Open-source atomic malware analysis

Analyze another

libffmpeg.dirty.dylib.xz

XZ
Verdict: SUSPICIOUS
SHA256: 49dc1e512e1bd89c4fc5ea4d996d7089ba2d8b9aedf8fbd217e5057d6e3042fc
Mal-ecule
KO₆(AlAs₃CCaDy₂I)H₄(CmFDb₂Os)Md₃(BiSi₂)
Size 1.5 MB download
First seen 118 days ago
Analyzed 116 days ago
Ecosystem malcontent-samples

Well-known

baseline severity, 95% confident.
lib FFmpeg/Libav multimedia library marker
baseline severity, 100% confident.
malware/stealer AppleScript dropper component: /tmp/

Micro-behaviors

notable severity, 75% confident.
communications/http/lib NSURLSession class reference
notable severity, 66% confident.
fs/chmod chmod syscall
baseline severity, 95% confident.
crypto/hash MD5 hashing functions
baseline severity, 90% confident.
os/msdos DOS dispatcher check op
baseline severity, 90% confident.
os/signal Abort program execution

Metadata

suspicious severity, 100% confident.
entitlement Allow unsigned executable memory
notable severity, 70% confident.
binary Data section dominates file
notable severity, 100% confident.
signed Allow JIT compilation
baseline severity, 100% confident.
arch::arm64-macho ARM64 Mach-O binary
baseline severity, 100% confident.
binary/linking Mach-O install name metadata
baseline severity, 100% confident.
build Mach-O UUID present
baseline severity, 95% confident.
dylib::system/library/frameworks/corefoundation/framework/versions/a links /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (OBJC_CLASS_$_NSURL)
baseline severity, 95% confident.
dylib::system/library/frameworks/foundation/framework/versions/c links /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation (OBJC_CLASS_$_NSMutableURLRequest, OBJC_CLASS_$_NSString, OBJC_CLASS_$_NSURLSessionConfiguration, OBJC_CLASS_$_NSURLSession)
baseline severity, 95% confident.
dylib::usr/lib/libobjc/a links /usr/lib/libobjc.A.dylib (objc_msgSend, objc_autoreleasePoolPop, objc_autoreleasePoolPush)
baseline severity, 95% confident.
dylib::usr/lib/libsystem/b links /usr/lib/libSystem.B.dylib (stack_chk_guard, fabs, acos, tan, asin, ... +127 more)
baseline severity, 100% confident.
hardened-runtime Hardened runtime enabled
baseline severity, 90% confident.
hardening::stack-chk-fail __stack_chk_fail function
baseline severity, 100% confident.
notarized Binary is notarized by Apple

20 of 41 traits shown

Identity

SHA-256 49dc1e512e1bd89c4fc5ea4d996d7089ba2d8b9aedf8fbd217e5057d6e3042fc
Filename libffmpeg.dirty.dylib.xz

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 26 Apr 2026 09:18 UTC
Last updated 26 Apr 2026 09:18 UTC

Labeling

Label bad
Label source harvest
Traits version bf48d