sandbox-exec

JSON
executablemacOS100.2 KBx86_64, arm64

System utility — communicates with Apple services for data collection or configuration

A signed Apple binary that establishes network connections to Apple endpoints, likely for telemetry, diagnostics, or service configuration. Contains embedded bundle identifiers and URLs suggesting integration with system frameworks or Apple services. The minimal function count and small binary size indicate a focused, lightweight utility rather than a complex subsystem. Runs with Apple's code signature and communicates across multiple network endpoints.AI

Fingerprint

Platform
macOS
Type
executable
Arch
x86_64, arm64
Min OS
26.1.0
SDK
26.1.0
File Size
100.2 KB
UUID
FE9E973E-45EC-31D3-B0B1-B8B3D8282E99
Analyzed
2026-04-07T05:21:13Z
CDHash
8f70256cb1c6a7194fb4fd99bf6231c73b6b08101e8571bff7435e353fec7245

Interesting Strings

Network Surface

DNA Capability Vector

Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0

Behavioral Profile

URL Endpoints
4
Telemetry Strings
0
File Paths
0
Bundle IDs
1
IOKit Constants
0
Library Functions
0

Structural HashesSHA-256

Static Libraries0 / 5 functions identified

Functions(5)

0x1000004d8sub_1000004d8
0x100000894sub_100000894
0x1000008c8sub_1000008c8
0x1000009a8sub_1000009a8
0x1000009c4sub_1000009c4

Imports34 symbols from 2 dylibs

Exports1

_mh_execute_header0x0