Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: YARA and CyberChef: ZIP SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
YARA and CyberChef: ZIP

When processing the result of "unzip" in CyberChef, for example with YARA rules, all files contained inside the ZIP file, are concatenated together.

This is not a problem when dealing with a single file inside a ZIP container. But it can be for multiple files. If you want to know more, I recorded a video with more details:

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com

DidierStevens

579 Posts
ISC Handler
Apr 4th 2021

Sign Up for Free or Log In to start participating in the conversation!