{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9333486557006836,
        "class": 0
      }
    ],
    "prob": 0.93334866,
    "class": 0,
    "version": "v16.16",
    "thresholds": [
      0.9815004,
      0.99404883
    ],
    "analyzed_at": "2026-04-30T08:27:19Z"
  },
  "path": "pam_rootok.so.2",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "Md₂(Si)",
        "x": 4,
        "id": 0,
        "is": [
          "openpam_log",
          "getuid"
        ],
        "ms": {
          "macho": {
            "flags": 34603141.0,
            "cpu_type": 16777228.0,
            "file_type": 6.0,
            "sdk_major": 26.0,
            "sdk_minor": 4.0,
            "class_bits": 64.0,
            "cpu_subtype": 2147483650.0,
            "slice_count": 2.0,
            "is_universal": true,
            "min_os_major": 26.0,
            "min_os_minor": 4.0,
            "uuid_present": true,
            "little_endian": true,
            "build_platform": 1.0,
            "signature_type": "platform",
            "source_version": 238701402652672.0,
            "build_tool_count": 1.0,
            "has_code_signature": true,
            "load_command_count": 16.0,
            "load_commands_size": 1032.0,
            "code_signature_size": 18576.0,
            "install_name_present": true,
            "build_version_present": true,
            "source_version_present": true
          },
          "binary": {
            "code_size": 112.0,
            "file_size": 51696.0,
            "code_entropy": 4.99,
            "data_entropy": 1.37,
            "export_count": 2.0,
            "import_count": 2.0,
            "string_count": 52.0,
            "has_signature": true,
            "section_count": 5.0,
            "segment_count": 3.0,
            "avg_complexity": 1.0,
            "function_count": 4.0,
            "import_density": 18.29,
            "string_density": 475.43,
            "overall_entropy": 3.08,
            "avg_section_size": 62.2,
            "entropy_variance": 1.42,
            "function_density": 36.57,
            "avg_function_size": 22.75,
            "avg_string_length": 23.54,
            "max_string_length": 180.0,
            "avg_string_entropy": 3.26,
            "code_to_data_ratio": 0.56,
            "text_to_file_ratio": 0.0,
            "provenance_id_length": 16.0,
            "string_length_stddev": 29.7,
            "largest_section_ratio": 0.0,
            "provenance_id_present": true,
            "sentence_string_count": 9.0,
            "sentence_string_ratio": 0.17,
            "nonstandard_section_name_count": 5.0
          }
        },
        "ss": [
          [
            16424,
            "__TEXT"
          ],
          [
            16488,
            "__text"
          ],
          [
            16568,
            "__stubs"
          ],
          [
            16648,
            "__cstring"
          ],
          [
            16728,
            "__unwind_info"
          ],
          [
            16816,
            "__DATA_CONST"
          ],
          [
            16880,
            "__got"
          ],
          [
            16968,
            "__LINKEDIT"
          ],
          [
            17056,
            "/usr/lib/pam/pam_rootok.so.2"
          ],
          [
            17320,
            "/usr/lib/libpam.2.dylib"
          ],
          [
            17368,
            "/usr/lib/libSystem.B.dylib"
          ],
          [
            17596,
            "pam_sm_authenticate"
          ],
          [
            17616,
            "authentication %s"
          ],
          [
            17634,
            "succeeded"
          ],
          [
            17644,
            "failed"
          ],
          [
            24657,
            "__openpam_log"
          ],
          [
            24671,
            "_getuid"
          ],
          [
            24708,
            "authenticate"
          ],
          [
            24722,
            "setcred"
          ],
          [
            24844,
            "_pam_sm_authenticate"
          ],
          [
            24865,
            "_pam_sm_setcred"
          ],
          [
            24903,
            "radr://5614542"
          ],
          [
            25052,
            "pam_rootok.so.2"
          ],
          [
            25413,
            "Apple Inc.1\u00260$"
          ],
          [
            25434,
            "Apple Certification Authority1"
          ],
          [
            25474,
            "Apple Root CA0"
          ],
          [
            25566,
            "Apple Certification Authority1301"
          ],
          [
            25605,
            "*Apple Code Signing Certification Authority0"
          ],
          [
            26084,
            "%http://www.apple.com/appleca/root.crl0"
          ],
          [
            26623,
            "Apple Inc.1"
          ],
          [
            26644,
            "Apple Software1"
          ],
          [
            26669,
            "Software Signing0"
          ],
          [
            27079,
            "kThis certificate is to be used exclusively for functions internal to Apple Products and/or Apple processes.0"
          ],
          [
            27229,
            "$http://crl.apple.com/codesigning.crl0"
          ],
          [
            28317,
            "https://www.apple.com/appleca/0"
          ],
          [
            28366,
            "Reliance on this certificate by any party assumes acceptance of the then applicable standard terms and conditions of use, certif"
          ],
          [
            28921,
            "*Apple Code Signing Certification Authority"
          ],
          [
            29183,
            "\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e"
          ],
          [
            29222,
            "\u003c!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\"\u003e"
          ],
          [
            29325,
            "\u003cplist version=\"1.0\"\u003e"
          ],
          [
            29347,
            "\u003cdict\u003e"
          ],
          [
            29354,
            "\u003ckey\u003ecdhashes\u003c/key\u003e"
          ],
          [
            29375,
            "\u003carray\u003e"
          ],
          [
            29384,
            "\u003cdata\u003e"
          ],
          [
            29393,
            "LJWCeWdZLTu0L0BZ8q9F5E+Uz54="
          ],
          [
            29424,
            "\u003c/data\u003e"
          ],
          [
            29434,
            "\u003c/array\u003e"
          ],
          [
            29444,
            "\u003c/dict\u003e"
          ],
          [
            29452,
            "\u003c/plist\u003e"
          ],
          [
            49336,
            "__auth_stubs"
          ],
          [
            49648,
            "__auth_got"
          ],
          [
            86929,
            "Dbv3ywLC8h67G79b08GGtU4HZ8w="
          ]
        ],
        "sz": 51696,
        "ts": [
          {
            "c": 1.0,
            "d": "Mach-O UUID present",
            "e": [
              "030c489110713d728378b8047b74eca6"
            ],
            "i": "metadata/build/reproducible::macho-uuid",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Mach-O install name present",
            "e": [
              "/usr/lib/pam/pam_rootok.so.2"
            ],
            "i": "metadata/binary/linking::macho-install-name",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Mach-O linked dylib",
            "e": [
              "/usr/lib/libpam.2.dylib",
              "/usr/lib/libSystem.B.dylib"
            ],
            "i": "metadata/binary/linking::macho-dylib",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "macOS Platform Binary",
            "e": [
              "platform::Apple Root CA"
            ],
            "i": "metadata/signed/platform::apple",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Identifier",
            "e": [
              "ok.so.2"
            ],
            "i": "metadata/signed/id::ok.so.2",
            "l": 2
          },
          {
            "d": "certificate string reference",
            "e": [
              "certificate",
              "certificate"
            ],
            "i": "micro-behaviors/crypto/certificate/operations::certificate-ref",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ARM64 Mach-O binary",
            "e": [
              "macho.cpu_type = 16777228.00"
            ],
            "i": "metadata/arch::arm64-macho",
            "l": 2
          },
          {
            "d": "Get user ID",
            "e": [
              "getuid"
            ],
            "i": "micro-behaviors/os/privilege/query::getuid",
            "l": 2
          },
          {
            "c": 0.4000000059604645,
            "d": "Very few functions detected",
            "e": [
              "binary.function_count = 4.00"
            ],
            "i": "metadata/binary/metrics::few-functions",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 3+ functions",
            "e": [
              "binary.function_count = 4.00"
            ],
            "i": "metadata/binary/metrics::few-functions-3",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 3.08"
            ],
            "i": "metadata/binary/metrics::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "binary.file_size = 51696.00"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "pam_sm_authenticate module function",
            "e": [
              "pam_sm_authenticate"
            ],
            "i": "micro-behaviors/os/pam/auth::pam-sm-authenticate-symbol",
            "l": 2
          },
          {
            "d": ".so extension reference",
            "e": [
              ".so",
              ".so"
            ],
            "i": "micro-behaviors/fs/path/extension::so",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "pam_sm_setcred module function",
            "e": [
              "pam_sm_setcred"
            ],
            "i": "micro-behaviors/os/pam/auth::pam-sm-setcred-symbol",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 3.26"
            ],
            "i": "metadata/binary/metrics::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Universal Mach-O with two slices",
            "e": [
              "macho.slice_count = 2.00"
            ],
            "i": "metadata/binary/framework::dual-arch-macho",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "Mach-O uses .so extension",
            "e": [
              "pam_rootok.so.2"
            ],
            "i": "metadata/file/extension::macho-so-extension",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 1.00"
            ],
            "i": "metadata/binary/metrics::avg-complexity-15-max",
            "l": 2
          },
          {
            "d": "libpam library reference",
            "e": [
              "/usr/lib/libpam.2.dylib"
            ],
            "i": "micro-behaviors/os/pam/auth::libpam-string",
            "l": 2
          },
          {
            "c": 0.75,
            "d": "Low average code complexity",
            "e": [
              "binary.avg_complexity = 1.00"
            ],
            "i": "metadata/binary/metrics::low-average-complexity",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Mach-O linked dylib metadata",
            "e": [
              "/usr/lib/libpam.2.dylib",
              "/usr/lib/libSystem.B.dylib"
            ],
            "i": "metadata/binary/linking/runtime::dylib",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Apple platform binary",
            "e": [
              "platform::Apple Root CA"
            ],
            "i": "metadata/signed/trust-level::platform",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Mach-O install name metadata",
            "e": [
              "/usr/lib/pam/pam_rootok.so.2"
            ],
            "i": "metadata/binary/linking/runtime::install-name",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PAM module API functions",
            "e": [
              "pam_sm_authenticate",
              "pam_sm_setcred"
            ],
            "i": "micro-behaviors/os/pam/auth::pam-module-api",
            "l": 2
          }
        ],
        "sha": "94b8945d3a039d102bcaf074696174c5d8aa0a81ec2d57b2de8767b3fcbba134",
        "path": "/data/samples/good/macOS_Tahoe-26.3/usr/lib/pam/pam_rootok.so.2",
        "type": "macho"
      }
    ],
    "tv": "f6eaa"
  }
}