Antivirus scan for b2e3300f71024be8c30ef3d18289231a066a2c17a5d88d7b2f580fe11697ba64 at 2017-07-09 02:17:33 UTC

Antivirus	Resultat	Opdatere
Ad-Aware		20170709
AegisLab		20170709
AhnLab-V3		20170708
Alibaba		20170709
ALYac		20170709
Antiy-AVL		20170708
Arcabit		20170709
Avast		20170709
AVG		20170709
Avira (no cloud)		20170708
AVware		20170709
Baidu		20170707
BitDefender		20170709
Bkav		20170706
CAT-QuickHeal		20170708
ClamAV		20170708
CMC		20170707
Comodo		20170709
CrowdStrike Falcon (ML)		20170420
Cylance		20170709
Cyren		20170708
DrWeb		20170708
Emsisoft		20170708
Endgame		20170706
ESET-NOD32		20170709
F-Prot		20170709
F-Secure		20170709
Fortinet		20170629
GData		20170708
Ikarus		20170708
Sophos ML		20170607
Jiangmin		20170709
K7AntiVirus		20170707
K7GW		20170708
Kaspersky		20170708
Kingsoft		20170709
Malwarebytes		20170709
MAX		20170709
McAfee		20170708
McAfee-GW-Edition		20170708
Microsoft		20170709
eScan		20170708
NANO-Antivirus		20170709
nProtect		20170709
Palo Alto Networks (Known Signatures)		20170709
Panda		20170708
Qihoo-360		20170709
Rising		20170709
SentinelOne (Static ML)		20170516
Sophos AV		20170709
SUPERAntiSpyware		20170708
Symantec		20170708
Symantec Mobile Insight		20170707
Tencent		20170709
TheHacker		20170707
TrendMicro		20170708
TrendMicro-HouseCall		20170708
Trustlook		20170709
VBA32		20170707
VIPRE		20170708
ViRobot		20170708
Webroot		20170709
WhiteArmor		20170706
Yandex		20170707
Zillya		20170707
ZoneAlarm by Check Point		20170709
Zoner		20170709

The file being studied is an Apple Disk Image! More specifically it follows the Universal Disk Image Format, commonly found with the DMG extension.

Contained file bundles

This DMG contains a hierarchical file system that stores the following file bundles.

[+] /Install Type3.2.pkg 6071005 Bytes

[+] /.fseventsd/000000000301d780 141 Bytes

[+] /.fseventsd/000000000301d781 71 Bytes

[+] /.fseventsd/000000000301d817 128 Bytes

[+] /.fseventsd/000000000301d818 72 Bytes

BLKX Table

Entry Attributes

Driver Descriptor Map (DDM : 0) 0x0050

Apple (Apple_partition_map : 1) 0x0050

disk image (Apple_HFS : 2) 0x0050

(Apple_Free : 3) 0x0050

DMG XML Property List

Entry Attributes

ID:0 0x0050

DMG structural properties

DMG version

Data fork offset

0x0

Data fork length

8064066

Resource fork offset

0x0

Resource fork length

Resource fork keys

blkx, plst

Running data fork offset

0x0

XML offset

0x8064066

XML length

7432

PLST keys

resource-fork

File identification

MD5 bc96f30a2ab6aa33c8f40401feea7c83

SHA1 91cad65da7016618291cfec8666961ff634fbd5d

SHA256 b2e3300f71024be8c30ef3d18289231a066a2c17a5d88d7b2f580fe11697ba64

ssdeep

196608:I6wfN55J6/bv+fbMUXoaN1W8UPY6OPyfIsE9t1AOOAyYFnhhM:IbLsoYqN/Rv8ARM

File size 7.7 MB ( 8072010 bytes )

File type Macintosh Disk Image

Magic literal

bzip2 compressed data, block size = 100k

TrID	Macintosh Disk image (BZ2 compressed) (96.3%) bzip2 compressed archive (3.6%)

VirusTotal metadata

First submission 2017-07-09 02:17:33 UTC ( 1 år, 1 månediden )

Last submission 2017-07-09 02:17:33 UTC ( 1 år, 1 månediden )

Filnavne

Type32demo.dmg

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

[appstoreupdateag] /System/Library/CoreServices/ServerVersion.plist (failed)

[appstoreupdateag] /System/Library/CoreServices/SystemVersion.bundle (successful)

[appstoreupdateag] /System/Library/CoreServices/SystemVersion.bundle/Base.lproj (failed)

[appstoreupdateag] /System/Library/CoreServices/SystemVersion.bundle/English.lproj (successful)

[appstoreupdateag] /System/Library/CoreServices/SystemVersion.bundle/English.lproj/SystemVersion.strings (successful)

[appstoreupdateag] /System/Library/CoreServices/SystemVersion.plist (successful)

[appstoreupdateag] /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources (successful)

[appstoreupdateag] /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/Base.lproj (successful)

[appstoreupdateag] /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/English.lproj (successful)

[appstoreupdateag] /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/appstoreupdateagent (successful)

Read files

[sh] /tmp/PKInstallSandbox.TMhE9a/Scripts/cr8software.net.pkg.Type32DEMO.application.GoUSGP/postinstall (successful)

[appstoreupdateag] /System/Library/CoreServices/SystemVersion.bundle/English.lproj/SystemVersion.strings (successful)

[appstoreupdateag] /Users/user1/.CFUserTextEncoding (successful)

[cp] /Applications/Type3.2DEMO.app/Contents/Resources/TypeScripts/actions/apple.atn (successful)

[cp] /Applications/Type3.2DEMO.app/Contents/Resources/TypeScripts/actions/decompose.atn (successful)

[cp] /Applications/Type3.2DEMO.app/Contents/Resources/TypeScripts/actions/glyph validation.atn (successful)

[cp] /Applications/Type3.2DEMO.app/Contents/Resources/TypeScripts/actions/glyphs.gfs (successful)

[cp] /Applications/Type3.2DEMO.app/Contents/Resources/TypeScripts/actions/italic 10 degrees.atn (successful)

[cp] /Applications/Type3.2DEMO.app/Contents/Resources/TypeScripts/actions/ordinals.atn (successful)

[cp] /Applications/Type3.2DEMO.app/Contents/Resources/TypeScripts/actions/random effect.atn (successful)

Written files

[install_monitor] /var/db/.dat.nosync02bd.P8zxa2 (successful)

[unknown] /Applications (successful)

[unknown] /Library/Fonts (successful)

[unknown] /Users/user1/Documents/TypeScripts (successful)

[unknown] /Users/user1/Documents/TypeScripts/actions (successful)

[unknown] /Users/user1/Documents/TypeScripts/composites (successful)

[unknown] /Users/user1/Documents/TypeScripts/opentype (successful)

[unknown] /Users/user1/Documents/TypeScripts/opentype/Kerning.feax (successful)

[unknown] /Users/user1/Documents/TypeScripts/opentype/Small capitals.feax (successful)

[unknown] /Users/user1/Documents/TypeScripts/opentype/Swash.feax (successful)

Moved files

SRC: /var/db/.dat.nosync02bd.P8zxa2
DST: /var/db/.InstallerTMExcludes.plist (successful)
PS: install_monitor

SRC: /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/9ED44AC7-483E-4CDE-871D-9691C7009401.activeSandbox/Root/Applications/Type3.2DEMO.app
DST: /Applications/Type3.2DEMO.app (successful)
PS: shove

SRC: /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/9ED44AC7-483E-4CDE-871D-9691C7009401.activeSandbox/Root/Library/Fonts/CharisSIL-R.ttf
DST: /Library/Fonts/CharisSIL-R.ttf (successful)
PS: shove

SRC: /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/9ED44AC7-483E-4CDE-871D-9691C7009401.activeSandbox/Root/Library/Fonts/CR8supp.ttf
DST: /Library/Fonts/CR8supp.ttf (successful)
PS: shove

SRC: /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/9ED44AC7-483E-4CDE-871D-9691C7009401.activeSandbox/Root/Library/Fonts/GalSILR.ttf
DST: /Library/Fonts/GalSILR.ttf (successful)
PS: shove

SRC: /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/9ED44AC7-483E-4CDE-871D-9691C7009401.activeSandbox/Root/Library/Fonts/Quivira.ttf
DST: /Library/Fonts/Quivira.ttf (successful)
PS: shove

SRC: /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/9ED44AC7-483E-4CDE-871D-9691C7009401.activeSandbox/Root/Library/Fonts/ScheherazadeRegOT.ttf
DST: /Library/Fonts/ScheherazadeRegOT.ttf (successful)
PS: shove

SRC: /var/db/.dat.nosync02bd.P8zxa2
DST: /var/db/.InstallerTMExcludes.plist (successful)
PS: install_monitor

Created processes

chmod -R +rwx /Applications/Type3.2DEMO.app/Contents/Resources/gfs.icns (successful)

/usr/libexec/diskmanagementd (successful)

install_monitor (successful)

cp -r /Applications/Type3.2DEMO.app/Contents/Resources/TypeScripts /Users/user1/Documents/ (successful)

chown -R root:staff /Users/user1/Documents/TypeScripts (successful)

chmod -R +rwx /Users/user1/Documents/TypeScripts (successful)

chmod -R +rwx /Applications/Type3.2DEMO.app/Contents/Resources/action.icns (successful)

efw_cache_update (successful)

chmod -R +rwx /Applications/Type3.2DEMO.app/Contents/Resources/Type3help.pdf (successful)

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/appstoreupdateagent (successful)

DNS requests

www.apple.com (23.218.213.175)

TCP connections

23.218.213.175:80

SHA256:	b2e3300f71024be8c30ef3d18289231a066a2c17a5d88d7b2f580fe11697ba64
Filnavn:	Type32demo.dmg
Opdagelses forhold:	0 / 57
Undersøgelses dato:	2017-07-09 02:17:33 UTC ( 1 år, 1 månediden ) Se seneste

Ciphered bundle