{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9400730133056641,
        "class": 0
      }
    ],
    "prob": 0.940073,
    "class": 0,
    "version": "v16.16",
    "thresholds": [
      0.9815004,
      0.99404883
    ],
    "analyzed_at": "2026-04-30T09:01:05Z"
  },
  "path": "deltochar.so",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "Md₂(Si)",
        "x": 4,
        "id": 0,
        "is": [
          "addzlefunction",
          "backkill",
          "bindk",
          "decpos",
          "deletezlefunction",
          "featuresarray",
          "forekill",
          "getfullchar",
          "handlefeatures",
          "incpos",
          "setfeatureenables",
          "zlecs",
          "zleline",
          "zlell",
          "zmod",
          "zwarnnam",
          "bindk",
          "zlecs",
          "zleline",
          "zlell",
          "zmod",
          "dyld_stub_binder",
          "addzlefunction",
          "backkill",
          "decpos",
          "deletezlefunction",
          "featuresarray",
          "forekill",
          "getfullchar",
          "handlefeatures",
          "incpos",
          "setfeatureenables",
          "zwarnnam"
        ],
        "ms": {
          "macho": {
            "flags": 4.0,
            "cpu_type": 16777228.0,
            "file_type": 8.0,
            "sdk_major": 26.0,
            "sdk_minor": 4.0,
            "class_bits": 64.0,
            "cpu_subtype": 2147483650.0,
            "slice_count": 2.0,
            "is_universal": true,
            "min_os_major": 26.0,
            "min_os_minor": 4.0,
            "uuid_present": true,
            "little_endian": true,
            "build_platform": 1.0,
            "signature_type": "platform",
            "source_version": 129742372077568.0,
            "build_tool_count": 1.0,
            "has_code_signature": true,
            "load_command_count": 18.0,
            "load_commands_size": 1328.0,
            "code_signature_size": 18576.0,
            "build_version_present": true,
            "source_version_present": true
          },
          "binary": {
            "code_size": 796.0,
            "file_size": 52528.0,
            "code_entropy": 5.83,
            "data_entropy": 1.9,
            "export_count": 6.0,
            "import_count": 16.0,
            "string_count": 89.0,
            "has_signature": true,
            "section_count": 7.0,
            "segment_count": 4.0,
            "avg_complexity": 2.16,
            "function_count": 19.0,
            "import_density": 20.58,
            "string_density": 114.49,
            "overall_entropy": 3.11,
            "avg_section_size": 196.43,
            "entropy_variance": 1.47,
            "function_density": 24.44,
            "avg_function_size": 59.58,
            "avg_string_length": 18.97,
            "max_string_length": 180.0,
            "avg_string_entropy": 3.15,
            "code_to_data_ratio": 1.37,
            "text_to_file_ratio": 0.02,
            "provenance_id_length": 16.0,
            "string_length_stddev": 23.86,
            "largest_section_ratio": 0.02,
            "provenance_id_present": true,
            "sentence_string_count": 10.0,
            "sentence_string_ratio": 0.11,
            "nonstandard_section_name_count": 7.0
          }
        },
        "ss": [
          [
            16424,
            "__TEXT"
          ],
          [
            16488,
            "__text"
          ],
          [
            16568,
            "__stubs"
          ],
          [
            16648,
            "__stub_helper"
          ],
          [
            16728,
            "__cstring"
          ],
          [
            16808,
            "__unwind_info"
          ],
          [
            16896,
            "__DATA_CONST"
          ],
          [
            16960,
            "__got"
          ],
          [
            17048,
            "__DATA"
          ],
          [
            17112,
            "__la_symbol_ptr"
          ],
          [
            17192,
            "__data"
          ],
          [
            17272,
            "__bss"
          ],
          [
            17360,
            "__LINKEDIT"
          ],
          [
            17672,
            "/usr/lib/libpcre.0.dylib"
          ],
          [
            17728,
            "/usr/lib/libiconv.2.dylib"
          ],
          [
            17784,
            "/usr/lib/libSystem.B.dylib"
          ],
          [
            17840,
            "/usr/lib/libncurses.5.4.dylib"
          ],
          [
            18153,
            "AWAVAUATSH"
          ],
          [
            18890,
            "delete-to-char"
          ],
          [
            18905,
            "zap-to-char"
          ],
          [
            18917,
            "deltochar: name clash when adding ZLE functions"
          ],
          [
            28730,
            "@dyld_stub_binder"
          ],
          [
            28770,
            "\u003e@_addzlefunction"
          ],
          [
            28792,
            "\u003e@_backkill"
          ],
          [
            28822,
            "\u003e@_deletezlefunction"
          ],
          [
            28845,
            "r \u003e@_featuresarray"
          ],
          [
            28866,
            "r(\u003e@_forekill"
          ],
          [
            28882,
            "r0\u003e@_getfullchar"
          ],
          [
            28901,
            "r8\u003e@_handlefeatures"
          ],
          [
            28923,
            "r@\u003e@_incpos"
          ],
          [
            28937,
            "rH\u003e@_setfeatureenables"
          ],
          [
            28962,
            "rP\u003e@_zwarnnam"
          ],
          [
            29020,
            "eatures_"
          ],
          [
            29030,
            "inish_"
          ],
          [
            29051,
            "cleanup_"
          ],
          [
            29062,
            "enables_"
          ],
          [
            29604,
            "_boot_"
          ],
          [
            29611,
            "_cleanup_"
          ],
          [
            29621,
            "_enables_"
          ],
          [
            29631,
            "_features_"
          ],
          [
            29642,
            "_finish_"
          ],
          [
            29651,
            "_setup_"
          ],
          [
            29659,
            "_addzlefunction"
          ],
          [
            29675,
            "_backkill"
          ],
          [
            29685,
            "_bindk"
          ],
          [
            29692,
            "_decpos"
          ],
          [
            29700,
            "_deletezlefunction"
          ],
          [
            29719,
            "_featuresarray"
          ],
          [
            29734,
            "_forekill"
          ],
          [
            29744,
            "_getfullchar"
          ],
          [
            29757,
            "_handlefeatures"
          ],
          [
            29773,
            "_incpos"
          ],
          [
            29781,
            "_setfeatureenables"
          ],
          [
            29800,
            "_zlecs"
          ],
          [
            29807,
            "_zleline"
          ],
          [
            29816,
            "_zlell"
          ],
          [
            29829,
            "_zwarnnam"
          ],
          [
            29839,
            "dyld_stub_binder"
          ],
          [
            29856,
            "radr://5614542"
          ],
          [
            29996,
            "com.apple.deltochar"
          ],
          [
            30397,
            "Apple Inc.1\u00260$"
          ],
          [
            30418,
            "Apple Certification Authority1"
          ],
          [
            30458,
            "Apple Root CA0"
          ],
          [
            30550,
            "Apple Certification Authority1301"
          ],
          [
            30589,
            "*Apple Code Signing Certification Authority0"
          ],
          [
            31068,
            "%http://www.apple.com/appleca/root.crl0"
          ],
          [
            31607,
            "Apple Inc.1"
          ],
          [
            31628,
            "Apple Software1"
          ],
          [
            31653,
            "Software Signing0"
          ],
          [
            32063,
            "kThis certificate is to be used exclusively for functions internal to Apple Products and/or Apple processes.0"
          ],
          [
            32213,
            "$http://crl.apple.com/codesigning.crl0"
          ],
          [
            33301,
            "https://www.apple.com/appleca/0"
          ],
          [
            33350,
            "Reliance on this certificate by any party assumes acceptance of the then applicable standard terms and conditions of use, certif"
          ],
          [
            33905,
            "*Apple Code Signing Certification Authority"
          ],
          [
            34167,
            "\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e"
          ],
          [
            34206,
            "\u003c!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\"\u003e"
          ],
          [
            34309,
            "\u003cplist version=\"1.0\"\u003e"
          ],
          [
            34331,
            "\u003cdict\u003e"
          ],
          [
            34338,
            "\u003ckey\u003ecdhashes\u003c/key\u003e"
          ],
          [
            34359,
            "\u003carray\u003e"
          ],
          [
            34368,
            "\u003cdata\u003e"
          ],
          [
            34377,
            "FcUFBqNogv4QfCmrBg0tW+BSi/Q="
          ],
          [
            34408,
            "\u003c/data\u003e"
          ],
          [
            34418,
            "\u003c/array\u003e"
          ],
          [
            34428,
            "\u003c/dict\u003e"
          ],
          [
            34436,
            "\u003c/plist\u003e"
          ],
          [
            49336,
            "__auth_stubs"
          ],
          [
            49648,
            "__auth_got"
          ],
          [
            87769,
            "6l2Q4qLd6ntcyVb08HWz6/J4Wyo="
          ]
        ],
        "sz": 52528,
        "ts": [
          {
            "c": 1.0,
            "d": "Mach-O UUID present",
            "e": [
              "a05c774b2bd8300d8e8a8f90a4cc04a0"
            ],
            "i": "metadata/build/reproducible::macho-uuid",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Mach-O linked dylib",
            "e": [
              "/usr/lib/libpcre.0.dylib",
              "/usr/lib/libiconv.2.dylib",
              "/usr/lib/libSystem.B.dylib",
              "/usr/lib/libncurses.5.4.dylib"
            ],
            "i": "metadata/binary/linking::macho-dylib",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "macOS Platform Binary",
            "e": [
              "platform::Apple Root CA"
            ],
            "i": "metadata/signed/platform::apple",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Identifier",
            "e": [
              "e.deltochar"
            ],
            "i": "metadata/signed/id::e.deltochar",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 3+ functions",
            "e": [
              "binary.function_count = 19.00"
            ],
            "i": "metadata/binary/metrics::few-functions-3",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Universal Mach-O with two slices",
            "e": [
              "macho.slice_count = 2.00"
            ],
            "i": "metadata/binary/framework::dual-arch-macho",
            "l": 2
          },
          {
            "d": "certificate string reference",
            "e": [
              "certificate",
              "certificate"
            ],
            "i": "micro-behaviors/crypto/certificate/operations::certificate-ref",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "Mach-O uses .so extension",
            "e": [
              "deltochar.so"
            ],
            "i": "metadata/file/extension::macho-so-extension",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 3.11"
            ],
            "i": "metadata/binary/metrics::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "binary.file_size = 52528.00"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 2.16"
            ],
            "i": "metadata/binary/metrics::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 3.15"
            ],
            "i": "metadata/binary/metrics::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ARM64 Mach-O binary",
            "e": [
              "macho.cpu_type = 16777228.00"
            ],
            "i": "metadata/arch::arm64-macho",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Mach-O linked dylib metadata",
            "e": [
              "/usr/lib/libpcre.0.dylib",
              "/usr/lib/libiconv.2.dylib",
              "/usr/lib/libSystem.B.dylib",
              "/usr/lib/libncurses.5.4.dylib"
            ],
            "i": "metadata/binary/linking/runtime::dylib",
            "l": 2
          },
          {
            "c": 0.75,
            "d": "Low average code complexity",
            "e": [
              "binary.avg_complexity = 2.16"
            ],
            "i": "metadata/binary/metrics::low-average-complexity",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Apple platform binary",
            "e": [
              "platform::Apple Root CA"
            ],
            "i": "metadata/signed/trust-level::platform",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "links self (bindk, zlecs, zleline, zlell, zmod, ... +12 more)",
            "e": [
              "self"
            ],
            "i": "metadata/dylib::self",
            "l": 2
          }
        ],
        "sha": "303ea7cabe89d6370ac36bdf1cebe7dcdf6afe0c0376bccbb7b9a98dfbc37d3d",
        "path": "deltochar.so",
        "type": "macho"
      }
    ],
    "tv": "f6eaa"
  }
}