YARA and CyberChef: ZIP

Published: 2021-04-04
Last Updated: 2021-04-04 20:01:06 UTC
by Didier Stevens (Version: 1)
0 comment(s)

When processing the result of "unzip" in CyberChef, for example with YARA rules, all files contained inside the ZIP file, are concatenated together.

This is not a problem when dealing with a single file inside a ZIP container. But it can be for multiple files. If you want to know more, I recorded a video with more details:

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com

0 comment(s)


Diary Archives