{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.933853805065155, "class": 0 } ], "prob": 0.9338538, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-04-30T07:42:14Z" }, "path": "mod_file_cache.so", "raw": { "v": "4", "fs": [ { "f": "Md₂(Si)", "x": 4, "id": 0, "is": [ "stack_chk_fail", "stack_chk_guard", "ap_core_translate", "ap_discard_request_body", "ap_hook_handler", "ap_hook_post_config", "ap_hook_translate_name", "ap_log_error_", "ap_meets_conditions", "ap_pass_brigade", "ap_rationalize_mtime", "ap_server_root_relative", "ap_set_etag", "ap_strcmp_match", "ap_update_mtime", "apr_brigade_create", "apr_brigade_insert_file", "apr_bucket_eos_create", "apr_bucket_mmap_create", "apr_file_close", "apr_file_inherit_set", "apr_file_open", "apr_hash_count", "apr_hash_get", "apr_hash_make", "apr_hash_set", "apr_mmap_create", "apr_mmap_dup", "apr_palloc", "apr_rfc822_date", "apr_snprintf", "apr_stat", "apr_table_setn", "memcpy", "memset", "strlen", "stack_chk_guard", "dyld_stub_binder", "stack_chk_fail", "ap_core_translate", "ap_discard_request_body", "ap_hook_handler", "ap_hook_post_config", "ap_hook_translate_name", "ap_log_error_", "ap_meets_conditions", "ap_pass_brigade", "ap_rationalize_mtime", "ap_server_root_relative", "ap_set_etag", "ap_strcmp_match", "ap_update_mtime", "apr_brigade_create", "apr_brigade_insert_file", "apr_bucket_eos_create", "apr_bucket_mmap_create", "apr_file_close", "apr_file_inherit_set", "apr_file_open", "apr_hash_count", "apr_hash_get", "apr_hash_make", "apr_hash_set", "apr_mmap_create", "apr_mmap_dup", "apr_palloc", "apr_rfc822_date", "apr_snprintf", "apr_stat$INODE64", "apr_table_setn", "memcpy", "memset", "strlen" ], "ms": { "macho": { "flags": 4.0, "cpu_type": 16777228.0, "file_type": 8.0, "sdk_major": 26.0, "sdk_minor": 4.0, "class_bits": 64.0, "cpu_subtype": 2147483650.0, "slice_count": 2.0, "is_universal": true, "min_os_major": 11.0, "uuid_present": true, "little_endian": true, "build_platform": 1.0, "signature_type": "platform", "source_version": 971968278953984.0, "build_tool_count": 1.0, "has_code_signature": true, "load_command_count": 18.0, "load_commands_size": 1456.0, "code_signature_size": 18720.0, "build_version_present": true, "source_version_present": true }, "binary": { "code_size": 3272.0, "file_size": 70704.0, "code_entropy": 5.44, "data_entropy": 1.7, "export_count": 1.0, "import_count": 36.0, "string_count": 147.0, "has_signature": true, "section_count": 8.0, "segment_count": 4.0, "avg_complexity": 1.69, "function_count": 45.0, "import_density": 11.27, "string_density": 46.0, "overall_entropy": 2.92, "avg_section_size": 636.0, "entropy_variance": 1.56, "function_density": 14.08, "avg_function_size": 73.24, "avg_string_length": 22.71, "max_string_length": 182.0, "avg_string_entropy": 3.33, "code_to_data_ratio": 1.8, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.05, "provenance_id_length": 16.0, "string_length_stddev": 24.02, "largest_section_ratio": 0.05, "provenance_id_present": true, "sentence_string_count": 17.0, "sentence_string_ratio": 0.12, "nonstandard_section_name_count": 8.0 } }, "ss": [ [ 16424, "__TEXT" ], [ 16488, "__text" ], [ 16568, "__stubs" ], [ 16648, "__stub_helper" ], [ 16728, "__cstring" ], [ 16808, "__unwind_info" ], [ 16896, "__DATA" ], [ 16960, "__got" ], [ 17040, "__la_symbol_ptr" ], [ 17120, "__const" ], [ 17200, "__data" ], [ 17288, "__LINKEDIT" ], [ 17600, "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation" ], [ 17704, "/usr/lib/libcrypto.46.dylib" ], [ 17760, "/usr/lib/libssl.48.dylib" ], [ 17816, "/usr/lib/libSystem.B.dylib" ], [ 20242, "fffff." ], [ 21738, "/AppleInternal/Library/BuildRoots/4~CI8cugCzo5-g8THsEtfDb569NpfrRSCNsL0UIVc/Library/Caches/com.apple.xbs/TemporaryDirectory.R1FS" ], [ 21921, "cachefile" ], [ 21931, "A space separated list of files to add to the file handle cache at config time" ], [ 22010, "mmapfile" ], [ 22019, "A space separated list of files to mmap at config time" ], [ 22074, "AH00794: invalid file path %s, skipping" ], [ 22114, "AH00795: unable to stat(%s), skipping" ], [ 22152, "AH00796: %s isn't a regular file, skipping" ], [ 22195, "AH00797: %s is too large to cache, skipping" ], [ 22239, "AH00798: unable to open(%s, O_RDONLY), skipping" ], [ 22287, "AH00799: unable to mmap %s, skipping" ], [ 22333, "Last-Modified" ], [ 22347, "Content-Length" ], [ 25040, "42PA" ], [ 28696, "\u003e@___stack_chk_guard" ], [ 28721, "@dyld_stub_binder" ], [ 28746, "\u003e@___stack_chk_fail" ], [ 28770, "\u003e@_ap_core_translate" ], [ 28793, "q \u003e@_ap_discard_request_body" ], [ 28824, "q(\u003e@_ap_hook_handler" ], [ 28847, "q0\u003e@_ap_hook_post_config" ], [ 28874, "q8\u003e@_ap_hook_translate_name" ], [ 28904, "q@\u003e@_ap_log_error_" ], [ 28925, "qH\u003e@_ap_meets_conditions" ], [ 28952, "qP\u003e@_ap_pass_brigade" ], [ 28975, "qX\u003e@_ap_rationalize_mtime" ], [ 29003, "q`\u003e@_ap_server_root_relative" ], [ 29034, "qh\u003e@_ap_set_etag" ], [ 29053, "qp\u003e@_ap_strcmp_match" ], [ 29076, "qx\u003e@_ap_update_mtime" ], [ 29102, "\u003e@_apr_brigade_create" ], [ 29129, "\u003e@_apr_brigade_insert_file" ], [ 29161, "\u003e@_apr_bucket_eos_create" ], [ 29191, "\u003e@_apr_bucket_mmap_create" ], [ 29222, "\u003e@_apr_file_close" ], [ 29245, "\u003e@_apr_file_inherit_set" ], [ 29274, "\u003e@_apr_file_open" ], [ 29296, "\u003e@_apr_hash_count" ], [ 29319, "\u003e@_apr_hash_get" ], [ 29340, "\u003e@_apr_hash_make" ], [ 29362, "\u003e@_apr_hash_set" ], [ 29383, "\u003e@_apr_mmap_create" ], [ 29407, "\u003e@_apr_mmap_dup" ], [ 29428, "\u003e@_apr_palloc" ], [ 29447, "\u003e@_apr_rfc822_date" ], [ 29471, "\u003e@_apr_snprintf" ], [ 29492, "\u003e@_apr_stat$INODE64" ], [ 29517, "\u003e@_apr_table_setn" ], [ 29586, "_file_cache_module" ], [ 30743, "___stack_chk_fail" ], [ 30761, "___stack_chk_guard" ], [ 30780, "_ap_core_translate" ], [ 30799, "_ap_discard_request_body" ], [ 30824, "_ap_hook_handler" ], [ 30841, "_ap_hook_post_config" ], [ 30862, "_ap_hook_translate_name" ], [ 30886, "_ap_log_error_" ], [ 30901, "_ap_meets_conditions" ], [ 30922, "_ap_pass_brigade" ], [ 30939, "_ap_rationalize_mtime" ], [ 30961, "_ap_server_root_relative" ], [ 30986, "_ap_set_etag" ], [ 30999, "_ap_strcmp_match" ], [ 31016, "_ap_update_mtime" ], [ 31033, "_apr_brigade_create" ], [ 31053, "_apr_brigade_insert_file" ], [ 31078, "_apr_bucket_eos_create" ], [ 31101, "_apr_bucket_mmap_create" ], [ 31125, "_apr_file_close" ], [ 31141, "_apr_file_inherit_set" ], [ 31163, "_apr_file_open" ], [ 31178, "_apr_hash_count" ], [ 31194, "_apr_hash_get" ], [ 31208, "_apr_hash_make" ], [ 31223, "_apr_hash_set" ], [ 31237, "_apr_mmap_create" ], [ 31254, "_apr_mmap_dup" ], [ 31268, "_apr_palloc" ], [ 31280, "_apr_rfc822_date" ], [ 31297, "_apr_snprintf" ], [ 31311, "_apr_stat$INODE64" ], [ 31329, "_apr_table_setn" ], [ 31345, "_memcpy" ], [ 31353, "_memset" ], [ 31361, "_strlen" ], [ 31369, "dyld_stub_binder" ], [ 31386, "_create_server_config" ], [ 31408, "_register_hooks" ], [ 31424, "_cachefilehandle" ], [ 31441, "_cachefilemmap" ], [ 31456, "_cache_the_file" ], [ 31472, "_file_cache_handler" ], [ 31492, "_file_cache_post_config" ], [ 31516, "_file_cache_xlat" ], [ 31533, "_mmap_handler" ], [ 31547, "_sendfile_handler" ], [ 31565, "_file_cache_cmds" ], [ 31582, "__dyld_private" ], [ 31724, "com.apple.mod_file_cache" ], [ 32134, "Apple Inc.1\u00260$" ], [ 32155, "Apple Certification Authority1" ], [ 32195, "Apple Root CA0" ], [ 32287, "Apple Certification Authority1301" ], [ 32326, "*Apple Code Signing Certification Authority0" ], [ 32805, "%http://www.apple.com/appleca/root.crl0" ], [ 33344, "Apple Inc.1" ], [ 33365, "Apple Software1" ], [ 33390, "Software Signing0" ], [ 33800, "kThis certificate is to be used exclusively for functions internal to Apple Products and/or Apple processes.0" ], [ 33950, "$http://crl.apple.com/codesigning.crl0" ], [ 35038, "https://www.apple.com/appleca/0" ], [ 35087, "Reliance on this certificate by any party assumes acceptance of the then applicable standard terms and conditions of use, certif" ], [ 35642, "*Apple Code Signing Certification Authority" ], [ 35904, "\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e" ], [ 35943, "\u003c!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\"\u003e" ], [ 36046, "\u003cplist version=\"1.0\"\u003e" ], [ 36068, "\u003cdict\u003e" ], [ 36075, "\u003ckey\u003ecdhashes\u003c/key\u003e" ], [ 36096, "\u003carray\u003e" ], [ 36105, "\u003cdata\u003e" ], [ 36114, "7dgNcQWbigzC1TxbCAWHFqpZI0U=" ], [ 36145, "\u003c/data\u003e" ], [ 36155, "\u003c/array\u003e" ], [ 36165, "\u003c/dict\u003e" ], [ 36173, "\u003c/plist\u003e" ], [ 65720, "__auth_stubs" ], [ 65968, "__DATA_CONST" ], [ 66032, "__auth_got" ], [ 115510, "_apr_stat" ], [ 122322, "OrrPNq2euasVbhCyADfKKSNNyUM=" ] ], "sz": 70704, "ts": [ { "c": 1.0, "d": "Mach-O UUID present", "e": [ "876ab245a58e3e4bbcb88f5f553353cb" ], "i": "metadata/build/reproducible::macho-uuid", "l": 2 }, { "c": 1.0, "d": "Mach-O linked dylib", "e": [ "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation", "/usr/lib/libcrypto.46.dylib", "/usr/lib/libssl.48.dylib", "/usr/lib/libSystem.B.dylib" ], "i": "metadata/binary/linking::macho-dylib", "l": 2 }, { "c": 1.0, "d": "macOS Platform Binary", "e": [ "platform::Apple Root CA" ], "i": "metadata/signed/platform::apple", "l": 3 }, { "c": 1.0, "d": "Identifier", "e": [ "e.mod_file_cache" ], "i": "metadata/signed/id::e.mod_file_cache", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 1.69" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.33" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.30000001192092896, "d": "libcrypto library reference", "e": [ "/usr/lib/libcrypto.46.dylib" ], "i": "micro-behaviors/dylib/library/ssl::libcrypto-ref", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 36.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "__stack_chk_fail function", "e": [ "stack_chk_fail", "stack_chk_fail", "sym.imp.__stack_chk_fail" ], "i": "metadata/hardening::stack-chk-fail", "l": 2 }, { "c": 0.20000000298023224, "d": "crypto keyword (substr, catches imports)", "e": [ "/usr/lib/libcrypto.46.dylib" ], "i": "micro-behaviors/data/text/keywords::crypto-substr", "l": 1 }, { "c": 0.6000000238418579, "d": "/Library/Caches directory reference", "e": [ "…sEtfDb569NpfrRSCNsL0UIVc/Library/Caches/com.apple.xbs/TemporaryD…" ], "i": "micro-behaviors/fs/path/library::library-caches-path", "l": 2 }, { "c": 0.30000001192092896, "d": "libssl library reference", "e": [ "/usr/lib/libssl.48.dylib" ], "i": "micro-behaviors/dylib/library/ssl::libssl-ref", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 36.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.92" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Universal Mach-O with two slices", "e": [ "macho.slice_count = 2.00" ], "i": "metadata/binary/framework::dual-arch-macho", "l": 2 }, { "d": "certificate string reference", "e": [ "certificate", "certificate" ], "i": "micro-behaviors/crypto/certificate/operations::certificate-ref", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 36.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.949999988079071, "d": "Mach-O uses .so extension", "e": [ "mod_file_cache.so" ], "i": "metadata/file/extension::macho-so-extension", "l": 3 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 45.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 45.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 70704.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "ARM64 Mach-O binary", "e": [ "macho.cpu_type = 16777228.00" ], "i": "metadata/arch::arm64-macho", "l": 2 }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 1.69" ], "i": "metadata/binary/metrics::low-average-complexity", "l": 2 }, { "c": 1.0, "d": "Mach-O linked dylib metadata", "e": [ "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation", "/usr/lib/libcrypto.46.dylib", "/usr/lib/libssl.48.dylib", "/usr/lib/libSystem.B.dylib" ], "i": "metadata/binary/linking/runtime::dylib", "l": 2 }, { "c": 1.0, "d": "Apple platform binary", "e": [ "platform::Apple Root CA" ], "i": "metadata/signed/trust-level::platform", "l": 2 }, { "c": 0.949999988079071, "d": "links self (stack_chk_guard, dyld_stub_binder, stack_chk_fail, ap_core_translate, ap_discard_request_body, ... +32 more)", "e": [ "self" ], "i": "metadata/dylib::self", "l": 2 } ], "sha": "d27180b339f6b2f793bdba51bdff881410a7d053e8d20e1690cd24a4f42e2093", "path": "/data/samples/good/macOS_Tahoe-26.3/usr/libexec/apache2/mod_file_cache.so", "type": "macho" } ], "tv": "f6eaa" } }