{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9257481098175049,
        "class": 0
      }
    ],
    "prob": 0.9257481,
    "class": 0,
    "version": "v16.16",
    "thresholds": [
      0.9815004,
      0.99404883
    ],
    "analyzed_at": "2026-04-30T07:42:14Z"
  },
  "path": "mod_allowmethods.so",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "Md₂(Si)",
        "x": 4,
        "id": 0,
        "is": [
          "ap_hook_access_checker",
          "ap_log_rerror_",
          "ap_method_number_of",
          "apr_palloc",
          "apr_pstrcat",
          "strcasecmp",
          "dyld_stub_binder",
          "ap_hook_access_checker",
          "ap_log_rerror_",
          "ap_method_number_of",
          "apr_palloc",
          "apr_pstrcat",
          "memset",
          "strcasecmp"
        ],
        "ms": {
          "macho": {
            "flags": 4.0,
            "cpu_type": 16777228.0,
            "file_type": 8.0,
            "sdk_major": 26.0,
            "sdk_minor": 4.0,
            "class_bits": 64.0,
            "cpu_subtype": 2147483650.0,
            "slice_count": 2.0,
            "is_universal": true,
            "min_os_major": 11.0,
            "uuid_present": true,
            "little_endian": true,
            "build_platform": 1.0,
            "signature_type": "platform",
            "source_version": 971968278953984.0,
            "build_tool_count": 1.0,
            "has_code_signature": true,
            "load_command_count": 18.0,
            "load_commands_size": 1376.0,
            "code_signature_size": 18720.0,
            "build_version_present": true,
            "source_version_present": true
          },
          "binary": {
            "code_size": 1120.0,
            "file_size": 68640.0,
            "code_entropy": 5.57,
            "data_entropy": 1.59,
            "export_count": 1.0,
            "import_count": 6.0,
            "string_count": 79.0,
            "has_signature": true,
            "section_count": 7.0,
            "segment_count": 4.0,
            "avg_complexity": 1.92,
            "function_count": 12.0,
            "import_density": 5.49,
            "string_density": 72.23,
            "overall_entropy": 2.95,
            "avg_section_size": 275.71,
            "entropy_variance": 1.73,
            "function_density": 10.97,
            "avg_function_size": 114.67,
            "avg_string_length": 24.94,
            "max_string_length": 182.0,
            "avg_string_entropy": 3.28,
            "code_to_data_ratio": 1.38,
            "data_to_file_ratio": 0.0,
            "text_to_file_ratio": 0.02,
            "provenance_id_length": 16.0,
            "string_length_stddev": 31.52,
            "largest_section_ratio": 0.02,
            "provenance_id_present": true,
            "sentence_string_count": 13.0,
            "sentence_string_ratio": 0.16,
            "nonstandard_section_name_count": 7.0
          }
        },
        "ss": [
          [
            16424,
            "__TEXT"
          ],
          [
            16488,
            "__text"
          ],
          [
            16568,
            "__stubs"
          ],
          [
            16648,
            "__stub_helper"
          ],
          [
            16728,
            "__cstring"
          ],
          [
            16808,
            "__unwind_info"
          ],
          [
            16896,
            "__DATA"
          ],
          [
            16960,
            "__got"
          ],
          [
            17040,
            "__la_symbol_ptr"
          ],
          [
            17120,
            "__const"
          ],
          [
            17200,
            "__data"
          ],
          [
            17288,
            "__LINKEDIT"
          ],
          [
            17600,
            "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"
          ],
          [
            17704,
            "/usr/lib/libcrypto.46.dylib"
          ],
          [
            17760,
            "/usr/lib/libssl.48.dylib"
          ],
          [
            17816,
            "/usr/lib/libSystem.B.dylib"
          ],
          [
            19030,
            "/AppleInternal/Library/BuildRoots/4~CI8cugCzo5-g8THsEtfDb569NpfrRSCNsL0UIVc/Library/Caches/com.apple.xbs/TemporaryDirectory.R1FS"
          ],
          [
            19213,
            "AllowMethods"
          ],
          [
            19226,
            "only allow specific methods"
          ],
          [
            19254,
            "AllowMethods: No method or 'reset' keyword given"
          ],
          [
            19303,
            "reset"
          ],
          [
            19309,
            "AllowMethods: Invalid Method '"
          ],
          [
            19342,
            "AH01623: client method denied by server configuration: '%s' to %s%s"
          ],
          [
            20664,
            "42PA"
          ],
          [
            24592,
            "\u003e@dyld_stub_binder"
          ],
          [
            24618,
            "\u003e@_ap_hook_access_checker"
          ],
          [
            24648,
            "\u003e@_ap_log_rerror_"
          ],
          [
            24670,
            "\u003e@_ap_method_number_of"
          ],
          [
            24695,
            "q \u003e@_apr_palloc"
          ],
          [
            24713,
            "q(\u003e@_apr_pstrcat"
          ],
          [
            24732,
            "q0\u003e@_memset"
          ],
          [
            24746,
            "q8\u003e@_strcasecmp"
          ],
          [
            24770,
            "_allowmethods_module"
          ],
          [
            25169,
            "_ap_hook_access_checker"
          ],
          [
            25193,
            "_ap_log_rerror_"
          ],
          [
            25209,
            "_ap_method_number_of"
          ],
          [
            25230,
            "_apr_palloc"
          ],
          [
            25242,
            "_apr_pstrcat"
          ],
          [
            25255,
            "_memset"
          ],
          [
            25263,
            "_strcasecmp"
          ],
          [
            25275,
            "dyld_stub_binder"
          ],
          [
            25292,
            "_am_create_conf"
          ],
          [
            25308,
            "_am_merge_conf"
          ],
          [
            25323,
            "_am_register_hooks"
          ],
          [
            25342,
            "_am_allowmethods"
          ],
          [
            25359,
            "_am_check_access"
          ],
          [
            25376,
            "_am_cmds"
          ],
          [
            25385,
            "__dyld_private"
          ],
          [
            25532,
            "com.apple.mod_allowmethods"
          ],
          [
            25916,
            "Apple Inc.1\u00260$"
          ],
          [
            25937,
            "Apple Certification Authority1"
          ],
          [
            25977,
            "Apple Root CA0"
          ],
          [
            26069,
            "Apple Certification Authority1301"
          ],
          [
            26108,
            "*Apple Code Signing Certification Authority0"
          ],
          [
            26587,
            "%http://www.apple.com/appleca/root.crl0"
          ],
          [
            27126,
            "Apple Inc.1"
          ],
          [
            27147,
            "Apple Software1"
          ],
          [
            27172,
            "Software Signing0"
          ],
          [
            27582,
            "kThis certificate is to be used exclusively for functions internal to Apple Products and/or Apple processes.0"
          ],
          [
            27732,
            "$http://crl.apple.com/codesigning.crl0"
          ],
          [
            28820,
            "https://www.apple.com/appleca/0"
          ],
          [
            28869,
            "Reliance on this certificate by any party assumes acceptance of the then applicable standard terms and conditions of use, certif"
          ],
          [
            29424,
            "*Apple Code Signing Certification Authority"
          ],
          [
            29686,
            "\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e"
          ],
          [
            29725,
            "\u003c!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\"\u003e"
          ],
          [
            29828,
            "\u003cplist version=\"1.0\"\u003e"
          ],
          [
            29850,
            "\u003cdict\u003e"
          ],
          [
            29857,
            "\u003ckey\u003ecdhashes\u003c/key\u003e"
          ],
          [
            29878,
            "\u003carray\u003e"
          ],
          [
            29887,
            "\u003cdata\u003e"
          ],
          [
            29896,
            "fsMPjtaJ0sUz+1zPQjLVgfAdFhM="
          ],
          [
            29927,
            "\u003c/data\u003e"
          ],
          [
            29937,
            "\u003c/array\u003e"
          ],
          [
            29947,
            "\u003c/dict\u003e"
          ],
          [
            29955,
            "\u003c/plist\u003e"
          ],
          [
            49336,
            "__auth_stubs"
          ],
          [
            49584,
            "__DATA_CONST"
          ],
          [
            49648,
            "__auth_got"
          ],
          [
            103880,
            "nSQM2TXdy33Jm4gySESCrMY13ZY="
          ]
        ],
        "sz": 68640,
        "ts": [
          {
            "c": 1.0,
            "d": "Mach-O UUID present",
            "e": [
              "65b6196fe230307b8f303516b2d53b1d"
            ],
            "i": "metadata/build/reproducible::macho-uuid",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Mach-O linked dylib",
            "e": [
              "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation",
              "/usr/lib/libcrypto.46.dylib",
              "/usr/lib/libssl.48.dylib",
              "/usr/lib/libSystem.B.dylib"
            ],
            "i": "metadata/binary/linking::macho-dylib",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "macOS Platform Binary",
            "e": [
              "platform::Apple Root CA"
            ],
            "i": "metadata/signed/platform::apple",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Identifier",
            "e": [
              "e.mod_allowmethods"
            ],
            "i": "metadata/signed/id::e.mod_allowmethods",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "binary.file_size = 68640.00"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 2.95"
            ],
            "i": "metadata/binary/metrics::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 3.28"
            ],
            "i": "metadata/binary/metrics::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "Mach-O uses .so extension",
            "e": [
              "mod_allowmethods.so"
            ],
            "i": "metadata/file/extension::macho-so-extension",
            "l": 3
          },
          {
            "d": "certificate string reference",
            "e": [
              "certificate",
              "certificate"
            ],
            "i": "micro-behaviors/crypto/certificate/operations::certificate-ref",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 1.92"
            ],
            "i": "metadata/binary/metrics::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 0.30000001192092896,
            "d": "libcrypto library reference",
            "e": [
              "/usr/lib/libcrypto.46.dylib"
            ],
            "i": "micro-behaviors/dylib/library/ssl::libcrypto-ref",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ARM64 Mach-O binary",
            "e": [
              "macho.cpu_type = 16777228.00"
            ],
            "i": "metadata/arch::arm64-macho",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 3+ functions",
            "e": [
              "binary.function_count = 12.00"
            ],
            "i": "metadata/binary/metrics::few-functions-3",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "/Library/Caches directory reference",
            "e": [
              "…sEtfDb569NpfrRSCNsL0UIVc/Library/Caches/com.apple.xbs/TemporaryD…"
            ],
            "i": "micro-behaviors/fs/path/library::library-caches-path",
            "l": 2
          },
          {
            "c": 0.30000001192092896,
            "d": "libssl library reference",
            "e": [
              "/usr/lib/libssl.48.dylib"
            ],
            "i": "micro-behaviors/dylib/library/ssl::libssl-ref",
            "l": 2
          },
          {
            "c": 0.20000000298023224,
            "d": "crypto keyword (substr, catches imports)",
            "e": [
              "/usr/lib/libcrypto.46.dylib"
            ],
            "i": "micro-behaviors/data/text/keywords::crypto-substr",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Universal Mach-O with two slices",
            "e": [
              "macho.slice_count = 2.00"
            ],
            "i": "metadata/binary/framework::dual-arch-macho",
            "l": 2
          },
          {
            "c": 0.75,
            "d": "Low average code complexity",
            "e": [
              "binary.avg_complexity = 1.92"
            ],
            "i": "metadata/binary/metrics::low-average-complexity",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Apple platform binary",
            "e": [
              "platform::Apple Root CA"
            ],
            "i": "metadata/signed/trust-level::platform",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Mach-O linked dylib metadata",
            "e": [
              "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation",
              "/usr/lib/libcrypto.46.dylib",
              "/usr/lib/libssl.48.dylib",
              "/usr/lib/libSystem.B.dylib"
            ],
            "i": "metadata/binary/linking/runtime::dylib",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "links self (dyld_stub_binder, ap_hook_access_checker, ap_log_rerror_, ap_method_number_of, apr_palloc, ... +3 more)",
            "e": [
              "self"
            ],
            "i": "metadata/dylib::self",
            "l": 2
          }
        ],
        "sha": "69d71a1dd4a0c61a5411e545db87be2089d77317a824892aeed9e88b6d4128c3",
        "path": "mod_allowmethods.so",
        "type": "macho"
      }
    ],
    "tv": "f6eaa"
  }
}