search

pandora-analysis / pandora

Pandora is an analysis framework to discover if a file is suspicious and conveniently show the results
https://pandora.circl.lu/
GNU Affero General Public License v3.0
248 stars 36 forks source link

[worker][extraction] Extract ISO file. #39

Open FafnerKeyZee opened 2 years ago

FafnerKeyZee commented 2 years ago

As many malware are delivered inside ISO file, it should be nice to have a generic extractor for it.

Rafiot commented 2 years ago

It works for the files that are detected as application/x-iso9660-image, but there are files that are mountable as iso files but their mime type is not properly detected and pycdlib doesn't supports them either.

The quick fix for now is to mark all the .iso files as malicious.

Rafiot commented 2 years ago

Extracting iso is a nightmare and windows will happily mount anything. This snipet of code will somehow help a bit: https://github.com/clalancette/pycdlib/issues/82

But it doesn't work for every image.

Rafiot commented 2 years ago

Most ISO are supported, but some are considered invalid by the library even if Windows can open them.

Until it is solved, all the .iso files are considered malicious by default by the blocklist worker.