Skip to main content

TH16109

Detected presence of files that embed a raw compressed executable file.

priorityCI/CD statusseverityeffortSAFE levelSAFE assessment
passhighhighNoneNone

About the issue​

Attackers commonly hide their malicious payloads in layers of packing and code obfuscation. Compression is a common data transformation technique used to reduce the file size of Windows executables. Detected software behaviors indicate that the code has the ability to execute decompressed executables. While presence of dynamic code execution does not imply malicious intent, all of its uses in a software package should be documented and approved. When a software package has behavior traits similar to malicious software, it may become flagged by security solutions. One example of acceptable use for embedding raw compressed Windows executables is the intent to install or deploy software components.

How to resolve the issue​

  • Investigate reported detections as indicators of software tampering.
  • Consult Mitre ATT&CK documentation: T1027 - Obfuscated Files or Information.
  • Consider an alternative delivery mechanism for software packages.

Incidence statistics​

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.

This section is updated when new data becomes available.

Total amount of packages analyzed

  • RubyGems: 183K
  • Nuget: 644K
  • PyPi: 628K
  • NPM: 3.72M
Statistics are not collected for the TH16109 policy at this time, or not applicable to this type of issue.