Overview

While many MalChela tools are file-type agnostic — Hash It, Threat Intel Query, File Miner, and others work the same regardless of what platform a sample targets — the tools on this page have been specifically implemented for the analysis of macOS malware: Mach-O binaries, .app bundles, code signing, property lists, and Apple's DMG/PKG installer formats.

Mac Analysis Tools

Dedicated tools for static analysis of macOS binaries, bundles, and property lists.

Program	Function
Analyze	One-click auto-triage for a file, folder, or .app bundle — dispatches every relevant tool, including the Mac Analysis stack, and produces a combined rollup report
Code Sign Check	Inspects macOS code signing: Developer-signed vs. ad-hoc vs. unsigned, Team ID, Bundle ID, entitlements, and get-task-allow flag
dpp Extract	Unwraps a .dmg or .pkg (UDIF → HFS+/APFS → XAR → PBZX/CPIO) to reach the real payload files inside
Mach-O Info	Parses Mach-O binaries: architecture, linked libraries, section entropy, symbol status, RPATH entries, and deprecated crypto library detection
mStrings	Extracts strings, IOCs, and MITRE ATT&CK matches from Mach-O binaries and .app bundles
Plist Analyzer	Parses .plist files and .app bundle Info.plist for malware indicators: hidden background agent, ATS disabled, custom URL schemes, env injection

Code Sign Check, Mach-O Info, mStrings, and Plist Analyzer auto-resolve a .app bundle's main executable — point them at the bundle directly. Run those four together against a bundle or binary with ./mac_stack.sh.