Overview

overview

4

Static

static

1

Ricoh_PS_P....0.dmg

macos-10.15-amd64

4

Ricoh_PS_P...er.pkg

macos-10.15-amd64

4

Analysis

  • max time kernel
    86s
  • max time network
    240s
  • platform
    macos-10.15_amd64
  • resource
    macos-20250619-en
  • resource tags

    arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    10/08/2026, 06:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Ricoh_PS_Printers_Vol4_EXP_LIO_4.4.0.0/Ricoh_PS_Printers_Vol4_EXP_LIO_Driver.pkg
  • Size 20.9MB
  • Sample260810-hev2jsshpf
  • SHA256 1261a1dc098d95abaaf409241d38eb44b3f3a8aca8be081b4e75217886ccdab8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
defense_evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 8 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    defense_evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
    1⤵
      PID:485
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
      1⤵
        PID:485
      • /usr/bin/sudo
        sudo /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
        1⤵
          PID:485
          • /bin/zsh
            /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
            2⤵
              PID:486
            • /usr/sbin/installer
              installer -pkg /Users/run/setup.pkg -target /
              2⤵
                PID:486
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.installd
              1⤵
                PID:487
              • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                1⤵
                  PID:487
                • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
                  /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Root/Library/Printers/RICOH/Utilities/AutoSetupToolRV1.app
                  1⤵
                    PID:488
                  • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
                    /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Root/Library/Printers/RICOH/Filters/commandfilterRV1.app
                    1⤵
                      PID:489
                    • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
                      /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Root/Library/Printers/RICOH/Filters/pstopsRV2.app
                      1⤵
                        PID:490
                      • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
                        /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Root/Library/Printers/Generic/Filters/pstopsRV1.app
                        1⤵
                          PID:491
                        • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
                          /System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
                          1⤵
                            PID:492
                          • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove
                            /System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Root /
                            1⤵
                              PID:493
                            • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
                              /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c
                              1⤵
                                PID:494
                              • /usr/libexec/xpcproxy
                                xpcproxy com.apple.nsurlstoraged
                                1⤵
                                  PID:510
                                • /usr/libexec/nsurlstoraged
                                  /usr/libexec/nsurlstoraged --privileged
                                  1⤵
                                    PID:510
                                  • /usr/libexec/xpcproxy
                                    xpcproxy com.apple.StreamingUnzipService 195
                                    1⤵
                                      PID:511
                                    • /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                                      /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                                      1⤵
                                        PID:511

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            RICOH.balanceadjustment.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Boms/RICOH.balanceadjustment.pkg.bom
                                            • Size 36KB
                                            • SHA256 0b0dea976b0501f7b504689bd57a39f1d0fe8384879c3677d579b76d86bae586
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            RICOH.synchrocut.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Boms/RICOH.synchrocut.pkg.bom
                                            • Size 36KB
                                            • SHA256 9eca2b246d9625b3657590405810efef798189e5e16b9b3b2838073a330eca35
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            com.RICOH.print.PS_Printers_Vol4_EXP.ICCs.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Boms/com.RICOH.print.PS_Printers_Vol4_EXP.ICCs.pkg.bom
                                            • Size 36KB
                                            • SHA256 6b4f8fcd6760a8b664b4c9cbe65d812307914228f03a7ca0e8ee381e628820c2
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            com.RICOH.print.PS_Printers_Vol4_EXP.icons.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Boms/com.RICOH.print.PS_Printers_Vol4_EXP.icons.pkg.bom
                                            • Size 36KB
                                            • SHA256 7aa7a60e0ada998ac907b8aeb878bc6dc17164faa2705a5b1174a3e291349228
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            com.RICOH.print.PS_Printers_Vol4_EXP.ppds.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Boms/com.RICOH.print.PS_Printers_Vol4_EXP.ppds.pkg.bom
                                            • Size 40KB
                                            • SHA256 77e224f7f10289247d5c2c8a9ebbea596c7b44fcbfcf75956a03d2eecabd8763
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.autosetuptool.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Boms/ricoh.autosetuptool.pkg.bom
                                            • Size 34KB
                                            • SHA256 18c39173cc0f0e71d8419945071e80140bee3132f18918677ddbf65a600b8efa
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.backgroundnumbering.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Boms/ricoh.backgroundnumbering.pkg.bom
                                            • Size 36KB
                                            • SHA256 804a7daa7e09ca5cd8bf521d087d50f18821b13f809c4e0419980e01b6eb7f79
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.commandfilter.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Boms/ricoh.commandfilter.pkg.bom
                                            • Size 34KB
                                            • SHA256 938cfa513d18d694ed0941173b85e63db7ae92a2a9fcb6584d7e841ea73930a4
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.copycontrol.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Boms/ricoh.copycontrol.pkg.bom
                                            • Size 43KB
                                            • SHA256 78baaa273447a1f5697c41be62f723af006a91c811f8efdde31314ba401fe7dc
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.cupsfilter.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Boms/ricoh.cupsfilter.pkg.bom
                                            • Size 34KB
                                            • SHA256 00cdf6275006be88f1c41cf73af3b6f93fb1a42f147c725b7f3d2746d502939d
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.gencupsfilter.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Boms/ricoh.gencupsfilter.pkg.bom
                                            • Size 34KB
                                            • SHA256 e354f2f502ae08d739c483abf2277d709b0c52d19b07347faa6cb84102219c03
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.genjoblog.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Boms/ricoh.genjoblog.pkg.bom
                                            • Size 36KB
                                            • SHA256 820e04ec24ace1c9f6356273357fdceaa3783cb267ac257ad94620cb79d783af
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.genuserAuthentication.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Boms/ricoh.genuserAuthentication.pkg.bom
                                            • Size 37KB
                                            • SHA256 69dbc141ded152dd985f48cb8dda8361aacf87dc5011b1f626e16f2084f5db10
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.joblog.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Boms/ricoh.joblog.pkg.bom
                                            • Size 36KB
                                            • SHA256 bd83c98456f49472463e5c6e669bbb7829365ed9f1ed9c7a223f065dd641fb79
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ricoh.userAuthentication.pkg.bom
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Boms/ricoh.userAuthentication.pkg.bom
                                            • Size 37KB
                                            • SHA256 17f7c3a15ba8938f59ee4ed18e94247cccd64cec7955edf48be0628f23de901c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Info.plist
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Root/Library/Printers/Generic/Filters/pstopsRV1.app/Contents/Info.plist
                                            • Size 1KB
                                            • SHA256 794fea4adf038dc465e7ff2986cb14ed4b65218b61113029d6a84ddb1e0a8cf8
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            Info.plist
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Root/Library/Printers/RICOH/Filters/commandfilterRV1.app/Contents/Info.plist
                                            • Size 1KB
                                            • SHA256 9e85af2f2ba55482c22178eb6c6df428f0435711991f82e244d45b01185ce93e
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            InfoPlist.strings
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Root/Library/Printers/RICOH/Filters/commandfilterRV1.app/Contents/Resources/English.lproj/InfoPlist.strings
                                            • Size 92B
                                            • SHA256 39cf2ee07b7b333e7c179d0bf4d798a5b72af6a4e584f51e642703bbfa4fc828
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            Info.plist
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Root/Library/Printers/RICOH/Filters/pstopsRV2.app/Contents/Info.plist
                                            • Size 1KB
                                            • SHA256 64a50a3740848ba0e1d6a7657569683065f2260292d9c62ccd3f59bc9fde707c
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            Info.plist
                                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/D31BF51E-2150-4DC6-B3FF-AE1C59344B64.activeSandbox/Root/Library/Printers/RICOH/Utilities/AutoSetupToolRV1.app/Contents/Info.plist
                                            • Size 1KB
                                            • SHA256 4eaf01adab4acc9701eb26942c41dc57bb087c589c9983740213f20b03a77752
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            installd.commit.pid
                                            • Path /private/var/run/installd.commit.pid
                                            • Size 3B
                                            • SHA256 9b19f9ab816598a0809e4afd5d60800f2dbef9cbb9b03ad2ce766b3c237b9059
                                            • MD5 SHA1 SHA512
                                            Submit Download