pandora
pandora copied to clipboard
pandora-analysis
[worker][extraction] Extract ISO file.
As many malware are delivered inside ISO file, it should be nice to have a generic extractor for it.
It works for the files that are detected as application/x-iso9660-image, but there are files that are mountable as iso files but their mime type is not properly detected and pycdlib doesn't supports them either.
The quick fix for now is to mark all the .iso files as malicious.
Extracting iso is a nightmare and windows will happily mount anything. This snipet of code will somehow help a bit: https://github.com/clalancette/pycdlib/issues/82
But it doesn't work for every image.
Most ISO are supported, but some are considered invalid by the library even if Windows can open them.
Until it is solved, all the .iso files are considered malicious by default by the blocklist worker.