Recursive Unpacking

Recursive unpacking is the process of extracting and analyzing nested files, archives, and compressed containers within a software artifact to reveal all embedded components. It’s essential for identifying deeply buried code, dependencies, or threats that are not visible through surface-level inspection.

Threat actors often hide malware or unauthorized files within multi-layered packaging formats (e.g., ZIP files within JAR files within EXE files). Without recursive unpacking, security tools may overlook critical payloads or vulnerable components embedded deep within software artifacts, especially in compiled or packaged releases.

A recursive unpacking engine:

1. Detects compressed or embedded file structures (e.g., TAR, JAR, MSI, ELF sections)
2. Extracts each layer iteratively until all subfiles are exposed
3. Applies static and/or dynamic analysis to each extracted layer
4. Rebuilds file trees and component relationships to support software bill of materials (SBOM) generation or threat analysis

It’s used in conjunction with binary analysis tools, malware detection engines, and Software Bill of Materials (SBOM) extractors.

• Improves Malware Detection by exposing hidden threats in layered files
• Supports Complete SBOM Generation by revealing all embedded components
• Enhances Third-Party Software Auditing with deeper visibility
• Strengthens Software Integrity Checksfor compliance and trustworthiness