997dca7ddd5a143bcd621bca0dd4d6f1d3b7a0a47109bc0017b6c880311b6540

Analysis

user interaction
yes
max time kernel
104s
max time network
104s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
22/10/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
the-new-harbrace-guide-genres-for-composing-fourth-edition-9780357509074-9780357509081_compress.pdf
Size 20.6MB
Sample261022-sha6navv7p
SHA256 997dca7ddd5a143bcd621bca0dd4d6f1d3b7a0a47109bc0017b6c880311b6540
MD5 79c05ed2c1447bf6058812d4a6fe82d8
SHA1 460ad3fc85a712703a58994f26cc119c1fa1b759
SHA512 bb9ca3318c8bba578d76a0e088e5b65495e7d996214b9a91e840f9491de785a28359660567973aca1dd25705ff4183ea796b98cbfcbc49b2ebbf76c98259459e
SSDEEP 393216:jPqMKTDTc2sxVEaywmW7bpAUItpfITnfwPMjPWAWeuREhHV:j4w5xj7VIfITfuMj1uk1
TLSH
T1D3278D14ECA989BCF4DB82705776385D062E33DBEACC1881B9AD4F115B51A0B5E93EC3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	LWWeeklyMessageTracer
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Java Updater

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Users/run/the-new-harbrace-guide-genres-for-composing-fourth-edition-9780357509074-9780357509081_compress.pdf\""
1⤵
PID:462

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Users/run/the-new-harbrace-guide-genres-for-composing-fourth-edition-9780357509074-9780357509081_compress.pdf\""
1⤵
PID:462

/usr/bin/sudo
sudo /bin/zsh -c "open /Users/run/the-new-harbrace-guide-genres-for-composing-fourth-edition-9780357509074-9780357509081_compress.pdf"
1⤵
PID:462
- /bin/zsh
  /bin/zsh -c "open /Users/run/the-new-harbrace-guide-genres-for-composing-fourth-edition-9780357509074-9780357509081_compress.pdf"
  2⤵
  PID:463
- /usr/bin/open
  open /Users/run/the-new-harbrace-guide-genres-for-composing-fourth-edition-9780357509074-9780357509081_compress.pdf
  2⤵
  PID:463

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:451

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:454

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
- Resource Forking
PID:458

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:449

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
- Resource Forking
PID:459

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:467

/usr/libexec/xpcproxy
xpcproxy com.apple.colorsync.useragent
1⤵
PID:496

/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
1⤵
PID:496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.apple.colorsync.profiles.502

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.colorsync.profiles.502
Size 21KB
SHA256 f268fb6b71a54b7f655445ea60dffe3166ade5475d5221c33b13f49cd711a234
MD5 12c6d2422ba76752f124143e987c2e8d
SHA1 ddf94fa2daed6bf5e8bb6a4a16c1adb225131d0a
SHA512 5a42050913b910bf295cc83d3c990a93f9c2392e87e4aa8a134b5ea800c38e58404f46b8e5436f288572040d92bcb87fb57e6c2923b6e2a2d6e6e772b35c4cde
SSDEEP 48:l+B07+EorluafSDojes6GVYUWWZTlwje+d3elNVrJfZi1w8E5j9554bCBkYpdwh8:l+ZplfSDCeZG5uQFrfic59ZU96AeB
TLSH
T1E1A2FBB78BAC2242DAF27EF820F44EB55B37BB11F6676D6D44C616191A03C909270B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download