{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9220433235168457, "class": 0 } ], "prob": 0.9220433, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-04-30T07:00:55Z" }, "path": "mod_sed.so", "raw": { "v": "4", "fs": [ { "f": "Md₂(Si)", "x": 4, "id": 0, "is": [ "memcpy_chk", "memset_chk", "stack_chk_fail", "stack_chk_guard", "ap_get_brigade", "ap_is_initial_req", "ap_log_rerror_", "ap_pass_brigade", "ap_register_input_filter", "ap_register_output_filter", "ap_remove_input_filter", "ap_remove_output_filter", "apr_brigade_cleanup", "apr_brigade_create", "apr_brigade_partition", "apr_brigade_split_ex", "apr_bucket_flush_create", "apr_bucket_pool_create", "apr_bucket_transient_create", "apr_bucket_type_eos", "apr_bucket_type_flush", "apr_file_close", "apr_file_open", "apr_file_printf", "apr_file_read", "apr_palloc", "apr_pmemdup", "apr_pool_cleanup_null", "apr_pool_cleanup_register", "apr_pool_clear", "apr_pool_create_ex", "apr_pool_tag", "apr_psprintf", "apr_pstrdup", "apr_pvsprintf", "apr_snprintf", "apr_table_unset", "bzero", "isprint", "memchr", "memset", "strcmp", "strlen", "strncmp", "stack_chk_guard", "apr_bucket_type_eos", "apr_bucket_type_flush", "apr_pool_cleanup_null", "dyld_stub_binder", "memcpy_chk", "memset_chk", "stack_chk_fail", "ap_get_brigade", "ap_is_initial_req", "ap_log_rerror_", "ap_pass_brigade", "ap_register_input_filter", "ap_register_output_filter", "ap_remove_input_filter", "ap_remove_output_filter", "apr_brigade_cleanup", "apr_brigade_create", "apr_brigade_partition", "apr_brigade_split_ex", "apr_bucket_flush_create", "apr_bucket_pool_create", "apr_bucket_transient_create", "apr_file_close", "apr_file_open", "apr_file_printf", "apr_file_read", "apr_palloc", "apr_pmemdup", "apr_pool_cleanup_register", "apr_pool_clear", "apr_pool_create_ex", "apr_pool_tag", "apr_psprintf", "apr_pstrdup", "apr_pvsprintf", "apr_snprintf", "apr_table_unset", "isprint", "memchr", "memset", "strcmp", "strlen", "strncmp" ], "ms": { "macho": { "flags": 4.0, "cpu_type": 16777228.0, "file_type": 8.0, "sdk_major": 26.0, "sdk_minor": 4.0, "class_bits": 64.0, "cpu_subtype": 2147483650.0, "slice_count": 2.0, "is_universal": true, "min_os_major": 11.0, "uuid_present": true, "little_endian": true, "build_platform": 1.0, "signature_type": "platform", "source_version": 971968278953984.0, "build_tool_count": 1.0, "has_code_signature": true, "load_command_count": 18.0, "load_commands_size": 1536.0, "code_signature_size": 18992.0, "build_version_present": true, "source_version_present": true }, "binary": { "code_size": 37168.0, "file_size": 106064.0, "code_entropy": 5.68, "data_entropy": 2.06, "export_count": 1.0, "import_count": 44.0, "string_count": 257.0, "has_signature": true, "section_count": 9.0, "segment_count": 4.0, "avg_complexity": 8.21, "function_count": 106.0, "import_density": 1.21, "string_density": 7.08, "overall_entropy": 3.13, "avg_section_size": 4489.67, "entropy_variance": 1.37, "function_density": 2.92, "avg_function_size": 319.8, "avg_string_length": 19.54, "max_string_length": 180.0, "avg_string_entropy": 3.25, "code_to_data_ratio": 11.48, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.35, "provenance_id_length": 16.0, "string_length_stddev": 18.62, "largest_section_ratio": 0.35, "provenance_id_present": true, "sentence_string_count": 50.0, "sentence_string_ratio": 0.19, "high_complexity_functions": 5.0, "nonstandard_section_name_count": 9.0 } }, "ss": [ [ 16424, "__TEXT" ], [ 16488, "__text" ], [ 16568, "__stubs" ], [ 16648, "__stub_helper" ], [ 16728, "__cstring" ], [ 16808, "__const" ], [ 16888, "__unwind_info" ], [ 16976, "__DATA" ], [ 17040, "__got" ], [ 17120, "__la_symbol_ptr" ], [ 17280, "__data" ], [ 17368, "__LINKEDIT" ], [ 17601, "8biq" ], [ 17680, "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation" ], [ 17784, "/usr/lib/libcrypto.46.dylib" ], [ 17840, "/usr/lib/libssl.48.dylib" ], [ 17896, "/usr/lib/libSystem.B.dylib" ], [ 18514, "fffff." ], [ 36625, "ffffff." ], [ 53506, "/AppleInternal/Library/BuildRoots/4~CI8cugCzo5-g8THsEtfDb569NpfrRSCNsL0UIVc/Library/Caches/com.apple.xbs/TemporaryDirectory.R1FS" ], [ 53684, "OutputSed" ], [ 53694, "Sed regular expression for Response" ], [ 53730, "InputSed" ], [ 53739, "Sed regular expression for Request" ], [ 53774, "Failed to compile sed expression. %s" ], [ 53815, "Content-Length" ], [ 53830, "AH10394: error evaluating sed on output" ], [ 53870, "sed_tpool" ], [ 53880, "AH02998: %s" ], [ 53892, "AH10395: error evaluating sed on input" ], [ 53931, "out of memory" ], [ 53945, "too many {'s" ], [ 53958, "undefined label: %s" ], [ 53978, "internal sed error" ], [ 53997, "command garbled: %s" ], [ 54017, "first RE may not be null" ], [ 54042, "too much command text: %s" ], [ 54068, "unrecognized command: %s" ], [ 54093, "no addresses allowed: %s" ], [ 54118, "too many }'s" ], [ 54131, "only one address allowed: %s" ], [ 54160, "label too long: %s" ], [ 54179, "duplicate labels: %s" ], [ 54200, "too many labels: %s" ], [ 54220, "suffix too large: %s" ], [ 54241, "Space missing before filename: %s" ], [ 54275, "file name too long: %s" ], [ 54298, "too many files in w commands" ], [ 54327, "command line too long" ], [ 54349, "too many line numbers" ], [ 54371, "``\\digit'' out of range: %s" ], [ 54399, "ending delimiter missing on substitution: %s" ], [ 54444, "ending delimiter missing on string: %s" ], [ 54483, "transform strings not the same size: %s" ], [ 54523, "cannot open %s" ], [ 54539, "too many appends after line %lld" ], [ 54577, "too many reads after line %lld" ], [ 54732, "Range endpoint too large: %s" ], [ 54761, "Bad number: %s" ], [ 54776, "Illegal or missing delimiter: %s" ], [ 54809, "No remembered search string: %s" ], [ 54841, "\\( \\) imbalance: %s" ], [ 54861, "Too many \\(: %s" ], [ 54877, "More than 2 numbers given in \\{ \\}: %s" ], [ 54916, "} expected after \\: %s" ], [ 54939, "First number exceeds second in \\{ \\}: %s" ], [ 54980, "[ ] imbalance: %s" ], [ 54998, "Unknown regexp error code %s" ], [ 58120, "42PA" ], [ 61452, "Cp p" ], [ 61464, "\u003e@___stack_chk_guard" ], [ 61489, "@_apr_bucket_type_eos" ], [ 61514, "@_apr_bucket_type_flush" ], [ 61539, "@_apr_pool_cleanup_null" ], [ 61564, "@dyld_stub_binder" ], [ 61600, "q(\u003e@___memcpy_chk" ], [ 61620, "q0\u003e@___memset_chk" ], [ 61640, "q8\u003e@___stack_chk_fail" ], [ 61664, "q@\u003e@_ap_get_brigade" ], [ 61686, "qH\u003e@_ap_is_initial_req" ], [ 61711, "qP\u003e@_ap_log_rerror_" ], [ 61733, "qX\u003e@_ap_pass_brigade" ], [ 61756, "q`\u003e@_ap_register_input_filter" ], [ 61788, "qh\u003e@_ap_register_output_filter" ], [ 61821, "qp\u003e@_ap_remove_input_filter" ], [ 61851, "qx\u003e@_ap_remove_output_filter" ], [ 61885, "\u003e@_apr_brigade_cleanup" ], [ 61913, "\u003e@_apr_brigade_create" ], [ 61940, "\u003e@_apr_brigade_partition" ], [ 61970, "\u003e@_apr_brigade_split_ex" ], [ 61999, "\u003e@_apr_bucket_flush_create" ], [ 62031, "\u003e@_apr_bucket_pool_create" ], [ 62062, "\u003e@_apr_bucket_transient_create" ], [ 62098, "\u003e@_apr_file_close" ], [ 62121, "\u003e@_apr_file_open" ], [ 62143, "\u003e@_apr_file_printf" ], [ 62167, "\u003e@_apr_file_read" ], [ 62189, "\u003e@_apr_palloc" ], [ 62208, "\u003e@_apr_pmemdup" ], [ 62228, "\u003e@_apr_pool_cleanup_register" ], [ 62262, "\u003e@_apr_pool_clear" ], [ 62285, "\u003e@_apr_pool_create_ex" ], [ 62312, "\u003e@_apr_pool_tag" ], [ 62333, "\u003e@_apr_psprintf" ], [ 62354, "\u003e@_apr_pstrdup" ], [ 62374, "\u003e@_apr_pvsprintf" ], [ 62396, "\u003e@_apr_snprintf" ], [ 62417, "\u003e@_apr_table_unset" ], [ 62538, "_sed_module" ], [ 64928, "___memcpy_chk" ], [ 64942, "___memset_chk" ], [ 64956, "___stack_chk_fail" ], [ 64974, "___stack_chk_guard" ], [ 64993, "_ap_get_brigade" ], [ 65009, "_ap_is_initial_req" ], [ 65028, "_ap_log_rerror_" ], [ 65044, "_ap_pass_brigade" ], [ 65061, "_ap_register_input_filter" ], [ 65087, "_ap_register_output_filter" ], [ 65114, "_ap_remove_input_filter" ], [ 65138, "_ap_remove_output_filter" ], [ 65163, "_apr_brigade_cleanup" ], [ 65184, "_apr_brigade_create" ], [ 65204, "_apr_brigade_partition" ], [ 65227, "_apr_brigade_split_ex" ], [ 65249, "_apr_bucket_flush_create" ], [ 65274, "_apr_bucket_pool_create" ], [ 65298, "_apr_bucket_transient_create" ], [ 65327, "_apr_bucket_type_eos" ], [ 65348, "_apr_bucket_type_flush" ], [ 65371, "_apr_file_close" ], [ 65387, "_apr_file_open" ], [ 65402, "_apr_file_printf" ], [ 65419, "_apr_file_read" ], [ 65434, "_apr_palloc" ], [ 65446, "_apr_pmemdup" ], [ 65459, "_apr_pool_cleanup_null" ], [ 65482, "_apr_pool_cleanup_register" ], [ 65509, "_apr_pool_clear" ], [ 65525, "_apr_pool_create_ex" ], [ 65545, "_apr_pool_tag" ], [ 65559, "_apr_psprintf" ], [ 65573, "_apr_pstrdup" ], [ 65586, "_apr_pvsprintf" ], [ 65601, "_apr_snprintf" ], [ 65615, "_apr_table_unset" ], [ 65632, "_isprint" ], [ 65641, "_memchr" ], [ 65649, "_memset" ], [ 65657, "_strcmp" ], [ 65665, "_strlen" ], [ 65673, "_strncmp" ], [ 65682, "dyld_stub_binder" ], [ 65699, "_create_sed_dir_config" ], [ 65722, "_register_hooks" ], [ 65738, "_sed_add_expr" ], [ 65752, "_compile_sed_expr" ], [ 65770, "_sed_compile_errf" ], [ 65788, "_sed_response_filter" ], [ 65809, "_sed_request_filter" ], [ 65829, "_init_context" ], [ 65843, "_flush_output_buffer" ], [ 65864, "_clear_ctxpool" ], [ 65879, "_log_sed_errf" ], [ 65893, "_sed_write_output" ], [ 65911, "_sed_eval_cleanup" ], [ 65929, "_alloc_outbuf" ], [ 65943, "_append_bucket" ], [ 65958, "_command_errf" ], [ 65972, "_sed_init_commands" ], [ 65991, "_alloc_reptr" ], [ 66004, "_sed_destroy_commands" ], [ 66026, "_sed_compile_string" ], [ 66046, "_fcomp" ], [ 66053, "_check_finalized" ], [ 66070, "_sed_compile_file" ], [ 66088, "_sed_get_finalize_error" ], [ 66112, "_sed_canbe_finalized" ], [ 66133, "_rline" ], [ 66140, "_address" ], [ 66149, "_search" ], [ 66157, "_dechain" ], [ 66172, "_comple" ], [ 66180, "_compsub" ], [ 66189, "_ycomp" ], [ 66196, "_sed_init_eval" ], [ 66211, "_sed_reset_eval" ], [ 66227, "_eval_errf" ], [ 66238, "_sed_destroy_eval" ], [ 66256, "_sed_eval_file" ], [ 66271, "_sed_eval_buffer" ], [ 66288, "_sed_finalize_eval" ], [ 66307, "_execute" ], [ 66316, "_appendmem_to_linebuf" ], [ 66338, "_append_to_linebuf" ], [ 66357, "_grow_line_buffer" ], [ 66375, "_grow_buffer" ], [ 66388, "_match" ], [ 66395, "_command" ], [ 66404, "_wline" ], [ 66411, "_arout" ], [ 66418, "_copy_to_linebuf" ], [ 66435, "_copy_to_holdbuf" ], [ 66452, "_append_to_holdbuf" ], [ 66471, "_substitute" ], [ 66483, "_copy_to_genbuf" ], [ 66499, "_grow_hold_buffer" ], [ 66517, "_dosub" ], [ 66524, "_place" ], [ 66531, "_grow_gen_buffer" ], [ 66548, "_append_to_genbuf" ], [ 66566, "_sed_compile" ], [ 66579, "_regerr" ], [ 66587, "_sed_step" ], [ 66597, "__advance" ], [ 66607, "_comperr" ], [ 66616, "_getrnge" ], [ 66630, "_sed_filter_cmds" ], [ 66647, "_trans" ], [ 66654, "_sed_filter_name" ], [ 66671, "_bittab" ], [ 66679, "__dyld_private" ], [ 66828, "com.apple.mod_sed" ], [ 67266, "Meqq" ], [ 67515, "Apple Inc.1\u00260$" ], [ 67536, "Apple Certification Authority1" ], [ 67576, "Apple Root CA0" ], [ 67668, "Apple Certification Authority1301" ], [ 67707, "*Apple Code Signing Certification Authority0" ], [ 68186, "%http://www.apple.com/appleca/root.crl0" ], [ 68725, "Apple Inc.1" ], [ 68746, "Apple Software1" ], [ 68771, "Software Signing0" ], [ 69181, "kThis certificate is to be used exclusively for functions internal to Apple Products and/or Apple processes.0" ], [ 69331, "$http://crl.apple.com/codesigning.crl0" ], [ 70419, "https://www.apple.com/appleca/0" ], [ 70468, "Reliance on this certificate by any party assumes acceptance of the then applicable standard terms and conditions of use, certif" ], [ 71023, "*Apple Code Signing Certification Authority" ], [ 71285, "\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e" ], [ 71324, "\u003c!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\"\u003e" ], [ 71427, "\u003cplist version=\"1.0\"\u003e" ], [ 71449, "\u003cdict\u003e" ], [ 71456, "\u003ckey\u003ecdhashes\u003c/key\u003e" ], [ 71477, "\u003carray\u003e" ], [ 71486, "\u003cdata\u003e" ], [ 71495, "a4pPHQYTwMm97yiu2X1ebIX7KvY=" ], [ 71526, "\u003c/data\u003e" ], [ 71536, "\u003c/array\u003e" ], [ 71546, "\u003c/dict\u003e" ], [ 71554, "\u003c/plist\u003e" ], [ 71651, "oq8m" ], [ 98488, "__auth_stubs" ], [ 98816, "__DATA_CONST" ], [ 98880, "__auth_got" ], [ 180551, "_bzero" ], [ 185863, "Fchj" ] ], "sz": 106064, "ts": [ { "c": 1.0, "d": "Mach-O UUID present", "e": [ "674cecdece2638b3894922b6416672e6" ], "i": "metadata/build/reproducible::macho-uuid", "l": 2 }, { "c": 1.0, "d": "Mach-O linked dylib", "e": [ "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation", "/usr/lib/libcrypto.46.dylib", "/usr/lib/libssl.48.dylib", "/usr/lib/libSystem.B.dylib" ], "i": "metadata/binary/linking::macho-dylib", "l": 2 }, { "c": 1.0, "d": "macOS Platform Binary", "e": [ "platform::Apple Root CA" ], "i": "metadata/signed/platform::apple", "l": 3 }, { "c": 1.0, "d": "Identifier", "e": [ "e.mod_sed" ], "i": "metadata/signed/id::e.mod_sed", "l": 2 }, { "c": 0.6000000238418579, "d": "/Library/Caches directory reference", "e": [ "…sEtfDb569NpfrRSCNsL0UIVc/Library/Caches/com.apple.xbs/TemporaryD…" ], "i": "micro-behaviors/fs/path/library::library-caches-path", "l": 2 }, { "c": 0.800000011920929, "d": "Universal Mach-O with two slices", "e": [ "macho.slice_count = 2.00" ], "i": "metadata/binary/framework::dual-arch-macho", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.13" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 106064.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 106.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.30000001192092896, "d": "libssl library reference", "e": [ "/usr/lib/libssl.48.dylib" ], "i": "micro-behaviors/dylib/library/ssl::libssl-ref", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 44.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "command line too long", "too much command text: %s", "command garbled: %s", "too many files in w commands", "_sed_destroy_commands", "_command", "_command_errf", "_sed_init_commands", "unrecognized command: %s" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 44.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.20000000298023224, "d": "crypto keyword (substr, catches imports)", "e": [ "/usr/lib/libcrypto.46.dylib" ], "i": "micro-behaviors/data/text/keywords::crypto-substr", "l": 1 }, { "c": 0.8999999761581421, "d": "__stack_chk_fail function", "e": [ "stack_chk_fail", "stack_chk_fail", "sym.imp.__stack_chk_fail" ], "i": "metadata/hardening::stack-chk-fail", "l": 2 }, { "c": 0.949999988079071, "d": "Mach-O uses .so extension", "e": [ "mod_sed.so" ], "i": "metadata/file/extension::macho-so-extension", "l": 3 }, { "c": 0.8500000238418579, "d": "FORTIFY_SOURCE memcpy bounds check", "e": [ "memcpy_chk", "memcpy_chk", "sym.imp.__memcpy_chk" ], "i": "metadata/hardening::memcpy-chk", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 106.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.25" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "d": "certificate string reference", "e": [ "certificate", "certificate" ], "i": "micro-behaviors/crypto/certificate/operations::certificate-ref", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "_ap_remove_output_filter", "qx\u003e@_ap_remove_output_filter", "qh\u003e@_ap_register_output_filter", "ap_register_output_filter", "ap_remove_output_filter", "_sed_write_output", "_flush_output_buffer", "_ap_register_output_filter", "AH10394: error evaluating sed on output" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 44.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 8.21" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 106.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.30000001192092896, "d": "libcrypto library reference", "e": [ "/usr/lib/libcrypto.46.dylib" ], "i": "micro-behaviors/dylib/library/ssl::libcrypto-ref", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 44.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 1.0, "d": "ARM64 Mach-O binary", "e": [ "macho.cpu_type = 16777228.00" ], "i": "metadata/arch::arm64-macho", "l": 2 }, { "c": 1.0, "d": "Apple platform binary", "e": [ "platform::Apple Root CA" ], "i": "metadata/signed/trust-level::platform", "l": 2 }, { "c": 1.0, "d": "Mach-O linked dylib metadata", "e": [ "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation", "/usr/lib/libcrypto.46.dylib", "/usr/lib/libssl.48.dylib", "/usr/lib/libSystem.B.dylib" ], "i": "metadata/binary/linking/runtime::dylib", "l": 2 }, { "c": 0.949999988079071, "d": "links self (stack_chk_guard, apr_bucket_type_eos, apr_bucket_type_flush, apr_pool_cleanup_null, dyld_stub_binder, ... +39 more)", "e": [ "self" ], "i": "metadata/dylib::self", "l": 2 } ], "sha": "d29e5afa8fe0bc5977d394e76e5384a88a3dc5f9f545f96073422a36ae46f69d", "path": "/data/samples/good/macOS_Tahoe-26.3/usr/libexec/apache2/mod_sed.so", "type": "macho" } ], "tv": "f6eaa" } }