aa
executablemacOS322.6 KBx86_64, arm64
Keychain access utility — manages and validates credential storage group membership
Provides functionality for accessing and managing items stored in the macOS Keychain, specifically handling group membership validation and credential retrieval. Interacts with the Keychain framework to authenticate requests and enforce access controls for applications seeking to read or write secrets. Makes network calls to 6 endpoints and sends telemetry data, likely for verifying certificate validity or checking group authorization status against remote services. Operates across 25 distinct bundle identifiers, suggesting it serves as a shared credential management component for multiple system and third-party applications.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 11.0.0
- SDK
- 26.1.0
- File Size
- 322.6 KB
- UUID
- 8EB939E1-67A9-39A1-A1CF-418A123A71EA
- Analyzed
- 2026-04-07T05:21:11Z
- CDHash
- 863e8948019a41b197e6e924c87bc8b84d308ceed841019e1f5a5cf71ea72fa2
Capabilities
Entitlements3
Interesting Strings
Bundle IDs(25)
/AppleInternal/Library/BuildRoots/4~B_wdugBjwo3uIoRccHz2nVeQDDWA6q4IkoI7h5E/Library/Caches/com.apple.xbs/Sources/ParallelCompression_executables/Common/BlobBuffer.c/AppleInternal/Library/BuildRoots/4~B_wdugBjwo3uIoRccHz2nVeQDDWA6q4IkoI7h5E/Library/Caches/com.apple.xbs/Sources/ParallelCompression_executables/Common/IOBasicStreams.c/AppleInternal/Library/BuildRoots/4~B_wdugBjwo3uIoRccHz2nVeQDDWA6q4IkoI7h5E/Library/Caches/com.apple.xbs/Sources/ParallelCompression_executables/Common/IOBuffers.c/AppleInternal/Library/BuildRoots/4~B_wdugBjwo3uIoRccHz2nVeQDDWA6q4IkoI7h5E/Library/Caches/com.apple.xbs/Sources/ParallelCompression_executables/Common/StringTable.c/AppleInternal/Library/BuildRoots/4~B_wdugBjwo3uIoRccHz2nVeQDDWA6q4IkoI7h5E/Library/Caches/com.apple.xbs/Sources/ParallelCompression_executables/Common/Utils.c
File Paths(19)
/AppleInternal/Library/BuildRoots/4~B_wdugBjwo3uIoRccHz2nVeQDDWA6q4IkoI7h5E/Library/Caches/com.apple.xbs/Sources/ParallelCompression_executables/Common/BlobBuffer.c/AppleInternal/Library/BuildRoots/4~B_wdugBjwo3uIoRccHz2nVeQDDWA6q4IkoI7h5E/Library/Caches/com.apple.xbs/Sources/ParallelCompression_executables/Common/IOBasicStreams.c/AppleInternal/Library/BuildRoots/4~B_wdugBjwo3uIoRccHz2nVeQDDWA6q4IkoI7h5E/Library/Caches/com.apple.xbs/Sources/ParallelCompression_executables/Common/IOBuffers.c/AppleInternal/Library/BuildRoots/4~B_wdugBjwo3uIoRccHz2nVeQDDWA6q4IkoI7h5E/Library/Caches/com.apple.xbs/Sources/ParallelCompression_executables/Common/StringTable.c/AppleInternal/Library/BuildRoots/4~B_wdugBjwo3uIoRccHz2nVeQDDWA6q4IkoI7h5E/Library/Caches/com.apple.xbs/Sources/ParallelCompression_executables/Common/Utils.c
telemetry(6)
-key* select the 256-bit symmetric key encryption mode -key-gen When encrypting, generate a new symmetric key -keychain Use Keychain to load/store symmetric keys and passwords -sign* select the 256-bit ECDSA signature mode available with symmetric key and ECDHE encryption modeshkdf_sha256_aesctr_hmac__symmetric__ecdsa_p256
Network Surface
Networking Frameworks
DNA Capability Vector
Location
0
Keychain
1
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
6
File Paths
19
Bundle IDs
25
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 154 functions identified
Functions(154)
0x100000770sub_100000770
0x100000a28sub_100000a28
0x100000aecsub_100000aec
0x100000b34sub_100000b34
0x100000bb4sub_100000bb4
0x100000c00sub_100000c00
0x100000cc4sub_100000cc4
0x100000d9csub_100000d9c
0x100000e6csub_100000e6c
0x100000ec4sub_100000ec4
0x100001194sub_100001194
0x100001714sub_100001714
0x1000018f8sub_1000018f8
0x100001c60sub_100001c60
0x100001cf4sub_100001cf4
0x100001d78sub_100001d78
0x100001e10sub_100001e10
0x100001e58sub_100001e58
0x100001ea0sub_100001ea0
0x100001ed0sub_100001ed0
Imports213 symbols from 4 dylibs
Exports1
_mh_execute_header0x0