File scan report
Verdict Low Risk
Is PSFLab
This macOS installer archive has no antivirus detections, but its signature claiming The MathWorks, Inc. failed verification and it has been submitted only once.
Read the whole reasonShow less
Why not Safe? Its signature could not be verified and only one source had seen it when we scanned it.
Limited evidence · Nothing points to a problem, but little confirms who made it.
Do not run this copy. Download the installer directly from the publisher's official site and confirm macOS shows a valid signature before opening it.
Good practice2 tips
Low Risk: no threat found, but we could not fully confirm this file.
Get it from the publisher's own website or app store, not from a re-upload or a link someone sent you.
Keep your security software on, and stop if the file does anything you didn't expect.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 66 flagged
- Flagged 0
- No detection 66
- No result 9
- Code signing Signer not verified
- Test run Completed
- First seen 4mo ago
Chapter 02
Why we think so
3 points against it and 2 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 66 antivirus engines that checked it flagged this macOS app archive, and the sandbox summary showed no high-risk behaviour. However, its code signature claims The MathWorks, Inc. but is invalid, and only one source has ever submitted it. There is not enough evidence to confirm it is genuine.
None of the 66 antivirus engines that checked it flagged the archive, including every responding major antivirus engine. The bundled app carries a signature that names The MathWorks, Inc., but the signature failed verification. That means the publisher claim cannot be trusted and could have been copied or broken by modification. The file was first seen on Jun 1, 2026 and has been submitted by a single source, so it has no reputation history. The sandbox summary showed only the archive being opened and listed, plus connections to addresses consistent with normal macOS system traffic, though no complete host-reputation result is available. With no hostile evidence but no trustworthy origin either, the file cannot be confirmed safe or harmful.
What We Detected
None of the 66 antivirus engines that checked it flagged this ZIP archive containing a macOS application. The app inside carries a code signature that claims The MathWorks, Inc., but that signature is invalid and failed verification. The file was first seen on Jun 1, 2026 and has been submitted only once.
Threat Behavior
The combined sandbox summary recorded no high-risk techniques, no process injection and no persistence. Observed activity was limited to opening and listing the archive and system service activity. The network connections went mostly to address ranges consistent with standard macOS services, but no complete host-reputation check is available for them.
What To Do Now
Download this installer only from the publisher's official website. Before running it, check that macOS reports a valid developer signature. An invalid signature on an app claiming a major publisher is a reason to obtain a fresh copy from the official source instead.
Where this verdict could be wrong1 caveat
- No engine flagged the file and the sandbox summary recorded no high-risk techniques, so a broken or re-packaged signature on a legitimate installer is a plausible benign explanation.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 66 antivirus engines that checked it flagged the file.
- The sandbox summary recorded no high-risk techniques, injection or persistence.
- The code signature claims The MathWorks, Inc. but failed verification.
- The file has been submitted by only one source and has no reputation history.
- No complete reputation check of the contacted network addresses is available.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 5sandbox rule tags
- 7spawned processes
- 9network contacts
- 2filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
5MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1036
- T1071· Application protocol
- T1518.001· Checks your AV
- T1564.001· Hides artifacts
- T1573
Observed activity
Processes started
7Programs the file ran, with their command lines.
exo-open/usr/bin/exo-open exo-open /tmp/PSFLabInstaller-macOS.app.zipexo-open/usr/bin/exo-open -engrampa/usr/bin/engrampa engrampa /tmp/PSFLabInstaller-macOS.app.zip7z/usr/lib/p7zip/7z l -slt -bd -y -- /tmp/PSFLabInstaller-macOS.app.ziponline-auth-agent/usr/libexec/online-auth-agentxpcproxy/usr/libexec/xpcproxy -
Show all 7 entries for processes started
launchd/sbin/launchd -
Network contacts
99 hosts, listed as 9 addresses. Links show the host and path only.
- IP address
17.57.144.102 - IP address
17.253.23.208 - IP address
17.253.23.203 - IP address
151.101.3.6 - IP address
23.195.81.57 - IP address
17.253.23.207
Show all 9 entries for network contacts
- IP address
3.139.131.151 - IP address
3.233.140.124 - IP address
17.253.23.202
Files
2Files the file created, changed or deleted.
- Written
/root/.cache/dconf/user - Written
/private/var/db/MobileIdentityService/Configuration/UserTrust.db-shm
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
dbus-launch/usr/bin/dbus-launch dbus-launch --autolaunch=a39eb3ed78b7401fb6809ed0c562a5b1 --binary-syntax --close-stderr
Chapter 04
Technical details
None of the 66 antivirus engines that checked it flag it; a signature that did not verify.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 17, 2026, 1:32 PM UTC
- SHA-256
7d3ba9448b65272f505ba4a0d77ba5c83731d4d345af73c57035472b74c7cc9a- SHA-1
6a2044bfef4192101affa0ecaa3fe0f5abe01d33- MD5
325d3ca8291b7d75302a3a64f3a5af70
About this file
PSFLabInstaller-macOS.app.zip is a ZIP file of 2.5 MB.
- Type and size
- ZIP · 2.5 MB
- Signer
- The MathWorks, Inc. (unverified signature)Worth noting: Malware sometimes copies or steals a company's signature, so this does not mean that company made it.
- First seen
- Jun 1, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned Updated
Verdict history
- Safe
- Low Riskafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
0 of 66 engines flagged this file
9 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-236 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is PSFLabInstaller-macOS.app.zip safe?
What is PSFLabInstaller-macOS.app.zip?
How many antivirus engines detected PSFLabInstaller-macOS.app.zip?
Is PSFLabInstaller-macOS.app.zip digitally signed?
What is the SHA-256 hash of PSFLabInstaller-macOS.app.zip?
How up to date is this analysis of PSFLabInstaller-macOS.app.zip?
Community
Member reviews and reports for this exact file hash.