8000 Detection issue with nested ZIP archives containing EICAR test file · Issue #796 · pandora-analysis/pandora · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Detection issue with nested ZIP archives containing EICAR test file #796

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dbarzin opened this issue Apr 22, 2025 · 1 comment
Open

Detection issue with nested ZIP archives containing EICAR test file #796

dbarzin opened this issue Apr 22, 2025 · 1 comment

Comments

@dbarzin
Copy link
Contributor
dbarzin commented Apr 22, 2025

Description:
It appears that when the EICAR test file is placed inside a ZIP archive, which is itself contained in another ZIP archive (i.e., a ZIP within a ZIP), Pandora does not detect the test malware.

Steps to reproduce:

  1. Place the EICAR test file inside a ZIP archive (e.g., eicar.zip).
  2. Place eicar.zip inside another ZIP archive (e.g., nested.zip).
  3. Submit nested.zip to Pandora for analysis.

Expected behavior:
Pandora should recursively analyze nested archives and detect the EICAR test file inside.

Actual behavior:
No detection is triggered when the EICAR file is hidden in a ZIP-in-ZIP configuration.

Request:
Could support for recursive analysis of nested ZIP archives be added or improved?
@dbarzin dbarzin mentioned this issue Apr 22, 2025
Open
@Rafiot
Copy link
Contributor
Rafiot commented Apr 22, 2025 •
edited
Loading

What is the value of max recurse in your case? -> https://github.com/pandora-analysis/pandora/blob/main/pandora/workers/extractor.yml.sample#L10

Unless it's broken, you can increase it as much as you needed.

And if max_is_error is no, you should be getting an alert when you hit the limit -> https://github.com/pandora-analysis/pandora/blob/main/pandora/workers/extractor.yml.sample#L12

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@Rafiot @dbarzin
0