analyzing-malicious-iso-and-container-files

Name: analyzing-malicious-iso-and-container-files
Author: meltedinhex

18stars5forks

How to install analyzing-malicious-iso-and-container-files?

meltedinhex/analyst-ai-pack/analyzing-malicious-iso-and-container-files

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-iso-and-container-files

Installs into the current project.

Summary

Analyzes malicious ISO, IMG, VHD, and similar container files used to smuggle payloads

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Malicious ISO and Container Files
2
3	## When to Use
4
5	- You have an ISO/IMG/VHD attachment suspected of smuggling a payload (LNK + hidden DLL/EXE/script)
6	past MOTW and scanners.
7	- You need to enumerate contents and flag hidden/executable entries without mounting the image.
8
9	Do not use mounting/auto-run to inspect — that can trigger the lure. Parse the container's
10	directory records statically.
11
12	## Prerequisites
13
14	- The container file (read inertly). Optional: `pycdlib` for full ISO parsing (the script falls
15	back to signature/string carving if absent).
16
17	## Safety & Handling
18
19	- Never mount or open the container interactively; carve statically. Defang any URLs found.
20
21	## Workflow
22
23	### Step 1: Identify the container type
24
25	```bash
26	python scripts/analyst.py inspect sample.iso
27	```
28
29	Detects ISO 9660 (`CD001`), UDF, FAT/VHD signatures and reports the format.
30
31	### Step 2: Enumerate entries and flag payloads
32
33	Lists embedded file signatures (`MZ`, `PK`, LNK `\x4C\x00\x00\x00`, script headers) and flags
34	hidden/executable/decoy entries.
35
36	### Step 3: Assess the lure chain
37
38	A typical chain is a visible LNK pointing at a hidden DLL/EXE/script in the same image — document
39	the relationship.
40
41	### Step 4: Extract and route
42
43	Carve the hidden payload and route it to the appropriate analysis workflow; defang URLs.
44
45	## Validation
46
47	- The container format is identified by signature.
48	- Hidden executables/LNKs/scripts are enumerated with offsets.
49	- The lure→payload relationship is documented.
50
51	## Pitfalls
52
53	- Mounting the image and triggering the lure.
54	- Missing payloads in less-common container formats (VHDX, UDF) without the right parser.
55	- Overlooking hidden-attribute files that the file manager would not show.
56
57	## References
58
59	- See [`references/api-reference.md`](references/api-reference.md) for the inspector.
60	- ATT&CK T1553.005 and ISO 9660 references (linked in frontmatter).

People who liked this also viewed

6 picks

Type

analyzing-malicious-iso-and-container-files

18stars5forks

View on GitHub

How to install analyzing-malicious-iso-and-container-files?

meltedinhex/analyst-ai-pack/analyzing-malicious-iso-and-container-files

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-iso-and-container-files

Installs into the current project.

Summary

Analyzes malicious ISO, IMG, VHD, and similar container files used to smuggle payloads

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Malicious ISO and Container Files
2
3	## When to Use
4
5	- You have an ISO/IMG/VHD attachment suspected of smuggling a payload (LNK + hidden DLL/EXE/script)
6	past MOTW and scanners.
7	- You need to enumerate contents and flag hidden/executable entries without mounting the image.
8
9	Do not use mounting/auto-run to inspect — that can trigger the lure. Parse the container's
10	directory records statically.
11
12	## Prerequisites
13
14	- The container file (read inertly). Optional: `pycdlib` for full ISO parsing (the script falls
15	back to signature/string carving if absent).
16
17	## Safety & Handling
18
19	- Never mount or open the container interactively; carve statically. Defang any URLs found.
20
21	## Workflow
22
23	### Step 1: Identify the container type
24
25	```bash
26	python scripts/analyst.py inspect sample.iso
27	```
28
29	Detects ISO 9660 (`CD001`), UDF, FAT/VHD signatures and reports the format.
30
31	### Step 2: Enumerate entries and flag payloads
32
33	Lists embedded file signatures (`MZ`, `PK`, LNK `\x4C\x00\x00\x00`, script headers) and flags
34	hidden/executable/decoy entries.
35
36	### Step 3: Assess the lure chain
37
38	A typical chain is a visible LNK pointing at a hidden DLL/EXE/script in the same image — document
39	the relationship.
40
41	### Step 4: Extract and route
42
43	Carve the hidden payload and route it to the appropriate analysis workflow; defang URLs.
44
45	## Validation
46
47	- The container format is identified by signature.
48	- Hidden executables/LNKs/scripts are enumerated with offsets.
49	- The lure→payload relationship is documented.
50
51	## Pitfalls
52
53	- Mounting the image and triggering the lure.
54	- Missing payloads in less-common container formats (VHDX, UDF) without the right parser.
55	- Overlooking hidden-attribute files that the file manager would not show.
56
57	## References
58
59	- See [`references/api-reference.md`](references/api-reference.md) for the inspector.
60	- ATT&CK T1553.005 and ISO 9660 references (linked in frontmatter).

People who liked this also viewed

6 picks

Type