envsubst

JSON
executablemacOS111.0 KBarm64

Unknown utility — ad hoc signed executable with network connectivity

This arm64 executable is ad hoc signed and contains 141 functions across 5 public frameworks. It initiates connections to 4 network endpoints and references 2 URLs or endpoints in its strings. The binary includes 2 file paths, suggesting local file operations. Without symbols or additional context, the specific purpose cannot be determined from structural analysis alone, but the network connectivity and file access indicate it performs some form of data retrieval or transmission.AI

Fingerprint

Platform
macOS
Type
executable
Arch
arm64
Min OS
26.0.0
SDK
26.0.0
File Size
111.0 KB
UUID
56D3308C-3F04-39B1-95A5-BA74DFF0C611
Analyzed
2026-04-09T08:40:44Z
CDHash
41aaa4e31bb76a2e2ad6483e7aa78df3a893c658e7d8353cfbc73d80cb6ab582

Interesting Strings

Network Surface

Networking Frameworks

DNA Capability Vector

Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0

Behavioral Profile

URL Endpoints
2
Telemetry Strings
0
File Paths
2
Bundle IDs
0
IOKit Constants
0
Library Functions
39

Structural HashesSHA-256

Static Libraries39 / 141 functions identified

Functions(141)

0x100001b80main
0x100002038usage
0x100002184find_variables
0x100002264print_variable
0x10000228cnote_variable
0x100002314cmp_string
0x100002320do_getc
0x100002368last_component
0x1000023acbase_len
0x1000023f4c_strcasecmp
0x100002448c32isalnum
0x10000248cc32isspace
0x1000024ccclose_stdout
0x10000255cflush_stdout
0x1000025a4error_tail
0x10000269cOUTLINED_FUNCTION_0
0x1000026b0rpl_free
0x1000026e4full_write
0x100002760fwriteerror
0x100002768do_fwriteerror

Imports70 symbols from 3 dylibs

Exports123

_getopt_internal_r0x2870
_getopt_long_only_r0x33fc
_getopt_long_r0x33e0
_gl_start_options0x4c7c
_mh_execute_header0x0
_rwsd_new_addr0x66f0
_sd_c0x69c4
_sd_c_casecmp0x65f0
_sd_char_at0x6474
_sd_cmp0x655c
_sd_copy0x685c
_sd_endswith0x651c
_sd_equals0x6494
_sd_fwrite0x675c
_sd_index0x6650
_sd_last_index0x6698
_sd_new_addr0x66ec
_sd_overwrite0x6a6c
_sd_startswith0x64dc
_sd_write0x6718
base_len0x23ac
c32isalnum0x2448
c32isspace0x248c
c_strcasecmp0x23f4
close_stdout0x24cc
error0x7494
error_at_line0x75e4
error_message_count0x10e10
error_one_per_line0x10e14
error_print_progname0x10e18
exit_failure0x10000
freea0x3568
full_write0x26e4
fwriteerror0x2760
fwriteerror_no_ebadf0x2868
get_next_option0x4eb4
gl_get_setlocale_null_lock0x5c08
last_component0x2368
locale_charset0x340c
main0x1b80
mbrtoc320x3590
mbslen0x35f4
mbsstr0x3794
mem_cd_iconv0x5ca8
memrchr0x4bac
mmalloca0x34f8
program_name0x10e08
proper_name0x4fd0
proper_name_utf80x5814
reallocarray0x5a1c
rpl_free0x26b0
rpl_getopt0x3364
rpl_getopt_internal0x3300
rpl_getopt_long0x33d4
rpl_getopt_long_only0x33f0
rpl_optarg0x10e20
rpl_opterr0x10008
rpl_optind0x10004
rpl_optopt0x1000c
rpl_setlocale0x5ad4
safe_write0x5a50
sb_append10x6154
sb_append_c0x6214
sb_append_desc0x61ac
sb_contents0x62a4
sb_contents_c0x62b0
sb_dupfree0x62ec
sb_dupfree_c0x63a8
sb_ensure_more_bytes0x60a0
sb_free0x628c
sb_init0x6084
sb_xappend10x72b0
sb_xappend_c0x72e8
sb_xappend_desc0x72cc
sb_xcontents_c0x7304
sb_xdupfree0x7320
sb_xdupfree_c0x7354
sd_concat0x68c0
sd_fill0x6a3c
sd_free0x6aa4
sd_from_c0x66f4
sd_new0x67a8
sd_new_empty0x66e0
sd_new_filled0x67f8
sd_readonly0x646c
sd_readwrite0x6470
sd_set_char_at0x6a1c
set_program_name0x4f3c
setlocale_null0x5b58
setlocale_null_r0x5ae0
setlocale_null_r_unlocked0x5c1c
setlocale_null_unlocked0x5c14
str_cd_iconv0x5f14
str_iconv0x5fbc
strnlen10x6aac
trim20x6ae4
verror0x7410
verror_at_line0x74bc
x2nrealloc0x6f34
x2realloc0x6f2c
xalloc_die0x71b0
xcalloc0x7070
xcharalloc0x6e6c
xicalloc0x70ac
ximalloc0x6e50
ximemdup0x7100
ximemdup00x7138
xinmalloc0x6f04
xirealloc0x6ea4
xireallocarray0x6ec0
xizalloc0x708c
xmalloc0x6e34
xmem_cd_iconv0x71fc
xmemdup0x70c8
xnmalloc0x6edc
xnrealloc0x6dfc
xpalloc0x6f94
xrealloc0x6e88
xreallocarray0x6e18
xstr_cd_iconv0x7238
xstr_iconv0x7274
xstrdup0x7174
xzalloc0x7050