reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-malicious-iso-and-container-files/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
analyzing-malicious-iso-and-container-files	Analyzes malicious ISO, IMG, VHD, and similar container files used to smuggle payloads past email and mark-of-the-web defenses by enumerating contents and flagging hidden executables, LNKs, and scripts. Activates for requests to analyze a malicious ISO/IMG, inspect a container delivery file, or find payloads hidden inside a disk image attachment.	cybersecurity	malware-analysis	malware-analysis iso container delivery mark-of-the-web	1.0.0	analyst-ai-pack	Apache-2.0	T1553.005 T1204.002 T1027	D3-FCR D3-FA	MITRE ATT&CK T1553.005 Mark-of-the-Web Bypass — https://attack.mitre.org/techniques/T1553/005/ ISO 9660 file system — https://wiki.osdev.org/ISO_9660

Analyzing Malicious ISO and Container Files

When to Use

• You have an ISO/IMG/VHD attachment suspected of smuggling a payload (LNK + hidden DLL/EXE/script) past MOTW and scanners.
• You need to enumerate contents and flag hidden/executable entries without mounting the image.

Do not use mounting/auto-run to inspect — that can trigger the lure. Parse the container's directory records statically.

Prerequisites

• The container file (read inertly). Optional: pycdlib for full ISO parsing (the script falls back to signature/string carving if absent).

Safety & Handling

• Never mount or open the container interactively; carve statically. Defang any URLs found.

Workflow

Step 1: Identify the container type

python scripts/analyst.py inspect sample.iso

Detects ISO 9660 (CD001), UDF, FAT/VHD signatures and reports the format.

Step 2: Enumerate entries and flag payloads

Lists embedded file signatures (MZ, PK, LNK \x4C\x00\x00\x00, script headers) and flags hidden/executable/decoy entries.

Step 3: Assess the lure chain

A typical chain is a visible LNK pointing at a hidden DLL/EXE/script in the same image — document the relationship.

Step 4: Extract and route

Carve the hidden payload and route it to the appropriate analysis workflow; defang URLs.

Validation

• The container format is identified by signature.
• Hidden executables/LNKs/scripts are enumerated with offsets.
• The lure→payload relationship is documented.

Pitfalls

• Mounting the image and triggering the lure.
• Missing payloads in less-common container formats (VHDX, UDF) without the right parser.
• Overlooking hidden-attribute files that the file manager would not show.

References

• See references/api-reference.md for the inspector.
• ATT&CK T1553.005 and ISO 9660 references (linked in frontmatter).