Reversing Approaches to Extract Embedded Scripts in macOS Malware
Patrick Wardle presents specialized reverse engineering techniques and tooling to automatically extract obfuscated AppleScript and shell payloads from macOS malware.
Summary
Script-Based Malware in the macOS Threat Landscape
macOS malware authors increasingly utilize compiled AppleScript, JXA (JavaScript for Automation), and nested shell scripts to evade static antivirus signatures and execute living-off-the-land attacks.
Deconstructing Compiled AppleScript Binaries
Patrick Wardle analyzes the proprietary binary formats of compiled AppleScript (OSAX and .scpt components), explaining how malware authors obfuscate script bytecode and control-flow graphs.
Automating Dynamic and Static Script Extraction
Using custom reverse engineering tools and runtime hooking, analysts can intercept Apple Event dispatch routines, decompile bytecode, and recover original human-readable scripts in seconds.
Enhancing macOS Threat Triage
Automating script payload extraction significantly accelerates malware analysis workflows and enables defenders to generate rapid detection signatures for emerging macOS threats.
Related talks
Main Stage·39 min
Agostino Panico
Presents a dynamic analysis framework for automatically unpacking and deobfuscating nested virtual-machine-based software protectors used in advanced malware.
Main Track 1·20 min
Patrick Wardle
Deconstructs the FruitFly macOS spyware variant by standing up a custom command-and-control server to stimulate and inspect binary capabilities.
Main Stage·47 min
Patrick Wardle
Patrick Wardle dissects macOS Ventura's Background Task Management architecture, releasing open-source tooling while demonstrating trivial evasion techniques.