ClamAV vs. Content IQ Test, part 4
Summary: In part four of a five-part Cisco Talos series, ClamAV was tested against Office and PDF files carrying a target string inside embedded VBA macros and executables. ClamAV treated PPTM, DOCM, XLSM and PPSM files as archives and read the embedded scripts, and in test file 27 it unpacked a Zip, opened the PDF inside, extracted the embedded executable and alerted on the string it found.
What's compelling: The test file that mattered most was the nested one: a Zip holding a PDF holding an executable, which defeats tools that stop at the first layer of compression. Security leaders should know whether their scanning stack unwraps archives to that depth, because the attacker only needs one layer their tool does not open.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026