61113029d6a84ddb1e0a8cf8
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            Info.plist
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Root/Library/Printers/RICOH/Filters/commandfilterRV1.app/Contents/Info.plist
                                            • Size 1KB
                                            • SHA256 9e85af2f2ba55482c22178eb6c6df428f0435711991f82e244d45b01185ce93e
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            InfoPlist.strings
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Root/Library/Printers/RICOH/Filters/commandfilterRV1.app/Contents/Resources/English.lproj/InfoPlist.strings
                                            • Size 92B
                                            • SHA256 39cf2ee07b7b333e7c179d0bf4d798a5b72af6a4e584f51e642703bbfa4fc828
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            Info.plist
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Root/Library/Printers/RICOH/Filters/pstopsRV2.app/Contents/Info.plist
                                            • Size 1KB
                                            • SHA256 64a50a3740848ba0e1d6a7657569683065f2260292d9c62ccd3f59bc9fde707c
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            Info.plist
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/BE6540E8-4E04-445E-8716-31BED0810CE3.activeSandbox/Root/Library/Printers/RICOH/Utilities/AutoSetupToolRV1.app/Contents/Info.plist
                                            • Size 1KB
                                            • SHA256 4eaf01adab4acc9701eb26942c41dc57bb087c589c9983740213f20b03a77752
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            installd.commit.pid
                                            • Path /private/var/run/installd.commit.pid
                                            • Size 3B
                                            • SHA256 560aa3e6e94314c78236109e209ac79e15e05ec8bf2dcb78300ae65e720edf9e
                                            • MD5 SHA1 SHA512
                                            Submit Download