Open-source atomic malware analysis

Analyze another

libffmpeg.dirty.dylib

MACHO
Verdict: HOSTILE
SHA256: a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67
Mal-ecule
KO₅(AlAs₃CDy₂I)H₄(CmFDb₂Os)Md₃(BiSi₂)Th₃
Size 4.7 MB download
First seen 117 days ago
Analyzed 116 days ago
Ecosystem malcontent-samples

Well-known

baseline severity, 100% confident.
malware/stealer AppleScript dropper component: /tmp/

Micro-behaviors

notable severity, 75% confident.
communications/http/lib NSURLSession class reference
notable severity, 66% confident.
fs/chmod chmod syscall
baseline severity, 95% confident.
crypto/hash MD5 hashing functions

Metadata

suspicious severity, 100% confident.
entitlement Allow unsigned executable memory
notable severity, 70% confident.
binary Data section dominates file
notable severity, 100% confident.
signed Developer ID: 3CX
baseline severity, 100% confident.
arch::arm64-macho ARM64 Mach-O binary
baseline severity, 100% confident.
binary/linking Mach-O install name metadata
baseline severity, 100% confident.
build Mach-O UUID present
baseline severity, 95% confident.
dylib::system/library/frameworks/corefoundation/framework/versions/a links /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (OBJC_CLASS_$_NSURL)
baseline severity, 95% confident.
dylib::system/library/frameworks/foundation/framework/versions/c links /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation (OBJC_CLASS_$_NSMutableURLRequest, OBJC_CLASS_$_NSString, OBJC_CLASS_$_NSURLSessionConfiguration, OBJC_CLASS_$_NSURLSession)
baseline severity, 95% confident.
dylib::usr/lib/libobjc/a links /usr/lib/libobjc.A.dylib (objc_msgSend, objc_autoreleasePoolPop, objc_autoreleasePoolPush)
baseline severity, 95% confident.
dylib::usr/lib/libsystem/b links /usr/lib/libSystem.B.dylib (stack_chk_guard, fabs, acos, tan, asin, ... +127 more)
baseline severity, 100% confident.
hardened-runtime Hardened runtime enabled
baseline severity, 100% confident.
notarized Binary is notarized by Apple

Third-party

hostile severity, 90% confident.
Sekoia/Downloader/Mac/Smooth Detect the Smooth_Operator malware
hostile severity, 90% confident.
SigBase/3Cxdesktopapp/Macos/Backdoor Detects 3CXDesktopApp MacOS Backdoor component
hostile severity, 90% confident.
SigBase/APT/MAL/Macos/NK/3CX/DYLIB Detects malicious DYLIB files related to 3CX compromise
hostile severity, 90% confident.
Volexity/Apt/Mac Detects the MACOS version of the ICONIC loader.

20 of 44 traits shown

Identity

SHA-256 a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67
Filename libffmpeg.dirty.dylib

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 25 Apr 2026 19:24 UTC
Last updated 25 Apr 2026 19:24 UTC

Labeling

Label bad
Label source harvest
Traits version bf48d