File scan report
Verdict Safe
Is ai. storyteller. artcraft- launcher safe? Yes, no threats found.
No engines detected a threat, the macOS disk image has a verified signature, and its completed observation from the test run produced no hostile findings.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Use the file only if it came from the expected official source, and keep macOS protections enabled. Recheck it later if its origin is uncertain or its behavior changes.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 60 flagged
- Flagged 0
- No detection 60
- No result 15
- Code signing Signer not verified
- Test run Completed
- First seen 14d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 60 antivirus engines that checked it flagged this macOS disk image, including the participating major antivirus engines. Its Learning Machines LLC signature verified successfully, while the completed sandbox run showed no offensive techniques, persistence, injection, malicious child, or disreputable contacted host.
The strongest evidence is the absence of detections across 75 engines, with all 17 major contributors that returned results also silent. The disk image carries a verified Learning Machines LLC signature, and no conflicting brand identity was identified. One completed sandbox run observed launcher and installation-related activity without offensive techniques, persistence, process injection, or a malicious sandbox assessment. Host-reputation coverage included every distinct observed domain and IP address, with no malicious or suspicious host matches; three IP addresses were sandbox background traffic rather than sample activity. The file is recent and lacks established signer history, but those limitations do not outweigh the consistent antivirus, signature, runtime, network-reputation, and external-intelligence evidence.
What We Detected
None of the 60 antivirus engines that checked it flagged the disk image, and no malware family was identified. The file is signed by Learning Machines LLC with a successfully verified signature, and no mismatch between its claimed identity and signer was detected.
Threat Behavior
One completed sandbox run launched the application and used ordinary macOS utilities associated with disk images, copying, signature checks, and system queries. It produced no offensive technique mappings, persistence indicators, process injection, or malicious sandbox assessment. Reputation checks covered all 31 distinct observed hosts and found no malicious or suspicious matches; three IP contacts were identified as analysis-environment background traffic. Ten extracted files lack individual saved verdicts, but none is known to be malicious.
What To Do Now
The evidence supports normal use when the disk image came from the expected publisher or official download channel. Because the sample and signer history are still recent, verify the download source and keep macOS security protections enabled.
Where this verdict could be wrong3 caveats
- The file was first submitted on Oct 12, 2026, so long-term reputation is not yet established.
- The Learning Machines LLC signer has no saved historical sample statistics, limiting publisher-history corroboration.
- The sample checked for virtualized environments and CPU identity, although the completed run mapped these only to techniques common in legitimate software and observed no offensive behavior.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 60 antivirus engines that checked it flagged the file.
- All 17 participating major antivirus engines reported no detection.
- The Learning Machines LLC code signature verified successfully.
- The completed sandbox run found no offensive behavior, persistence, or process injection.
- Every observed host was reputation-checked, with no malicious or suspicious matches.
- The file was first observed on Oct 12, 2026, leaving limited time for reputation to develop.
- No historical sample record is available for the signer.
- The application checked CPU and virtual-environment characteristics, although no offensive behavior accompanied those checks.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 3sandbox rule tags
- 15spawned processes
- 30network contacts
- 30filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
3MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1071· Application protocol
- T1497.001· Sandbox evasion
- T1573
Observed activity
Processes started
15Programs the file ran, with their command lines.
zsh/bin/zshArtCraft/Users/admin/Applications/ArtCraft Launcher.app/Contents/MacOS/ArtCraft Launcherscutil/usr/sbin/scutilhdiutil/usr/bin/hdiutildiskimages-helper/System/Library/PrivateFrameworks/DiskImages.framework/Versions/A/Resources/diskimages-helperditto/usr/bin/ditto
Show all 15 entries for processes started
codesign/usr/bin/codesignps/bin/psosascript/usr/bin/osascriptsystem_profiler/usr/sbin/system_profilerlaunchctl/bin/launchctlkillall/usr/bin/killallonline-auth-agent/usr/libexec/online-auth-agentfskitd/usr/libexec/fskitdfskit_agent/usr/libexec/fskit_agent
Network contacts
3030 hosts, listed as 13 domains, 17 addresses. Links show the host and path only.
- Domain
calendars.icloud.com - Domain
gateway.icloud.com - Domain
setup.icloud.com - Domain
h3.apis.apple.map.fastly.net - Domain
e4805.dsca.akamaiedge.net - Domain
a1051.dscg4.akamai.net
Show all 30 entries for network contacts
- Domain
a1366.dscapi6.akamai.net - Domain
s.mzstatic.com - Domain
api.storyteller.ai - Domain
github.com - Domain
release-assets.githubusercontent.com - Domain
e5977.dsce9.akamaiedge.net - Domain
cp10.cloudflare.com - IP address
23.212.97.135 - IP address
23.63.156.63 - IP address
23.47.204.53 - IP address
184.51.42.106 - IP address
151.101.3.6 - IP address
23.222.244.213 - IP address
23.61.255.144 - IP address
23.61.255.142 - IP address
151.101.195.6 - IP address
151.101.131.6 - IP address
23.61.208.191 - IP address
184.29.30.30 - IP address
23.11.33.159 - IP address
23.220.75.234 - IP address
192.178.164.94 - IP address
104.18.38.233 - IP address
104.26.4.102
Files
30Files the file created, changed or deleted.
- Written
/Users/user1/Library/Caches/com.apple.iCloudNotificationAgent/fsCachedData/7973900F-BC18-44CA-AD8B-075B63C49CDE.tmp - Written
/System/Library/Frameworks/ExternalAccessory.framework/Versions/Current - Written
/Users/user1/Library/Application Support/CrashReporter/.dat.nosync0192.HH2PhX - Written
/Users/user1/Library/Application Support/CrashReporter/.dat.nosync0192.9RamgC - Written
/var/db/timed/.dat.nosync006a.Ap6xO2 - Written
/private/var/db/systemstats/.dat.nosync01eb.vuHmzZ
Show all 30 entries for files
- Written
/private/var/db/systemstats/.dat.nosync01eb.djmARh - Written
/Users/user1/Library/Application Support/com.apple.spotlight/.dat.nosync01d2.xdnnX9 - Written
/Users/user1/Library/Caches/com.apple.AppleMediaServices/fsCachedData/462443BB-DB4B-44FE-BDDF-1C0F74DBC84F.tmp - Written
/Users/user1/Library/Caches/com.apple.AppleMediaServices/Engagement/journeys/output/7DB85845-4DE4-4325-A84C-747BE2F3F7B6.bundle/index.js - Written
/Users/user1/Library/Caches/com.apple.AppleMediaServices/Engagement/journeys/output/7DB85845-4DE4-4325-A84C-747BE2F3F7B6.bundle/app.js - Written
/Users/user1/Library/Caches/com.apple.AppleMediaServices/fsCachedData/0415E7CD-2592-4B4F-881B-930FC5D9ADD2.tmp - Written
/Applications/.DesignCraft.app.partial/Contents/.BC.T_0mGDuK - Written
/Applications/.DesignCraft.app.partial/Contents/.BC.T_VmYqgQ - Written
/Applications/.DesignCraft.app.partial/Contents/.BC.T_tK6WkP - Deleted
/Applications/.artcraft-launcher-write-test - Deleted
/Users/admin/Library/Caches/ArtCraft Launcher/downloads/designcraft-0.6.0-macos-universal.dmg - Deleted
/Users/admin/Library/Caches/ArtCraft Launcher/downloads/effectcraft-0.8.0-macos-universal.dmg - Deleted
/Users/admin/Library/Caches/ArtCraft Launcher/downloads/filmcraft-0.6.0-macos-universal.dmg - Deleted
/Users/admin/Library/Caches/ArtCraft Launcher/downloads/lightcraft-0.6.0-macos-universal.dmg - Deleted
/Users/admin/Library/Caches/ArtCraft Launcher/downloads/pdfcraft-0.6.0-macos-universal.dmg - Deleted
/Users/admin/Library/Caches/ArtCraft Launcher/downloads/photocraft-0.7.0-macos-universal.dmg - Deleted
/Users/admin/Library/Caches/ArtCraft Launcher/downloads/vectorcraft-0.9.0-macos-universal.dmg - Deleted
/Users/admin/Library/Caches/ArtCraft Launcher/mount-designcraft-963-1791768787807679000 - Deleted
/Users/admin/Library/Caches/ArtCraft Launcher/mount-effectcraft-963-1791768774142951000 - Deleted
/Users/admin/Library/Caches/ArtCraft Launcher/mount-filmcraft-963-1791768740694265000 - Deleted
/Users/admin/Library/Caches/ArtCraft Launcher/mount-lightcraft-963-1791768732730306000 - Deleted
/Users/admin/Library/Caches/ArtCraft Launcher/mount-pdfcraft-963-1791768758662615000 - Deleted
/Users/admin/Library/Caches/ArtCraft Launcher/mount-photocraft-963-1791768698675417000 - Deleted
/Users/admin/Library/Caches/ArtCraft Launcher/mount-vectorcraft-963-1791768716430372000
Sandbox background — not the file
4The analysis machine's own processes and connections, recorded in every run.
- VM host
eip-terr-na.cdp1.digicert.com.akahost.net - VM host
8.8.8.8 - VM host
255.255.255.255 - VM host
192.168.2.1
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- f75b1c7f5268853d064d…ff3aedNot checkedno saved verdict
- ec7b9444a9c5b3fe77b2…391e79Not checkedno saved verdict
- 14d02f4336c0717cc339…ca6438Not checkedno saved verdict
- 7e5ca9d8cb4b2d0772bc…447dcbNot checkedno saved verdict
- 8d12b62ab79ee80b9285…bd06e3Not checkedno saved verdict
- 29cd29fd97fbc447e7f8…9a426dNot checkedno saved verdict
- 147fdc91f29cb9463b3d…c348f5Not checkedno saved verdict
- cd04389f15518c6208ef…1c8a4aNot checkedno saved verdict
- bf4fb9a7950939619d4d…498e6aNot checkedno saved verdict
- ac37cdff79f4bf75107c…b386e9Not checkedno saved verdict
Chapter 04
Technical details
None of the 60 antivirus engines that checked it flag it; a signature that did not verify.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 14, 2026, 2:21 AM UTC
- SHA-256
7c3325209c6dfa062a8467d0f65dafcb0e6a493c2198545490c47b743be09158- SHA-1
eda06d6dce9d37f7b592c2a2b37a7dfead9f8027- MD5
7cd7e8b9ffb77349397e8de97fc073bf
About this file
ai.storyteller.artcraft-launcher is a Macintosh Disk Image file of 18.0 MB.
- Type and size
- Macintosh Disk Image · 18.0 MB
- Signer
- Learning Machines LLC (unverified signature)Worth noting: Malware sometimes copies or steals a company's signature, so this does not mean that company made it.
- First seen
- Oct 12, 2026On VirusTotal.
- Submitted by
- 56 distinct sources
First scanned
Antivirus consensus
0 of 60 engines flagged this file
15 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-231 engines0flagged
- Low-trust11 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is ai.storyteller.artcraft-launcher safe?
What is ai.storyteller.artcraft-launcher?
How many antivirus engines detected ai.storyteller.artcraft-launcher?
Is ai.storyteller.artcraft-launcher digitally signed?
What is the SHA-256 hash of ai.storyteller.artcraft-launcher?
Is it safe to open ai.storyteller.artcraft-launcher?
How up to date is this analysis of ai.storyteller.artcraft-launcher?
Community
Member reviews and reports for this exact file hash.