Untitled file without extention on my desktop

I just noticed an Untitled file with a size of 250MB on my desktop. I don't understand much about what's going on, but I tried to see what it is about.


It has a bunch of gibberish (ChatGPT said it might be a .zip, .docx, or .xls file based on an approximation by ASCII on the first bytes of the file:


PK..........!..oAPW...........Untitled-1/Untitled.UT...z.Ygz.Yg


At the end of the file, there's an exact copy of com.apple.xpc.launchd.rootless.plist located at /System/Library/Sandbox/com.apple.xpc.launchd.rootless.plist


I'm not sure if it was just something that corrupted or if there's more to this; I've run it through VirusTotal too. I'm not sure if I should include the file itself, so I'll send a screenshot of the first lines, and if I should, I'll provide it.


Thanks for your time




[Edited by Moderator]

iPhone 11, iOS 18

Posted on Aug 15, 2025 8:37 AM

Reply
Question marked as Top-ranking reply

Posted on Aug 16, 2025 9:37 AM

If you have not deleted the Untitled file, you may still be able to identify what it is by the first four bytes of the file.


I have written an AppleScript that obtains the first four hexadecimal bytes of a selected file and displays that in a dialog. Although you can search in the list of file signatures for that four-byte sequence, and identify the extension, not every file is represented on that web page.


Copy and paste the following AppleScript into the Script Editor. To open the Script Edtor, just tape the Spotlight symbol on the Finder menu bar 🔍 and enter script and a return. Create a new script on your Desktop and with the pasted AppleScript, click the hammer icon and then the run button.


Code:

use scripting additions

-- https://en.wikipedia.org/wiki/List_of_file_signatures

set theUnk to POSIX path of (choose file with prompt "Select unknown file")
-- split the four contiguous hex codes into groups of two with spaces
set hexcode to (do shell script "xxd -l 4 -p " & theUnk & " | sed 's/../& /g' | tr 'a-z' 'A-Z'")
display dialog "File signature is:  " & hexcode with title "File Signature"
return



Some common signatures:

  • Any file that is a .zip container even if the extension is different (e.g. docx, pages, etc.)
    • 50 4b 03 04
  • Any .dmg container
    • 45 52 02 00
    • 42 5a 68 39
    • 78 da 63 60
    • Possibly others
  • Compiled Swift, C++, or dylib library executable
    • CF FA ED FE
  • PDF
    • 25 50 44 46
  • JPG, JPEG
    • FF D8 FF E0
  • PNG, animated PNG
    • 89 50 4E 47
  • TIFF, including multi-page TIFF
    • 4D 4D 00 2A
  • GIF, including animated GIF
    • 47 49 46 38
  • ICNS, Apple icon
    • 69 63 6E 73
  • SVG, vector
    • 3C 3F 78 6D
  • PS, Postscript
    • 25 21 50 53
  • PSD, Photoshop
    • 38 42 50 53
  • RAW Camera images
    • CR2, CR3 (same as TIFF), and iPhone DNG
      • 4D 4D 00 2A
    • ARW, Sony
      • 49 49 2A 00
    • RW2, Panasonic
      • 49 49 55 00
    • DNG, Leica
      • 49 49 2A 00


5 replies
Question marked as Top-ranking reply

Aug 16, 2025 9:37 AM in response to radiocabea

If you have not deleted the Untitled file, you may still be able to identify what it is by the first four bytes of the file.


I have written an AppleScript that obtains the first four hexadecimal bytes of a selected file and displays that in a dialog. Although you can search in the list of file signatures for that four-byte sequence, and identify the extension, not every file is represented on that web page.


Copy and paste the following AppleScript into the Script Editor. To open the Script Edtor, just tape the Spotlight symbol on the Finder menu bar 🔍 and enter script and a return. Create a new script on your Desktop and with the pasted AppleScript, click the hammer icon and then the run button.


Code:

use scripting additions

-- https://en.wikipedia.org/wiki/List_of_file_signatures

set theUnk to POSIX path of (choose file with prompt "Select unknown file")
-- split the four contiguous hex codes into groups of two with spaces
set hexcode to (do shell script "xxd -l 4 -p " & theUnk & " | sed 's/../& /g' | tr 'a-z' 'A-Z'")
display dialog "File signature is:  " & hexcode with title "File Signature"
return



Some common signatures:

  • Any file that is a .zip container even if the extension is different (e.g. docx, pages, etc.)
    • 50 4b 03 04
  • Any .dmg container
    • 45 52 02 00
    • 42 5a 68 39
    • 78 da 63 60
    • Possibly others
  • Compiled Swift, C++, or dylib library executable
    • CF FA ED FE
  • PDF
    • 25 50 44 46
  • JPG, JPEG
    • FF D8 FF E0
  • PNG, animated PNG
    • 89 50 4E 47
  • TIFF, including multi-page TIFF
    • 4D 4D 00 2A
  • GIF, including animated GIF
    • 47 49 46 38
  • ICNS, Apple icon
    • 69 63 6E 73
  • SVG, vector
    • 3C 3F 78 6D
  • PS, Postscript
    • 25 21 50 53
  • PSD, Photoshop
    • 38 42 50 53
  • RAW Camera images
    • CR2, CR3 (same as TIFF), and iPhone DNG
      • 4D 4D 00 2A
    • ARW, Sony
      • 49 49 2A 00
    • RW2, Panasonic
      • 49 49 55 00
    • DNG, Leica
      • 49 49 2A 00


Aug 16, 2025 3:15 AM in response to radiocabea

Delete the file, though " I've run it through VirusTotal too "


Total Virus Software  is not needed and actually may have compromised the Security of the Operating System


What is malware? - Apple Community


Windows-like viruses that self-replicate and affect macOS don’t exist because of the underlying UNIX Foundation and permission limitations.


The macOS operating system resides in a sealed and read-only volume that can’t be opened by users or third-party applications.


Mac app security enhancements are sufficient to protect computers from malware.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Untitled file without extention on my desktop

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.