{"arch":"arm64","build_provenance":null,"call_graph":{"calls":{},"data_xrefs":{"by_data":{},"by_function":{}},"noreturn_vas":[],"symbols":{"4294968168":"sub_100000368"}},"capabilities":[],"code_signature":{"code_directory":{"cdhash":"9e804ecd5c2ba0096c44781a66a5f637b8a115391088899358528e7eee863ddf","flag_names":[],"flags":0,"hash_type":2,"identifier":"com.apple.true","platform":26,"team_id":null},"signing_status":"AppleSigned"},"cpp_hierarchy":null,"data_in_code":[],"dna":{"hashes":{"classhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","cpp_classhash":null,"entitlementhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","frameworkhash":"b97e2cdeefa15f4389f6b3af8effe69a9a08ff67358c734e7ad450bacde906ed","imphash":"21b562eedf9f4da268355875b57cfe0f0bfc87c509a6020ebb070d21ee506d80","sha256_text":"2f6110664dbd16b514a0c2c7c8326932a36e85d2f15b91e57ca76efd2c7a625a","symbolhash":"21b562eedf9f4da268355875b57cfe0f0bfc87c509a6020ebb070d21ee506d80"},"sets":{"apis_called":[],"bundle_ids":["com.apple.true"],"cpp_classes":[],"entitlements":[],"frameworks":["libSystem.B.dylib"],"iokit_constants":[],"objc_classes":[],"private_frameworks":[],"protocols":[],"signing_status":"Apple Signed","static_libs":[],"swift_protocol_names":[],"swift_type_names":[],"xpc_services":[]},"vector":{"bundle_ids":1,"cap_analytics":0,"cap_hardware":0,"cap_ipc":0,"cap_keychain":0,"cap_location":0,"cap_network":0,"cap_security":0,"cap_storage":0,"cap_system":0,"cpp_classes":0,"cpp_vtable_entries":0,"entitlements_total":0,"file_paths":0,"frameworks_private":0,"frameworks_total":1,"iokit_constants":0,"library_functions":0,"nlist_functions":1,"objc_classes":0,"objc_ivars":0,"objc_methods":0,"objc_protocols":0,"section_count":3,"size_log2":16.360298,"static_lib_count":0,"swift_conformances":0,"swift_protocols":0,"swift_types":0,"telemetry_strings":0,"text_ratio":0.00009509319,"url_endpoints":4,"xpc_provides":0}},"dwarf_metadata":null,"entitlements":{"entries":{},"raw_plist":null},"exports":[{"address":0,"is_reexport":false,"is_thread_local":false,"is_weak":false,"name":"_mh_execute_header"}],"fileset_entries":[],"fingerprint":{"analyzed_at":"2026-04-07T05:21:11Z","available_arches":["x86_64","arm64"],"binary_type":"executable","bundle_id":null,"cdhash":"9e804ecd5c2ba0096c44781a66a5f637b8a115391088899358528e7eee863ddf","file_modified":"2026-04-06T12:04:14Z","file_size":84128,"is_arm64e":true,"min_os":"26.1.0","name":"true","platform":"macOS","sdk":"26.1.0","sha256":"20729fdbfe231d3e797da8d5bc804ca039b249c768bc74bee0e30852661415e3","sha256_slice":"520722172856b7f151febd17f1a67bb3ff3e57cfb0efd3a69b3cb3435e51f814","source_version":"326.0.0.0.0","team_id":null,"uuid":"0DC7587C-94B1-33CD-9B2B-48B098AF4CE9"},"frameworks":[{"is_private":false,"is_weak":false,"name":"/usr/lib/libSystem.B.dylib"}],"function_starts_count":1,"imports":[],"interesting_strings":{"bundle_ids":["com.apple.true"],"urls_and_endpoints":["$http://crl.apple.com/codesigning.crl0","%http://www.apple.com/appleca/root.crl0","<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">","https://www.apple.com/appleca/0"]},"iokit_surface":null,"library_matches":[],"library_profile":{"libraries":{},"library_ratio":0.0,"total_functions":1,"total_identified":0},"network_surface":{"api_usage":{"callers":[],"classes":[],"methods":[]},"endpoints":[{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/appleca/root.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"www.apple.com"},{"is_dynamic":false,"kind":"Url","value":"http://crl.apple.com/codesigning.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"crl.apple.com"},{"is_dynamic":false,"kind":"Url","value":"https://www.apple.com/appleca/0"},{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">"}],"has_network_entitlement":false,"network_frameworks":[]},"objc_classes":{},"objc_metadata":{"classes":{}},"sections":[{"name":"__text","offset":872,"protection":"r-x","segment":"__TEXT","size":8},{"name":"__const","offset":880,"protection":"r-x","segment":"__TEXT","size":56},{"name":"__unwind_info","offset":936,"protection":"r-x","segment":"__TEXT","size":88}],"summary":"A signed Apple executable that initiates outbound network connections to six distinct remote endpoints. Loads one framework and references multiple URLs and endpoints, suggesting coordination with Apple's cloud or backend services. The minimal function count and bundle ID indicate a focused utility for a specific system task. Network communication pattern and Apple signature suggest legitimate system integration rather than user-facing functionality.","swift_metadata":null,"title":"Apple system utility — communicates with remote services for system operations","total_strings":82,"xpc_services":[]}