Analysis Report

Overview

General Information

Joe Sandbox Version:	18.0.0
Analysis ID:	32821
Start time:	14:51:16
Joe Sandbox Product:	Cloud
Start date:	07.02.2017
Overall analysis duration:	0h 9m 35s
Report type:	full
Sample file name:	52efcfe30f96a85c9c068880c20663db64f0e08346e0f3b59c2e5bbcb41ba73c.app
Cookbook file name:	default.jbs
Analysis system description:	Mac Mini, El Capitan 10.11.6 (Java 1.8.0_25)
Detection:	MAL
Classification:	mal60.spyw.troj.macAPP@0/4@0/0

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	60	0 - 100	Report FP / FN

Classification

Signature Overview

Click to jump to signature section

Networking:

Downloads files from webservers via HTTP

Show sources

Source: global traffic

HTTP traffic detected: GET /Servermac.php HTTP/1.1 Host: 46.17.97.37 Accept: */* Accept-Language: en-us Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: Bitdefender%20Adware%20Removal%20Tool/1009 CFNetwork/760.6.3 Darwin/15.6.0 (x86_64)

Reads from file descriptors related to (network) sockets

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)

Reads from socket in process:

Writes from file descriptors related to (network) sockets

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)

Writes from socket in process:

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

TCP traffic: 192.168.0.50:5353 -> 224.0.0.251:5353

Stealing of Sensitive Information:

Executes the "uname" command used to read OS and architecture name

Show sources

Source: /bin/sh (PID: 533)

Uname executable: /usr/bin/uname -> uname -a

Enumerates the installed applications

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: dictionary
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: numbers
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: microsoft excel
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: game center
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: notes
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: time machine
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: stickies
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: keynote
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: garageband
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: image capture
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: launchpad
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: font book
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: photo booth
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: imovie
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: ibooks
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: textedit
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: calculator
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: mail
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: system preferences
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: quicktime player
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: mission control
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: app store
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: dvd player
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: calendar
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: microsoft powerpoint
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: iphoto
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: microsoft outlook
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: itunes
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: reminders
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: facetime
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: safari
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: microsoft word
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: messages
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: photos
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: pages
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: contacts
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: maps
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: dashboard
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: microsoft onenote
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: automator
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: preview
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Application directory enumerated: chess

Executes the "dscl" command with authonly argument (probably to verify the login password)

Show sources

Source: /bin/sh (PID: 531)

Security executable: /usr/bin/dscl -> dscl . -authonly vreni

Executes the "ifconfig" command used to gather network information

Show sources

Source: /bin/sh (PID: 535)

Ifconfig executable: /sbin/ifconfig -> ifconfig

Executes the "security" command used to access the keychain

Show sources

Source: /bin/sh (PID: 534)

Security executable: /usr/bin/security -> security list

Persistence and Installation Behavior:

Reads data from the local random generator

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Random device file read: /dev/random
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Random device file read: /dev/random

Uses AppleKeyboardLayouts bundle containing keyboard layouts

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)

AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Executes commands using a shell command-line interpreter

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 530)	Shell command executed: sh -c if dscl . -authonly vreni \|grep failed then echo no else echo ok fi
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 533)	Shell command executed: sh -c uname -a
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 534)	Shell command executed: sh -c security list
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 535)	Shell command executed: sh -c ifconfig

Executes the "grep" command used to find patterns in files or piped streams

Show sources

Source: /bin/sh (PID: 532)

Grep executable: /usr/bin/grep -> grep failed

Reads launchservices plist files

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices.plist
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist

Reads user launchservices plist file containing default apps for corresponding filetypes

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)

Preferences launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist

Uses AppleScript framework/components containing Apple Script related functionalities

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plist

Uses AppleScript scripting additions containing additional functionalities for Apple Scripts

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist

Uses CFNetwork bundle containing interfaces for network communication (HTTP, sockets, and Bonjour)

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)

CFNetwork info plist opened: /System/Library/Frameworks/CFNetwork.framework/Resources/Info.plist

System Summary:

Classification label

Show sources

Source: classification engine

Classification label: mal60.spyw.troj.macAPP@0/4@0/0

HIPS / PFW / Operating System Protection Evasion:

Reads the sysctl safe boot value (probably to check if the system is in safe boot mode)

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)

Sysctl read request: kern.safeboot (1.66)

Language, Device and Operating System Detection:

Reads the system or server version plist file

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)

System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist

Reads hardware related sysctl values

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Sysctl read request: hw.ncpu (6.3)
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Sysctl read request: hw.cpu_freq (6.15)
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Sysctl read request: hw.availcpu (6.25)

Reads the kernel OS version value

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)

Sysctl read request: kern.osversion (1.65)

Reads the systems OS release and/or type

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Sysctl requested: kern.ostype (1.1)
Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Sysctl requested: kern.osrelease (1.2)
Source: /usr/bin/uname (PID: 533)	Sysctl requested: kern.ostype (1.1)
Source: /usr/bin/uname (PID: 533)	Sysctl requested: kern.osrelease (1.2)

Reads the systems hostname

Show sources

Source: /Users/vreni/Desktop/unpack/addone flashplayer.app/Contents/MacOS/Bitdefender Adware Removal Tool (PID: 527)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 530)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 533)	Sysctl requested: kern.hostname (1.10)
Source: /usr/bin/uname (PID: 533)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 534)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 535)	Sysctl requested: kern.hostname (1.10)

Runtime Messages

Command:	open
Exitcode:	0
Killed:	False
Standard Output:
Standard Error:

Yara Overview

No Yara matches

Screenshot

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Error!

Analysis Report

Overview

General Information

Detection

Classification

Signature Overview

Networking:

Stealing of Sensitive Information:

Persistence and Installation Behavior:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Runtime Messages

Yara Overview

Screenshot