Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: YARA and CyberChef: ZIP - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
YARA and CyberChef: ZIP

When processing the result of "unzip" in CyberChef, for example with YARA rules, all files contained inside the ZIP file, are concatenated together.

This is not a problem when dealing with a single file inside a ZIP container. But it can be for multiple files. If you want to know more, I recorded a video with more details:

Didier Stevens
Senior handler
Microsoft MVP


639 Posts
ISC Handler
Apr 4th 2021

Sign Up for Free or Log In to start participating in the conversation!