MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4ddd6f1a6bfba850ee0a753ff722bcbeaf35e2c6da17b581a9e967e6cea859ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 2
| SHA256 hash: | 4ddd6f1a6bfba850ee0a753ff722bcbeaf35e2c6da17b581a9e967e6cea859ac |
|---|---|
| SHA3-384 hash: | 13a87c64a68f9678a28beaa3f8ff4a3c61a66d4aa65493dba0e18e8de89caf2f728d4a4dc824918b4806944b759db8fa |
| SHA1 hash: | a6cb054613b25308fa62df18ef466742b7767009 |
| MD5 hash: | c3ddd1095434e7a70ff9d8397ad38299 |
| humanhash: | mississippi-lima-five-gee |
| File name: | recovered_item0_4ddd6f1a6bfb.scpt |
| Download: | download sample |
| File size: | 524 bytes |
| First seen: | 2026-09-18 05:29:59 UTC |
| Last seen: | Never |
| File type: | |
| MIME type: | application/octet-stream |
| ssdeep | 12:eFvsgY3J2dRubJCdliQft8qjW51npmudDUDP2WEhtn:eFEBJ2d0tCd7tc1nZdIDPITn |
| TLSH | T125F09E8167C8A86DC617E2D40F23C88105D1E6244FF3B740DB5D7B898854F718C62FE1 |
| Magika | unknown |
| Reporter |  c4ffeine |
| Tags: | AMOS apph4 AppleScript Foxveil macOS scpt unpacked |
c4ffeine
Second, smaller compiled AppleScript (524 B) decrypted from the same Foxveil 'apph4' loader, sealed under a separate key from the 77-item stealer array. Parent Mach-O sha256 f3b6962c49b361c63fe9d0af9a83e10a52133360117e4c8ac68272160a60edac. Included for completeness so the two stages can be told apart.Intelligence
File Origin
# of uploads :
1
# of downloads :
31
Origin country :
USVendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
2.5/10
Confidence:
100%
Gathering data
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
4ddd6f1a6bfba850ee0a753ff722bcbeaf35e2c6da17b581a9e967e6cea859ac
(this sample)
Link
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.