When we're investigating a large quantity of potentially malicious samples every day, it can be helpful to automatically triage them to know what to put in front of an analyst. Sometimes we can check external sources like Virus Total, but other times we have sensitive samples we can't submit or hashes are not found. Machine learning is one way to bucket Mach-O files as malicious or benign, or packed or not. \n\n In this talk, we'll walk through the steps to collect data and build a malware classification model for Mach-O using static analysis techniques.