{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9317264556884766, "class": 0 } ], "prob": 0.93172646, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-04-30T08:03:35Z" }, "path": "mod_log_forensic.so", "raw": { "v": "4", "fs": [ { "f": "Md₂(Si)", "x": 5, "id": 0, "is": [ "strcpy_chk", "ap_bin2hex", "ap_hook_log_transaction", "ap_hook_open_logs", "ap_hook_post_read_request", "ap_log_assert", "ap_log_error_", "ap_open_piped_log", "ap_piped_log_write_fd", "ap_server_root_relative", "apr_atomic_inc32", "apr_file_open", "apr_file_write", "apr_palloc", "apr_psprintf", "apr_pstrcat", "apr_pstrdup", "apr_table_do", "apr_table_get", "apr_table_setn", "getpid", "memset", "strlen", "time", "dyld_stub_binder", "strcpy_chk", "ap_bin2hex", "ap_hook_log_transaction", "ap_hook_open_logs", "ap_hook_post_read_request", "ap_log_assert", "ap_log_error_", "ap_open_piped_log", "ap_piped_log_write_fd", "ap_server_root_relative", "apr_atomic_inc32", "apr_file_open", "apr_file_write", "apr_palloc", "apr_psprintf", "apr_pstrcat", "apr_pstrdup", "apr_table_do", "apr_table_get", "apr_table_setn", "getpid", "memset", "strlen", "time" ], "ms": { "macho": { "flags": 4.0, "cpu_type": 16777228.0, "file_type": 8.0, "sdk_major": 26.0, "sdk_minor": 4.0, "class_bits": 64.0, "cpu_subtype": 2147483650.0, "slice_count": 2.0, "is_universal": true, "min_os_major": 11.0, "uuid_present": true, "little_endian": true, "build_platform": 1.0, "signature_type": "platform", "source_version": 971968278953984.0, "build_tool_count": 1.0, "has_code_signature": true, "load_command_count": 18.0, "load_commands_size": 1536.0, "code_signature_size": 18720.0, "build_version_present": true, "source_version_present": true }, "binary": { "code_size": 3028.0, "file_size": 70000.0, "code_entropy": 5.62, "data_entropy": 1.77, "export_count": 1.0, "import_count": 24.0, "string_count": 122.0, "has_signature": true, "section_count": 9.0, "segment_count": 4.0, "avg_complexity": 1.71, "function_count": 38.0, "import_density": 8.12, "string_density": 41.26, "overall_entropy": 2.95, "avg_section_size": 545.22, "entropy_variance": 1.53, "function_density": 12.85, "avg_function_size": 96.0, "avg_string_length": 21.74, "max_string_length": 186.0, "avg_string_entropy": 3.29, "code_to_data_ratio": 1.61, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.04, "provenance_id_length": 16.0, "string_length_stddev": 25.89, "largest_section_ratio": 0.04, "provenance_id_present": true, "sentence_string_count": 13.0, "sentence_string_ratio": 0.11, "nonstandard_section_name_count": 9.0 } }, "ss": [ [ 16424, "__TEXT" ], [ 16488, "__text" ], [ 16568, "__stubs" ], [ 16648, "__stub_helper" ], [ 16728, "__cstring" ], [ 16808, "__const" ], [ 16888, "__unwind_info" ], [ 16976, "__DATA" ], [ 17040, "__got" ], [ 17120, "__la_symbol_ptr" ], [ 17280, "__data" ], [ 17360, "__bss" ], [ 17448, "__LINKEDIT" ], [ 17760, "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation" ], [ 17864, "/usr/lib/libcrypto.46.dylib" ], [ 17920, "/usr/lib/libssl.48.dylib" ], [ 17976, "/usr/lib/libSystem.B.dylib" ], [ 21130, "/AppleInternal/Library/BuildRoots/4~CI8cugCzo5-g8THsEtfDb569NpfrRSCNsL0UIVc/Library/Caches/com.apple.xbs/TemporaryDirectory.R1FS" ], [ 21317, "ForensicLog" ], [ 21329, "the filename of the forensic log" ], [ 21362, "mod_unique_id.c" ], [ 21378, "AH00650: couldn't spawn forensic log pipe %s" ], [ 21423, "AH00651: could not open forensic log file %s." ], [ 21469, "UNIQUE_ID" ], [ 21489, "h.pos \u003c h.end" ], [ 21503, "rv == APR_SUCCESS \u0026\u0026 n == h.count-1" ], [ 21539, "forensic-id" ], [ 24920, "42PA" ], [ 28688, "\u003e@dyld_stub_binder" ], [ 28714, "\u003e@___strcpy_chk" ], [ 28734, "\u003e@_ap_bin2hex" ], [ 28752, "\u003e@_ap_hook_log_transaction" ], [ 28781, "q \u003e@_ap_hook_open_logs" ], [ 28806, "q(\u003e@_ap_hook_post_read_request" ], [ 28839, "q0\u003e@_ap_log_assert" ], [ 28860, "q8\u003e@_ap_log_error_" ], [ 28881, "q@\u003e@_ap_open_piped_log" ], [ 28906, "qH\u003e@_ap_piped_log_write_fd" ], [ 28935, "qP\u003e@_ap_server_root_relative" ], [ 28966, "qX\u003e@_apr_atomic_inc32" ], [ 28990, "q`\u003e@_apr_file_open" ], [ 29011, "qh\u003e@_apr_file_write" ], [ 29033, "qp\u003e@_apr_palloc" ], [ 29051, "qx\u003e@_apr_psprintf" ], [ 29074, "\u003e@_apr_pstrcat" ], [ 29094, "\u003e@_apr_pstrdup" ], [ 29114, "\u003e@_apr_table_do" ], [ 29135, "\u003e@_apr_table_get" ], [ 29157, "\u003e@_apr_table_setn" ], [ 29242, "_log_forensic_module" ], [ 30217, "___strcpy_chk" ], [ 30231, "_ap_bin2hex" ], [ 30243, "_ap_hook_log_transaction" ], [ 30268, "_ap_hook_open_logs" ], [ 30287, "_ap_hook_post_read_request" ], [ 30314, "_ap_log_assert" ], [ 30329, "_ap_log_error_" ], [ 30344, "_ap_open_piped_log" ], [ 30363, "_ap_piped_log_write_fd" ], [ 30386, "_ap_server_root_relative" ], [ 30411, "_apr_atomic_inc32" ], [ 30429, "_apr_file_open" ], [ 30444, "_apr_file_write" ], [ 30460, "_apr_palloc" ], [ 30472, "_apr_psprintf" ], [ 30486, "_apr_pstrcat" ], [ 30499, "_apr_pstrdup" ], [ 30512, "_apr_table_do" ], [ 30526, "_apr_table_get" ], [ 30541, "_apr_table_setn" ], [ 30557, "_getpid" ], [ 30565, "_memset" ], [ 30573, "_strlen" ], [ 30587, "dyld_stub_binder" ], [ 30604, "_make_forensic_log_scfg" ], [ 30628, "_merge_forensic_log_scfg" ], [ 30653, "_register_hooks" ], [ 30669, "_set_forensic_log" ], [ 30687, "_log_init" ], [ 30697, "_log_before" ], [ 30709, "_log_after" ], [ 30720, "_open_log" ], [ 30730, "_count_headers" ], [ 30745, "_count_string" ], [ 30759, "_log_escape" ], [ 30771, "_log_headers" ], [ 30784, "_test_char_table" ], [ 30801, "_forensic_log_cmds" ], [ 30820, "_register_hooks.pre" ], [ 30840, "__dyld_private" ], [ 30855, "_next_id" ], [ 30988, "com.apple.mod_log_forensic" ], [ 31404, "Apple Inc.1\u00260$" ], [ 31425, "Apple Certification Authority1" ], [ 31465, "Apple Root CA0" ], [ 31557, "Apple Certification Authority1301" ], [ 31596, "*Apple Code Signing Certification Authority0" ], [ 32075, "%http://www.apple.com/appleca/root.crl0" ], [ 32614, "Apple Inc.1" ], [ 32635, "Apple Software1" ], [ 32660, "Software Signing0" ], [ 33070, "kThis certificate is to be used exclusively for functions internal to Apple Products and/or Apple processes.0" ], [ 33220, "$http://crl.apple.com/codesigning.crl0" ], [ 34308, "https://www.apple.com/appleca/0" ], [ 34357, "Reliance on this certificate by any party assumes acceptance of the then applicable standard terms and conditions of use, certif" ], [ 34912, "*Apple Code Signing Certification Authority" ], [ 35174, "\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e" ], [ 35213, "\u003c!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\"\u003e" ], [ 35316, "\u003cplist version=\"1.0\"\u003e" ], [ 35338, "\u003cdict\u003e" ], [ 35345, "\u003ckey\u003ecdhashes\u003c/key\u003e" ], [ 35366, "\u003carray\u003e" ], [ 35375, "\u003cdata\u003e" ], [ 35384, "SmQG7vqMFBqBOfiPTUzYsICu2Fg=" ], [ 35415, "\u003c/data\u003e" ], [ 35425, "\u003c/array\u003e" ], [ 35435, "\u003c/dict\u003e" ], [ 35443, "\u003c/plist\u003e" ], [ 65720, "__auth_stubs" ], [ 66048, "__DATA_CONST" ], [ 66112, "__auth_got" ], [ 121624, "zN9RxtnJzbtBq6bueFaNVQx25dk=" ] ], "sz": 70000, "ts": [ { "c": 1.0, "d": "Mach-O UUID present", "e": [ "18b8f5089ab43b40809c3e41c21c52f9" ], "i": "metadata/build/reproducible::macho-uuid", "l": 2 }, { "c": 1.0, "d": "Mach-O linked dylib", "e": [ "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation", "/usr/lib/libcrypto.46.dylib", "/usr/lib/libssl.48.dylib", "/usr/lib/libSystem.B.dylib" ], "i": "metadata/binary/linking::macho-dylib", "l": 2 }, { "c": 1.0, "d": "macOS Platform Binary", "e": [ "platform::Apple Root CA" ], "i": "metadata/signed/platform::apple", "l": 3 }, { "c": 1.0, "d": "Identifier", "e": [ "e.mod_log_forensic" ], "i": "metadata/signed/id::e.mod_log_forensic", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 24.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 70000.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.95" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 38.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.29" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.949999988079071, "d": "Mach-O uses .so extension", "e": [ "mod_log_forensic.so" ], "i": "metadata/file/extension::macho-so-extension", "l": 3 }, { "d": "certificate string reference", "e": [ "certificate", "certificate" ], "i": "micro-behaviors/crypto/certificate/operations::certificate-ref", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 1.71" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.30000001192092896, "d": "libcrypto library reference", "e": [ "/usr/lib/libcrypto.46.dylib" ], "i": "micro-behaviors/dylib/library/ssl::libcrypto-ref", "l": 2 }, { "c": 1.0, "d": "ARM64 Mach-O binary", "e": [ "macho.cpu_type = 16777228.00" ], "i": "metadata/arch::arm64-macho", "l": 2 }, { "c": 0.8500000238418579, "d": "FORTIFY_SOURCE strcpy bounds check", "e": [ "strcpy_chk", "strcpy_chk", "sym.imp.__strcpy_chk" ], "i": "metadata/hardening::strcpy-chk", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 38.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.6000000238418579, "d": "/Library/Caches directory reference", "e": [ "…sEtfDb569NpfrRSCNsL0UIVc/Library/Caches/com.apple.xbs/TemporaryD…" ], "i": "micro-behaviors/fs/path/library::library-caches-path", "l": 2 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get current calendar time (seconds)", "e": [ "time", "time" ], "i": "micro-behaviors/time/query::time", "l": 2, "m": "T1124" }, { "c": 0.30000001192092896, "d": "libssl library reference", "e": [ "/usr/lib/libssl.48.dylib" ], "i": "micro-behaviors/dylib/library/ssl::libssl-ref", "l": 2 }, { "c": 0.20000000298023224, "d": "crypto keyword (substr, catches imports)", "e": [ "/usr/lib/libcrypto.46.dylib" ], "i": "micro-behaviors/data/text/keywords::crypto-substr", "l": 1 }, { "c": 0.800000011920929, "d": "Universal Mach-O with two slices", "e": [ "macho.slice_count = 2.00" ], "i": "metadata/binary/framework::dual-arch-macho", "l": 2 }, { "c": 0.30000001192092896, "d": "Get process ID", "e": [ "getpid", "getpid" ], "i": "micro-behaviors/process/identity/query::getpid", "l": 2 }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 1.71" ], "i": "metadata/binary/metrics::low-average-complexity", "l": 2 }, { "c": 1.0, "d": "Apple platform binary", "e": [ "platform::Apple Root CA" ], "i": "metadata/signed/trust-level::platform", "l": 2 }, { "c": 1.0, "d": "Mach-O linked dylib metadata", "e": [ "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation", "/usr/lib/libcrypto.46.dylib", "/usr/lib/libssl.48.dylib", "/usr/lib/libSystem.B.dylib" ], "i": "metadata/binary/linking/runtime::dylib", "l": 2 }, { "c": 0.949999988079071, "d": "links self (dyld_stub_binder, strcpy_chk, ap_bin2hex, ap_hook_log_transaction, ap_hook_open_logs, ... +20 more)", "e": [ "self" ], "i": "metadata/dylib::self", "l": 2 } ], "sha": "faadd3d86be2e183232bf7cb970372085a5efb35de718f21e9c6d831b0a8b5b5", "path": "mod_log_forensic.so", "type": "macho" } ], "tv": "f6eaa" } }