Skip to content

ScanZip

Extracts files from ZIP archives.

Attributes:

Name Type Description
passwords

List of passwords to use when bruteforcing encrypted files.
Options

limit: Maximum number of files to extract. Defaults to 1000. password_file: Location of passwords file for zip archives. Defaults to /etc/strelka/passwords.dat.

Source code in strelka/src/python/strelka/scanners/scan_zip.py 
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
class ScanZip(strelka.Scanner):
    """Extracts files from ZIP archives.

    Attributes:
        passwords: List of passwords to use when bruteforcing encrypted files.

    Options:
        limit: Maximum number of files to extract.
            Defaults to 1000.
        password_file: Location of passwords file for zip archives.
            Defaults to /etc/strelka/passwords.dat.
    """

    def init(self):
        self.passwords = []

    def scan(self, data, file, options, expire_at):
        file_limit = options.get("limit", 100)
        size_limit = options.get("size_limit", 250000000)
        limit_metadata = options.get("limit_metadata", True)
        crack_pws = options.get("crack_pws", False)
        log_pws = options.get("log_pws", True)
        password_file = options.get("password_file", "/etc/strelka/passwords.dat")

        # Gather count and list of files to be extracted
        self.event["total"] = {"files": 0, "extracted": 0}
        self.event["files"] = []

        # Temporary top level compression metrics
        compress_size_total = 0
        file_size_total = 0

        if crack_pws:
            if not self.passwords:
                if os.path.isfile(password_file):
                    with open(password_file, "rb") as f:
                        for line in f:
                            self.passwords.append(line.strip())

                    if (
                        len(self.passwords) == 0
                        and "no_passwords_loaded" not in self.flags
                    ):
                        self.flags.append("no_passwords_loaded")
                else:
                    if "password_file_missing" not in self.flags:
                        self.flags.append("password_file_missing")

        self.passwords.insert(0, None)

        with io.BytesIO(data) as zip_io:
            try:
                with pyzipper.AESZipFile(zip_io) as zip_obj:
                    filelist = zip_obj.filelist

                    # Count the file entries, in case the function encounters an unhandled exception
                    for compressed_file in filelist:
                        if compressed_file.is_dir():
                            continue
                        self.event["total"]["files"] += 1

                    # For each file in zip, gather metadata and pass extracted file back to Strelka
                    for compressed_file in filelist:
                        if compressed_file.is_dir():
                            continue

                        extract = True
                        extracted = False
                        compression_rate = 0

                        if compressed_file.file_size > size_limit:
                            extract = False
                            if "file_size_limit" not in self.flags:
                                self.flags.append("file_size_limit")

                        if self.event["total"]["extracted"] >= file_limit:
                            extract = False
                            if "file_count_limit" not in self.flags:
                                self.flags.append("file_count_limit")

                        if (
                            compressed_file.file_size > 0
                            and compressed_file.compress_size > 0
                        ):
                            compress_size_total += compressed_file.compress_size
                            file_size_total += compressed_file.file_size

                            size_difference = (
                                compressed_file.file_size
                                - compressed_file.compress_size
                            )
                            compression_rate = (
                                size_difference * 100.0
                            ) / compressed_file.file_size

                        try:
                            extract_data = b""
                            zinfo = zip_obj.getinfo(compressed_file.filename)

                            if zinfo.flag_bits & 0x1:
                                if "encrypted" not in self.flags:
                                    self.flags.append("encrypted")

                            for password in self.passwords:
                                try:
                                    if extract:
                                        extract_data = zip_obj.read(
                                            compressed_file.filename, password
                                        )
                                        if extract_data:
                                            self.passwords.insert(
                                                0,
                                                self.passwords.pop(
                                                    self.passwords.index(password)
                                                ),
                                            )
                                            if password and crack_pws and log_pws:
                                                if "password" not in self.event.keys():
                                                    self.event["password"] = []
                                                if password.decode(
                                                    "utf-8"
                                                ) not in self.event.get("password", []):
                                                    self.event["password"].append(
                                                        password.decode("utf-8")
                                                    )
                                            break
                                except RuntimeError:
                                    pass

                            # If there's data in it, and no limits have been met, emit the file
                            if extract_data and extract:
                                # Send extracted file back to Strelka
                                self.emit_file(
                                    extract_data, name=compressed_file.filename
                                )
                                extracted = True

                            if not (
                                limit_metadata
                                and self.event["total"]["extracted"] >= file_limit
                            ):
                                self.event["files"].append(
                                    {
                                        "file_name": compressed_file.filename,
                                        "file_size": compressed_file.file_size,
                                        "compression_size": compressed_file.compress_size,
                                        "compression_rate": round(compression_rate, 2),
                                        "extracted": extracted,
                                        "encrypted": (
                                            True
                                            if zinfo.flag_bits & 0x1 == 1
                                            else False
                                        ),
                                    }
                                )

                            if extracted:
                                self.event["total"]["extracted"] += 1

                        except NotImplementedError:
                            self.flags.append("unsupported_compression")
                        except RuntimeError:
                            self.flags.append("runtime_error")
                        except ValueError:
                            self.flags.append("value_error")
                        except zlib.error:
                            self.flags.append("zlib_error")
                        except pyzipper.BadZipFile:
                            self.flags.append("bad_zip_file")

                        # Top level compression metric
                        if file_size_total > 0 and compress_size_total > 0:
                            size_difference_total = (
                                file_size_total - compress_size_total
                            )
                            self.event["compression_rate"] = round(
                                (size_difference_total * 100.0) / file_size_total, 2
                            )
                        else:
                            self.event["compression_rate"] = 0.00

            except pyzipper.BadZipFile:
                self.flags.append("bad_zip_file")
            except ValueError:
                self.flags.append("value_error")

Features

The features of this scanner are detailed below. These features represent the capabilities and the type of analysis the scanner can perform. This may include support for Indicators of Compromise (IOC), the ability to emit files for further analysis, and the presence of extended documentation for complex analysis techniques.

Feature
Support
IOC Support
Emit Files
Extended Docs
Malware Scanner
Image Thumbnails

Tastes

Strelka's file distribution system assigns scanners to files based on 'flavors' and 'tastes'. Flavors describe the type of file, typically determined by MIME types from libmagic, matches from YARA rules, or characteristics of parent files. Tastes are the criteria used within Strelka to determine which scanners are applied to which files, with positive and negative tastes defining files to be included or excluded respectively.

Source Filetype
Include / Exclude
application/java-archive
application/vnd.openxmlformats-officedocument.presentationml.presentation
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
application/vnd.openxmlformats-officedocument.wordprocessingml.document
application/vnd.openxmlformats-officedocument
application/zip
ooxml_file
zip_file

Scanner Fields

This section provides a list of fields that are extracted from the files processed by this scanner. These fields include the data elements that the scanner extracts from each file, representing the analytical results produced by the scanner. If the test file is missing or cannot be parsed, this section will not contain any data.

Field Name
Field Type
compression_rate
float
elapsed
str
files
list
files.compression_rate
int
files.compression_rate
float
files.compression_size
int
files.encrypted
bool
files.extracted
bool
files.file_name
str
files.file_size
int
flags
list
password
list
total
dict
total.extracted
int
total.files
int

Sample Event

Below is a sample event generated by this scanner, demonstrating the kind of output that can be expected when it processes a file. This sample is derived from a mock scan event configured in the scanner's test file. If no test file is available, this section will not display a sample event.

    test_scan_event = {
        "elapsed": 0.001,
        "flags": [],
        "total": {"files": 4, "extracted": 4},
        "files": [
            {
                "file_name": "hidden/lorem-hidden.txt",
                "file_size": 4015,
                "compression_size": 1425,
                "compression_rate": 64.51,
                "extracted": True,
                "encrypted": False,
            },
            {
                "file_name": "hidden/lorem-readonly.txt",
                "file_size": 4015,
                "compression_size": 1425,
                "compression_rate": 64.51,
                "extracted": True,
                "encrypted": False,
            },
            {
                "file_name": "hidden/lorem.txt",
                "file_size": 4015,
                "compression_size": 1425,
                "compression_rate": 64.51,
                "extracted": True,
                "encrypted": False,
            },
            {
                "file_name": "lorem.txt",
                "file_size": 4015,
                "compression_size": 1425,
                "compression_rate": 64.51,
                "extracted": True,
                "encrypted": False,
            },
        ],
        "compression_rate": 64.51,
    }