ttyd
executablemacOS627.6 KBarm64
Anonymous executable — telemetry and network communication utility
This ad-hoc signed executable handles telemetry collection and network communication through 7 identified network endpoints. It processes file paths and sends telemetry data through 5 telemetry-related strings, with 4 URLs/endpoints embedded in its code. The binary contains 1033 functions and uses 8 public frameworks. The lack of a standard developer signature and high function count suggest this is either a development build or a custom tool designed for data collection and remote communication.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- arm64
- Min OS
- 26.0.0
- SDK
- 26.1.0
- File Size
- 627.6 KB
- UUID
- 44105E58-EFD0-3A70-8385-40B792CFC5DC
- Analyzed
- 2026-04-09T09:20:22Z
- CDHash
- 83eef19f15768a9675e9a1ece8f16210d991472f1ed6fe0e2a2e40b9e42a47d3
Frameworks8
Interesting Strings
File Paths(1)
telemetry(5)
Network Surface
Endpoints(7)
Hostname1.7.7-unknown
Hostname4.5.2-unknown
Hostnamegithub.com
Hostnamelibwebsockets-4.5.2
Hostnameconnectivitycheck.android.com
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
5
File Paths
1
Bundle IDs
0
IOKit Constants
0
Library Functions
455
Structural HashesSHA-256
Static Libraries455 / 1033 functions identified
Identified Libraries
FLAC 1.5.0 (33 fn)FLAC++ 1.5.0 (1 fn)SDL2 2.32.10 (20 fn)SDL2_test 2.32.10 (4 fn)X11 1.8.12 (19 fn)Xdmcp 1.1.5 (5 fn)Xext 1.3.6 (2 fn)Xi 1.8.2 (4 fn)aom 3.13.1 (12 fn)ass 0.17.4 (1 fn)avcodec 8.0.1 (1 fn)boost_filesystem 1.89.0 (2 fn)boost_graph 1.89.0 (2 fn)boost_iostreams 1.89.0 (1 fn)boost_json 1.89.0 (5 fn)boost_locale 1.89.0 (5 fn)boost_log 1.89.0 (2 fn)boost_log_setup 1.89.0 (1 fn)boost_math_tr1 1.89.0 (1 fn)boost_program_options 1.89.0 (1 fn)boost_python313 1.89.0 (1 fn)boost_test_exec_monitor 1.89.0 (6 fn)boost_url 1.89.0 (1 fn)boost_wave 1.89.0 (3 fn)cares 1.34.5 (1 fn)crypto 3.6.1 (11 fn)event 2.1.12_1 (1 fn)fontconfig 2.17.1 (1 fn)gio-2.0 2.86.3 (3 fn)glib-2.0 2.86.3 (1 fn)gtest 1.17.0 (1 fn)harfbuzz 12.3.0 (1 fn)harfbuzz-subset 12.3.0 (4 fn)hogweed 3.10.2 (1 fn)jq 1.7.1 (1 fn)leptonica 1.87.0 (1 fn)rav1e 0.8.1 (3 fn)upb 34.0 (1 fn)websockets 4.5.2 (290 fn)zmq 4.3.5_2 (1 fn)
Function Matches(1)
SSL_newopenssl 3.6High
Functions(1033)
0x100002868xmalloc
0x100002888xrealloc
0x1000028b4uppercase
0x1000028f0lowercase
0x10000292cendswith
0x100002988get_sig_name
0x100002a10get_sig
0x100002a8copen_uri
0x100002afcpty_buf_init
0x100002b50pty_buf_free
0x100002b84process_init
0x100002c00process_running
0x100002c38process_free
0x100002cd0close_cb
0x100002cd4pty_pause
0x100002cecpty_resume
0x100002d20alloc_cb
0x100002d4cread_cb
0x100002de0pty_write
0x100002e50write_cb
Imports328 symbols from 6 dylibs
Exports30
_mh_execute_header0x0
callback_http0x4060
callback_tty0x3250
context0x86ed0
endpoints0x86b88
endswith0x292c
force_exit0x86ec8
get_sig0x2a10
get_sig_name0x2988
index_html0x58000
index_html_len0x86b7c
index_html_size0x86b80
lowercase0x28f0
main0x4934
open_uri0x2a8c
process_free0x2c38
process_init0x2b84
process_running0x2c00
pty_buf_free0x2b50
pty_buf_init0x2afc
pty_kill0x2ed8
pty_pause0x2cd4
pty_resize0x2e78
pty_resume0x2cec
pty_spawn0x2f00
pty_write0x2de0
server0x86ed8
uppercase0x28b4
xmalloc0x2868
xrealloc0x2888