pandora-analysis / pandora

Pandora is an analysis framework to discover if a file is suspicious and conveniently show the results
https://pandora.circl.lu/
GNU Affero General Public License v3.0
248 stars 36 forks source link

Multipart zip file/files (7zip) #202

Open kurgans0 opened 1 year ago

kurgans0 commented 1 year ago

When I tried to check a multipart zip file created with 7zip, I have an issue: Extractor > warn - Unable to extract test-multipart-file.zip.001: File is not a zip file. Looks like the archive is empty (?). This is suspicious. Nothing to extract.

I understand Pandora cannot analyse one file of multipart files. I don't if it was possible, because zip file is truncated.

Is there a way to test multipart zip file? I tried without success to create a zip with multipart files and push it to Pandora. Pandora cannot unzip included multipart files too. Do you think it was possible?

Comment: In "File details" part, it says MimeType is an "application/zip" > in fact, it's an "application/octet-stream"

Rafiot commented 1 year ago

Yeah, that makes sense, there is no way right now to upload and process more than one file at a time (and you need all the files to be able to extract a multipart file).

It is related to this issue: https://github.com/pandora-analysis/pandora/issues/165 and will require something similar to this one: https://github.com/pandora-analysis/pandora/issues/164

And then, we'll need to figure out if and how the 7z python library can support multi-files.