{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8143885135650635, "class": 0, "threshold": 0.9989520311355591 } ], "prob": 0.8143885, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8143885, "class": 0 }, { "m": "az/native", "prob": 0.06514995, "class": 0 }, { "m": "az/macho", "prob": 0.0, "class": 0 } ], "version": "v17.17", "threshold": 0.99895203, "analyzed_at": "2026-05-30T11:24:35Z" }, "path": "date", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 4, "ff": { "m": { "file": { "size": 40992.0, "entropy": 2.1, "size_bytes": 135392.0 }, "macho": { "slice_count": 2.0, "pagezero_size": 4294967296.0, "has_main_command": 1.0, "wx_segment_count": 0.0, "data_in_code_count": 1.0, "has_chained_fixups": 1.0, "load_command_count": 18.0, "function_starts_count": 19.0, "has_data_const_segment": 1.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 5.92, "data_entropy": 2.13, "overlay_size": 118656.0, "string_count": 204.0, "overlay_ratio": 0.88, "overlay_entropy": 2.34, "entropy_variance": 1.9, "avg_string_length": 13.38, "max_string_length": 180.0, "code_to_data_ratio": 0.91, "string_length_stddev": 18.86, "largest_section_ratio": 0.04, "sentence_string_count": 20.0, "sentence_string_ratio": 0.1, "high_entropy_string_count": 0.0 }, "exports": { "count": 1.0 }, "sections": { "count": 9.0, "code_size": 7169.0, "entropy_max": 6.28, "entropy_mean": 3.29, "name_entropy": 3.93, "writable_count": 4.0, "executable_count": 5.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 16424, "u8", "__PAGEZERO" ], [ 16496, "u8", "__TEXT" ], [ 16560, "u8", "__text" ], [ 16640, "u8", "__stubs" ], [ 16720, "u8", "__const" ], [ 16800, "u8", "__cstring" ], [ 16880, "u8", "__unwind_info" ], [ 16968, "u8", "__DATA_CONST" ], [ 17032, "u8", "__got" ], [ 17200, "u8", "__DATA" ], [ 17264, "u8", "__data" ], [ 17344, "u8", "__bss" ], [ 17432, "u8", "__LINKEDIT" ], [ 17644, "u8", "/usr/lib/dyld" ], [ 17784, "u8", "/usr/lib/libSystem.B.dylib" ], [ 17916, "u8", "AVSH" ], [ 18758, "u8", "tpAk" ], [ 19096, "u8", "tUHcO" ], [ 19273, "u8", "tSHcC" ], [ 19630, "u8", "AWAVAUATSPE1" ], [ 20756, "u8", "AVSA" ], [ 23904, "u8", "@(#)PROGRAM:date PROJECT:shell_cmds-329" ], [ 24016, "u8", "malloc" ], [ 24023, "u8", "sunday" ], [ 24030, "u8", "monday" ], [ 24037, "u8", "tuesday" ], [ 24045, "u8", "wednesday" ], [ 24055, "u8", "thursday" ], [ 24064, "u8", "friday" ], [ 24071, "u8", "saturday" ], [ 24080, "u8", "january" ], [ 24088, "u8", "february" ], [ 24103, "u8", "april" ], [ 24113, "u8", "june" ], [ 24123, "u8", "august" ], [ 24130, "u8", "september" ], [ 24140, "u8", "october" ], [ 24148, "u8", "november" ], [ 24157, "u8", "december" ], [ 24166, "u8", "bin/date" ], [ 24175, "u8", "unix2003" ], [ 24204, "u8", "UTC0" ], [ 24209, "u8", "clock_gettime" ], [ 24226, "u8", "setenv(TZ)" ], [ 24237, "u8", "invalid time" ], [ 24250, "u8", "%s: Cannot apply date adjustment" ], [ 24286, "u8", "date" ], [ 24291, "u8", "%Y-%m-%d" ], [ 24300, "u8", "hours" ], [ 24310, "u8", "minutes" ], [ 24322, "u8", "seconds" ], [ 24341, "u8", "%a, %d %b %Y %T %z" ], [ 24360, "u8", "stdout" ], [ 24370, "u8", "Failed conversion of ``%s'' using format ``%s''" ], [ 24419, "u8", "Warning: Ignoring %ld extraneous characters in date string (%s)" ], [ 24484, "u8", "nonexistent time" ], [ 24501, "u8", "clock_settime" ], [ 24519, "u8", "date set by %s" ], [ 24534, "u8", "illegal time format" ], [ 24554, "u8", "strdup" ], [ 24561, "u8", "%.*s%.9ld%s" ], [ 24573, "u8", "asprintf" ], [ 24582, "u8", "invalid argument '%s' for -I" ], [ 24611, "u8", "multiple output formats specified" ], [ 24655, "u8", "usage: date [-jnRu] [-I[date|hours|minutes|seconds|ns]] [-f input_fmt]" ], [ 32768, "u8", "0123456789" ], [ 37117, "u8", "___stderrp" ], [ 37128, "u8", "___stdoutp" ], [ 37139, "u8", "___strlcat_chk" ], [ 37154, "u8", "_asprintf" ], [ 37170, "u8", "_clock_gettime" ], [ 37185, "u8", "_clock_settime" ], [ 37200, "u8", "_compat_mode" ], [ 37230, "u8", "_fflush" ], [ 37238, "u8", "_fprintf" ], [ 37253, "u8", "_getlogin" ], [ 37263, "u8", "_getopt" ], [ 37271, "u8", "_gettimeofday" ], [ 37285, "u8", "_localtime" ], [ 37296, "u8", "_malloc_type_malloc" ], [ 37316, "u8", "_mktime" ], [ 37324, "u8", "_optarg" ], [ 37332, "u8", "_optind" ], [ 37346, "u8", "_pututxline" ], [ 37358, "u8", "_setenv" ], [ 37366, "u8", "_setlocale" ], [ 37377, "u8", "_stat$INODE64" ], [ 37391, "u8", "_strcmp" ], [ 37399, "u8", "_strdup" ], [ 37407, "u8", "_strftime" ], [ 37417, "u8", "_strlen" ], [ 37425, "u8", "_strncasecmp" ], [ 37438, "u8", "_strptime" ], [ 37448, "u8", "_strspn" ], [ 37456, "u8", "_strtoq" ], [ 37464, "u8", "_syslog$DARWIN_EXTSN" ], [ 37485, "u8", "_warnx" ], [ 37498, "u8", "__mh_execute_header" ], [ 38871, "u8", "radr://5614542" ], [ 39020, "u8", "com.apple.date" ], [ 39476, "u8", "Apple Inc.1\u00260$" ], [ 39497, "u8", "Apple Certification Authority1" ], [ 39537, "u8", "Apple Root CA0" ], [ 39554, "u8", "111024173941Z" ], [ 39569, "u8", "261024173941Z0" ], [ 39629, "u8", "Apple Certification Authority1301" ], [ 39668, "u8", "*Apple Code Signing Certification Authority0" ], [ 40147, "u8", "%http://www.apple.com/appleca/root.crl0" ], [ 40632, "u8", "201029183238Z" ], [ 40647, "u8", "261024173941Z0V1" ], [ 40686, "u8", "Apple Inc.1" ], [ 40707, "u8", "Apple Software1" ], [ 40732, "u8", "Software Signing0" ], [ 41142, "u8", "kThis certificate is to be used exclusively for functions internal to Apple Products and/or Apple processes.0" ], [ 41292, "u8", "$http://crl.apple.com/codesigning.crl0" ], [ 41804, "u8", "060425214036Z" ], [ 41819, "u8", "350209214036Z0b1" ], [ 42380, "u8", "https://www.apple.com/appleca/0" ], [ 42429, "u8", "Reliance on this certificate by any party assumes acceptance of the then applicable standard terms and conditions of use, certif" ], [ 42984, "u8", "*Apple Code Signing Certification Authority" ], [ 43099, "u8", "260419002744Z0/" ], [ 43246, "u8", "\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e" ], [ 43285, "u8", "\u003c!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\"\u003e" ], [ 43388, "u8", "\u003cplist version=\"1.0\"\u003e" ], [ 43410, "u8", "\u003cdict\u003e" ], [ 43417, "u8", "\u003ckey\u003ecdhashes\u003c/key\u003e" ], [ 43438, "u8", "\u003carray\u003e" ], [ 43447, "u8", "\u003cdata\u003e" ], [ 43456, "u8", "FDO5Pdz1Lu1dZCe3C+e20ThYJFM=" ], [ 43487, "u8", "\u003c/data\u003e" ], [ 43497, "u8", "\u003c/array\u003e" ], [ 43507, "u8", "\u003c/dict\u003e" ], [ 43515, "u8", "\u003c/plist\u003e" ], [ 65792, "u8", "__auth_stubs" ], [ 66184, "u8", "__auth_got" ], [ 121472, "u8", "sUz651AchABwMSlt0tPVfwhEvE8=" ] ], "v": { "file.stem": "date", "macho.uuid": "25021bfc-012a-3d7d-b7e5-b2f840b146ed", "macho.entry": 4294971760, "macho.endian": "little", "file.basename": "date", "macho.cpu_type": "x86_64", "macho.flags[0]": "no_undefs", "macho.flags[1]": "dyld_link", "macho.flags[2]": "two_level", "macho.flags[3]": "pie", "macho.dyld_path": "/usr/lib/dyld", "macho.file_type": "executable", "macho.flags_raw": 2097285, "macho.class_bits": 64, "macho.cpu_subtype": 3, "macho.cpu_type_raw": 16777223, "macho.libraries[0]": "/usr/lib/libSystem.B.dylib", "macho.file_type_raw": 2, "macho.hashes.symhash": "ed3e48ceb6258af1822f3c132d3eb299", "macho.slices[0].uuid": "25021bfc-012a-3d7d-b7e5-b2f840b146ed", "macho.slices[1].uuid": "a49a90ce-fb02-3432-b9bc-ffc7f6705b61", "macho.source_version": "329.0.0.0.0", "macho.slices[0].entry": 4294971760, "macho.slices[1].entry": 4294971984, "macho.load_commands[0]": "LC_SEGMENT_64", "macho.load_commands[1]": "LC_SEGMENT_64", "macho.load_commands[2]": "LC_SEGMENT_64", "macho.load_commands[3]": "LC_SEGMENT_64", "macho.load_commands[4]": "LC_SEGMENT_64", "macho.load_commands[5]": "LC_DYLD_CHAINED_FIXUPS", "macho.load_commands[6]": "LC_DYLD_EXPORTS_TRIE", "macho.load_commands[7]": "LC_SYMTAB", "macho.load_commands[8]": "LC_DYSYMTAB", "macho.load_commands[9]": "LC_LOAD_DYLINKER", "macho.segments[0].name": "__PAGEZERO", "macho.segments[1].name": "__TEXT", "macho.segments[2].name": "__DATA_CONST", "macho.segments[3].name": "__DATA", "macho.segments[4].name": "__LINKEDIT", "macho.slices[0].endian": "little", "macho.slices[1].endian": "little", "macho.build_version.sdk": "26.5.0", "macho.hashes.dylib_hash": "c92070ad210458d5b3e8f048b1578e6d", "macho.load_commands[10]": "LC_UUID", "macho.load_commands[11]": "LC_BUILD_VERSION", "macho.load_commands[12]": "LC_SOURCE_VERSION", "macho.load_commands[13]": "LC_MAIN", "macho.load_commands[14]": "LC_LOAD_DYLIB", "macho.load_commands[15]": "LC_FUNCTION_STARTS", "macho.load_commands[16]": "LC_DATA_IN_CODE", "macho.load_commands[17]": "LC_CODE_SIGNATURE", "macho.segments[0].perms": "---", "macho.segments[0].vsize": 4294967296, "macho.segments[1].perms": "r-x", "macho.segments[1].vaddr": 4294967296, "macho.segments[1].vsize": 12288, "macho.segments[2].perms": "rw-", "macho.segments[2].vaddr": 4294979584, "macho.segments[2].vsize": 4096, "macho.segments[3].perms": "rw-", "macho.segments[3].vaddr": 4294983680, "macho.segments[3].vsize": 4096, "macho.segments[4].perms": "r--", "macho.segments[4].vaddr": 4294987776, "macho.segments[4].vsize": 32768, "build.toolchain.compiler": "apple_clang", "macho.hashes.export_hash": "7f3b75c82e3151fff6c0a55b51cd5b94", "macho.load_commands_size": 1448, "macho.slices[0].cpu_type": "x86_64", "macho.slices[0].flags[0]": "no_undefs", "macho.slices[0].flags[1]": "dyld_link", "macho.slices[0].flags[2]": "two_level", "macho.slices[0].flags[3]": "pie", "macho.slices[1].cpu_type": "arm64e", "macho.slices[1].flags[0]": "no_undefs", "macho.slices[1].flags[1]": "dyld_link", "macho.slices[1].flags[2]": "two_level", "macho.slices[1].flags[3]": "pie", "macho.code_signature.hash": "sha256", "macho.code_signature_size": 18480, "macho.load_dylibs[0].kind": "load", "macho.load_dylibs[0].path": "/usr/lib/libSystem.B.dylib", "macho.slices[0].dyld_path": "/usr/lib/dyld", "macho.slices[0].file_size": 40992, "macho.slices[0].file_type": "executable", "macho.slices[0].flags_raw": 2097285, "macho.slices[1].dyld_path": "/usr/lib/dyld", "macho.slices[1].file_size": 69856, "macho.slices[1].file_type": "executable", "macho.slices[1].flags_raw": 2097285, "macho.build_version.min_os": "26.5.0", "macho.slices[0].class_bits": 64, "macho.slices[1].class_bits": 64, "macho.code_signature.cdhash": "1433b93ddcf52eed5d6427b70be7b6d138582453b918eadb98035e44dfef1f2c", "macho.function_starts_count": 19, "macho.segments[1].file_size": 12288, "macho.segments[2].file_size": 4096, "macho.segments[3].file_size": 4096, "macho.segments[4].file_size": 20512, "macho.slices[0].cpu_subtype": 3, "macho.slices[0].file_offset": 16384, "macho.slices[1].cpu_subtype": 2, "macho.slices[1].file_offset": 65536, "macho.build_version.platform": "macos", "macho.code_signature.version": 132096, "macho.slices[0].cpu_type_raw": 16777223, "macho.slices[0].export_count": 1, "macho.slices[0].libraries[0]": "/usr/lib/libSystem.B.dylib", "macho.slices[1].cpu_type_raw": 16777228, "macho.slices[1].export_count": 1, "macho.slices[1].libraries[0]": "/usr/lib/libSystem.B.dylib", "macho.code_signature.cms_size": 4442, "macho.code_signature.platform": 26, "macho.segments[1].maxprot_raw": 5, "macho.segments[2].file_offset": 12288, "macho.segments[2].maxprot_raw": 3, "macho.segments[3].file_offset": 16384, "macho.segments[3].maxprot_raw": 3, "macho.segments[4].file_offset": 20480, "macho.segments[4].maxprot_raw": 1, "macho.slices[0].file_type_raw": 2, "macho.slices[0].section_count": 9, "macho.slices[1].file_type_raw": 2, "macho.slices[1].section_count": 10, "macho.code_signature.hash_size": 32, "macho.code_signature.page_size": 4096, "macho.load_dylibs[0].path_kind": "absolute", "macho.load_dylibs[0].timestamp": 2, "macho.segments[1].initprot_raw": 5, "macho.segments[2].initprot_raw": 3, "macho.segments[3].initprot_raw": 3, "macho.segments[4].initprot_raw": 1, "macho.slices[0].hashes.symhash": "ed3e48ceb6258af1822f3c132d3eb299", "macho.slices[0].source_version": "329.0.0.0.0", "macho.slices[1].hashes.symhash": "e4320d9be21faabc8c575841ad8b3108", "macho.slices[1].source_version": "329.0.0.0.0", "macho.code_signature.code_limit": 22512, "macho.code_signature.code_slots": 6, "macho.code_signature.identifier": "com.apple.date", "macho.slices[0].load_commands[0]": "LC_SEGMENT_64", "macho.slices[0].load_commands[1]": "LC_SEGMENT_64", "macho.slices[0].load_commands[2]": "LC_SEGMENT_64", "macho.slices[0].load_commands[3]": "LC_SEGMENT_64", "macho.slices[0].load_commands[4]": "LC_SEGMENT_64", "macho.slices[0].load_commands[5]": "LC_DYLD_CHAINED_FIXUPS", "macho.slices[0].load_commands[6]": "LC_DYLD_EXPORTS_TRIE", "macho.slices[0].load_commands[7]": "LC_SYMTAB", "macho.slices[0].load_commands[8]": "LC_DYSYMTAB", "macho.slices[0].load_commands[9]": "LC_LOAD_DYLINKER", "macho.slices[0].segments[0].name": "__PAGEZERO", "macho.slices[0].segments[1].name": "__TEXT", "macho.slices[0].segments[2].name": "__DATA_CONST", "macho.slices[0].segments[3].name": "__DATA", "macho.slices[0].segments[4].name": "__LINKEDIT", "macho.slices[1].load_commands[0]": "LC_SEGMENT_64", "macho.slices[1].load_commands[1]": "LC_SEGMENT_64", "macho.slices[1].load_commands[2]": "LC_SEGMENT_64", "macho.slices[1].load_commands[3]": "LC_SEGMENT_64", "macho.slices[1].load_commands[4]": "LC_SEGMENT_64", "macho.slices[1].load_commands[5]": "LC_DYLD_CHAINED_FIXUPS", "macho.slices[1].load_commands[6]": "LC_DYLD_EXPORTS_TRIE", "macho.slices[1].load_commands[7]": "LC_SYMTAB", "macho.slices[1].load_commands[8]": "LC_DYSYMTAB", "macho.slices[1].load_commands[9]": "LC_LOAD_DYLINKER", "macho.slices[1].segments[0].name": "__PAGEZERO", "macho.slices[1].segments[1].name": "__TEXT", "macho.slices[1].segments[2].name": "__DATA_CONST", "macho.slices[1].segments[3].name": "__DATA", "macho.slices[1].segments[4].name": "__LINKEDIT", "macho.build_version.tools[0].tool": "ld", "macho.slices[0].build_version.sdk": "26.5.0", "macho.slices[0].hashes.dylib_hash": "c92070ad210458d5b3e8f048b1578e6d", "macho.slices[0].load_commands[10]": "LC_UUID", "macho.slices[0].load_commands[11]": "LC_BUILD_VERSION", "macho.slices[0].load_commands[12]": "LC_SOURCE_VERSION", "macho.slices[0].load_commands[13]": "LC_MAIN", "macho.slices[0].load_commands[14]": "LC_LOAD_DYLIB", "macho.slices[0].load_commands[15]": "LC_FUNCTION_STARTS", "macho.slices[0].load_commands[16]": "LC_DATA_IN_CODE", "macho.slices[0].load_commands[17]": "LC_CODE_SIGNATURE", "macho.slices[0].segments[0].perms": "---", "macho.slices[0].segments[0].vsize": 4294967296, "macho.slices[0].segments[1].perms": "r-x", "macho.slices[0].segments[1].vaddr": 4294967296, "macho.slices[0].segments[1].vsize": 12288, "macho.slices[0].segments[2].perms": "rw-", "macho.slices[0].segments[2].vaddr": 4294979584, "macho.slices[0].segments[2].vsize": 4096, "macho.slices[0].segments[3].perms": "rw-", "macho.slices[0].segments[3].vaddr": 4294983680, "macho.slices[0].segments[3].vsize": 4096, "macho.slices[0].segments[4].perms": "r--", "macho.slices[0].segments[4].vaddr": 4294987776, "macho.slices[0].segments[4].vsize": 32768, "macho.slices[1].build_version.sdk": "26.5.0", "macho.slices[1].hashes.dylib_hash": "c92070ad210458d5b3e8f048b1578e6d", "macho.slices[1].load_commands[10]": "LC_UUID", "macho.slices[1].load_commands[11]": "LC_BUILD_VERSION", "macho.slices[1].load_commands[12]": "LC_SOURCE_VERSION", "macho.slices[1].load_commands[13]": "LC_MAIN", "macho.slices[1].load_commands[14]": "LC_LOAD_DYLIB", "macho.slices[1].load_commands[15]": "LC_FUNCTION_STARTS", "macho.slices[1].load_commands[16]": "LC_DATA_IN_CODE", "macho.slices[1].load_commands[17]": "LC_CODE_SIGNATURE", "macho.slices[1].segments[0].perms": "---", "macho.slices[1].segments[0].vsize": 4294967296, "macho.slices[1].segments[1].perms": "r-x", "macho.slices[1].segments[1].vaddr": 4294967296, "macho.slices[1].segments[1].vsize": 16384, "macho.slices[1].segments[2].perms": "rw-", "macho.slices[1].segments[2].vaddr": 4294983680, "macho.slices[1].segments[2].vsize": 16384, "macho.slices[1].segments[3].perms": "rw-", "macho.slices[1].segments[3].vaddr": 4295000064, "macho.slices[1].segments[3].vsize": 16384, "macho.slices[1].segments[4].perms": "r--", "macho.slices[1].segments[4].vaddr": 4295016448, "macho.slices[1].segments[4].vsize": 32768, "macho.code_signature.special_slots": 2, "macho.slices[0].hashes.export_hash": "7f3b75c82e3151fff6c0a55b51cd5b94", "macho.slices[0].load_commands_size": 1448, "macho.slices[1].hashes.export_hash": "7f3b75c82e3151fff6c0a55b51cd5b94", "macho.slices[1].load_commands_size": 1528, "macho.slices[0].code_signature.hash": "sha256", "macho.slices[0].code_signature_size": 18480, "macho.slices[0].load_dylibs[0].kind": "load", "macho.slices[0].load_dylibs[0].path": "/usr/lib/libSystem.B.dylib", "macho.slices[1].code_signature.hash": "sha256", "macho.slices[1].code_signature_size": 18704, "macho.slices[1].load_dylibs[0].kind": "load", "macho.slices[1].load_dylibs[0].path": "/usr/lib/libSystem.B.dylib", "macho.build_version.tools[0].version": "1267.0.0", "macho.load_dylibs[0].current_version": "1356.0.0", "macho.slices[0].build_version.min_os": "26.5.0", "macho.slices[1].build_version.min_os": "26.5.0", "macho.data_in_code_kinds.jump_table32": 1, "macho.slices[0].code_signature.cdhash": "1433b93ddcf52eed5d6427b70be7b6d138582453b918eadb98035e44dfef1f2c", "macho.slices[0].function_starts_count": 19, "macho.slices[0].segments[1].file_size": 12288, "macho.slices[0].segments[2].file_size": 4096, "macho.slices[0].segments[3].file_size": 4096, "macho.slices[0].segments[4].file_size": 20512, "macho.slices[1].code_signature.cdhash": "b14cfae7501c84007031296dd2d3d57f0844bc4f928bad243617ecd5f61a4d2e", "macho.slices[1].function_starts_count": 19, "macho.slices[1].segments[1].file_size": 16384, "macho.slices[1].segments[2].file_size": 16384, "macho.slices[1].segments[3].file_size": 16384, "macho.slices[1].segments[4].file_size": 20704, "macho.code_signature.requirements_size": 56, "macho.slices[0].build_version.platform": "macos", "macho.slices[0].code_signature.version": 132096, "macho.slices[1].build_version.platform": "macos", "macho.slices[1].code_signature.version": 132096, "macho.code_signature.exec_segment_flags": 1, "macho.code_signature.exec_segment_limit": 12288, "macho.slices[0].code_signature.cms_size": 4442, "macho.slices[0].code_signature.platform": 26, "macho.slices[0].segments[1].maxprot_raw": 5, "macho.slices[0].segments[2].file_offset": 12288, "macho.slices[0].segments[2].maxprot_raw": 3, "macho.slices[0].segments[3].file_offset": 16384, "macho.slices[0].segments[3].maxprot_raw": 3, "macho.slices[0].segments[4].file_offset": 20480, "macho.slices[0].segments[4].maxprot_raw": 1, "macho.slices[1].code_signature.cms_size": 4442, "macho.slices[1].code_signature.platform": 26, "macho.slices[1].segments[1].maxprot_raw": 5, "macho.slices[1].segments[2].file_offset": 16384, "macho.slices[1].segments[2].maxprot_raw": 3, "macho.slices[1].segments[3].file_offset": 32768, "macho.slices[1].segments[3].maxprot_raw": 3, "macho.slices[1].segments[4].file_offset": 49152, "macho.slices[1].segments[4].maxprot_raw": 1, "macho.load_dylibs[0].current_version_raw": 88866816, "macho.slices[0].code_signature.hash_size": 32, "macho.slices[0].code_signature.page_size": 4096, "macho.slices[0].load_dylibs[0].path_kind": "absolute", "macho.slices[0].load_dylibs[0].timestamp": 2, "macho.slices[0].segments[1].initprot_raw": 5, "macho.slices[0].segments[2].initprot_raw": 3, "macho.slices[0].segments[3].initprot_raw": 3, "macho.slices[0].segments[4].initprot_raw": 1, "macho.slices[1].code_signature.hash_size": 32, "macho.slices[1].code_signature.page_size": 4096, "macho.slices[1].load_dylibs[0].path_kind": "absolute", "macho.slices[1].load_dylibs[0].timestamp": 2, "macho.slices[1].segments[1].initprot_raw": 5, "macho.slices[1].segments[2].initprot_raw": 3, "macho.slices[1].segments[3].initprot_raw": 3, "macho.slices[1].segments[4].initprot_raw": 1, "macho.slices[0].code_signature.code_limit": 22512, "macho.slices[0].code_signature.code_slots": 6, "macho.slices[0].code_signature.identifier": "com.apple.date", "macho.slices[1].code_signature.code_limit": 51152, "macho.slices[1].code_signature.code_slots": 13, "macho.slices[1].code_signature.identifier": "com.apple.date", "macho.load_dylibs[0].compatibility_version": "1.0.0", "macho.slices[0].build_version.tools[0].tool": "ld", "macho.slices[1].build_version.tools[0].tool": "ld", "macho.code_signature.requirements.designated": "(identifier \"com.apple.date\" and anchor apple)", "macho.slices[0].code_signature.special_slots": 2, "macho.slices[1].code_signature.special_slots": 2, "macho.load_dylibs[0].compatibility_version_raw": 65536, "macho.slices[0].build_version.tools[0].version": "1267.0.0", "macho.slices[0].load_dylibs[0].current_version": "1356.0.0", "macho.slices[1].build_version.tools[0].version": "1267.0.0", "macho.slices[1].load_dylibs[0].current_version": "1356.0.0", "macho.slices[0].data_in_code_kinds.jump_table32": 1, "macho.slices[0].code_signature.requirements_size": 56, "macho.slices[1].code_signature.requirements_size": 56, "macho.slices[0].code_signature.exec_segment_flags": 1, "macho.slices[0].code_signature.exec_segment_limit": 12288, "macho.slices[1].code_signature.exec_segment_flags": 1, "macho.slices[1].code_signature.exec_segment_limit": 16384, "macho.slices[0].load_dylibs[0].current_version_raw": 88866816, "macho.slices[1].load_dylibs[0].current_version_raw": 88866816, "macho.slices[0].load_dylibs[0].compatibility_version": "1.0.0", "macho.slices[1].load_dylibs[0].compatibility_version": "1.0.0", "macho.slices[0].code_signature.requirements.designated": "(identifier \"com.apple.date\" and anchor apple)", "macho.slices[1].code_signature.requirements.designated": "(identifier \"com.apple.date\" and anchor apple)", "macho.slices[0].load_dylibs[0].compatibility_version_raw": 65536, "macho.slices[1].load_dylibs[0].compatibility_version_raw": 65536 }, "x": [ [ "mh_execute_header" ] ], "id": "macho", "sc": [ [ "__TEXT,__text", 1528, 5782, 6.28, "r-x" ], [ "__TEXT,__stubs", 7310, 198, 3.09, "r-x" ], [ "__TEXT,__const", 7520, 112, 3.37, "r-x" ], [ "__TEXT,__cstring", 7632, 925, 5.07, "r-x" ], [ "__TEXT,__unwind_info", 8560, 152, 2.94, "r-x" ], [ "__DATA_CONST,__got", 12288, 296, 2.16, "rw-" ], [ "__DATA_CONST,__const", 12592, 80, 2.06, "rw-" ], [ "__DATA,__data", 16384, 352, 2.11, "rw-" ], [ "__DATA,__bss", 0, 16, 2.5, "rw-" ] ] }, "id": 0, "sz": 40992, "ts": [ { "c": 1.0, "d": "Mach-O linked dylib", "e": [ "/usr/lib/libSystem.B.dylib" ], "i": "metadata/binary/linking::macho-dylib", "l": 2 }, { "c": 1.0, "d": "macOS Platform Binary", "e": [ "platform::Apple Root CA" ], "i": "metadata/signed/platform::apple", "l": 3 }, { "c": 1.0, "d": "Identifier", "e": [ "com.apple.date" ], "i": "metadata/signed/id::com.apple.date", "l": 2 }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Meeting lure update action", "e": [ "version" ], "i": "objectives/evasion/masquerade/brand/meeting::meeting-sdk-action-token", "l": 1, "el": [ "0x5f32" ] }, { "c": 1.0, "d": "Universal (fat) Mach-O with multiple slices", "e": [ "macho.slice_count = 2.00" ], "i": "metadata/build/artifact::macho-universal-binary", "l": 2 }, { "d": "certificate string reference", "e": [ "certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2, "el": [ "0xa0b6" ] }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "multiple output formats specified" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1, "el": [ "0x6023" ] }, { "c": 1.0, "d": "Carries arm64e (Apple Silicon PAC) slice", "e": [ "arm64e" ], "i": "metadata/build/artifact::macho-arm64e", "l": 2, "el": [ "value:macho.slices[*].cpu_type" ] }, { "c": 0.8999999761581421, "d": "Mach-O __PAGEZERO size disagrees with arch default", "e": [ "macho.pagezero_size = 4294967296.00" ], "i": "metadata/binary/anomaly/format::macho-pagezero-size-anomalous", "l": 3 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "date" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Universal Mach-O with two slices", "e": [ "macho.slice_count = 2.00" ], "i": "metadata/build/framework::dual-arch-macho", "l": 2 }, { "c": 1.0, "d": "Mach-O UUID metadata", "e": [ "25021bfc-012a-3d7d-b7e5-b2f840b146ed" ], "i": "metadata/build/reproducible::macho-uuid", "l": 2, "el": [ "value:macho.uuid" ] }, { "c": 0.20000000298023224, "d": "localtime function (string)", "e": [ "_localtime" ], "i": "micro-behaviors/time/query::localtime-string", "l": 2, "el": [ "0x91a5" ] }, { "c": 1.0, "d": "Apple platform binary", "e": [ "com.apple.date" ], "i": "metadata/signed/trust-level::platform", "l": 2, "el": [ "value:macho.code_signature.identifier" ] }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.overlay_ratio = 0.88" ], "i": "objectives/anti-static/obfuscation/control-flow/logic::bloated-low-density-malware-cond-5--inline-32080", "l": 1 }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Overlay large enough to contain payload", "e": [ "binary.overlay_size = 118656.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::large-overlay-size", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Mach-O linked dylib metadata", "e": [ "/usr/lib/libSystem.B.dylib" ], "i": "metadata/binary/linking/runtime::dylib", "l": 2 }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 118656.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::medium-overlay-size", "l": 1, "m": "B0032" } ], "sha": "415457f612a7b519b5f1356785d12bfa3f30557ce221ac1f2ea30ce30d8964cd", "path": "/data/samples/unknown/uploads/41/54/date", "type": "macho" } ], "tv": "ca5ef" } }