Recent work was done to handle compressed archives better, there are still some issues where some compressed files are overlooked or report different results when extracted from a containing archive. A simple example of this is extracting the uncompressed elf kernel binary out of a compressed vmlinuz image, like so (using current tip of malcont 0ffa0db):
$ mal --format=simple analyze /boot/vmlinuz-6.8.0-51-generic | wc -l
9
$ /usr/src/linux-headers-6.8.0-51-generic/scripts/extract-vmlinux /boot/vmlinuz-6.8.0-51-generic > /tmp/vmlinux-6.8.0-51-generic
$ mal --format=simple analyze /tmp/vmlinux-6.8.0-51-generic | wc -l
139
Also, we should probably flag, either via yara rules or otherwise, situations where a file advertises it is one type of file (e.g. named something.gz, but it is some other file type).
Recent work was done to handle compressed archives better, there are still some issues where some compressed files are overlooked or report different results when extracted from a containing archive. A simple example of this is extracting the uncompressed elf kernel binary out of a compressed vmlinuz image, like so (using current tip of malcont 0ffa0db):
Also, we should probably flag, either via yara rules or otherwise, situations where a file advertises it is one type of file (e.g. named something.gz, but it is some other file type).