Analysis showcase

The PDF-Brain app executed, creating temporary Metal, GPU, Flutter-engine cache, and CFNetwork download files, and issued DNS queries for etoftheappyrince.org and atsheisdomestic.org.

Network IOCs

2 domains

Captured files

24 artifacts

Code signing

Unsigned

The sample launched /usr/bin/osascript via /bin/zsh to run Maccy.scpt; osascript queried api.live-updates.online and modified cache and HTTP storage files under the user's Library directories.

Process chain

zsh → osascript

Network IOCs

1 domain

Captured files

2 artifacts

The sample executed its veltod binary, resolved raw.githubusercontent.com, and attempted a TLS connection to that host over port 443 while modifying temporary and user cache database files.

Code signing

Revoked

Network IOCs

1 domain, 9 IPs

Captured files

4 artifacts