2025 Gartner® Market Guide for Software Supply Chain Security
Read Now
Modernize Your Malware Analysis
Download White Paper
Looking for an alternative to VirusTotal? We've got you covered.
Learn More

Table of Contents

Recursive Unpacking

What is recursive unpacking?

Recursive unpacking is the process of extracting and analyzing nested files, archives, and compressed containers within a software artifact to reveal all embedded components. It’s essential for identifying deeply buried code, dependencies, or threats that are not visible through surface-level inspection.

Why is recursive unpacking critical?

Threat actors often hide malware or unauthorized files within multi-layered packaging formats (e.g., ZIP files within JAR files within EXE files). Without recursive unpacking, security tools may overlook critical payloads or vulnerable components embedded deep within software artifacts, especially in compiled or packaged releases.

How it works

A recursive unpacking engine:

  1. Detects compressed or embedded file structures (e.g., TAR, JAR, MSI, ELF sections)
  2. Extracts each layer iteratively until all subfiles are exposed
  3. Applies static and/or dynamic analysis to each extracted layer
  4. Rebuilds file trees and component relationships to support software bill of materials (SBOM) generation or threat analysis

It’s used in conjunction with binary analysis tools, malware detection engines, and Software Bill of Materials (SBOM) extractors.

Benefits

  • Improves Malware Detection by exposing hidden threats in layered files

  • Supports Complete SBOM Generation by revealing all embedded components

  • Enhances Third-Party Software Auditing with deeper visibility

  • Strengthens Software Integrity Checksfor compliance and trustworthiness

Recursive unpacking vs

Topic

Focus Area

Key Differences

Binary SBOM

List of components in compiled code

Recursive unpacking helps generate accurate binary SBOMs

Post-Compilation Scanning

Scans compiled artifacts

Recursive unpacking is often a prerequisite for effective scanning

Artifact Behavioral Analysis

Runtime execution analysis

Focuses on behavior, not file structure or embedded content

Recursive unpacking best practices

  • Automatically unpack all file layers before analysis or deployment
  • Identify hidden components or tools not declared in the source SBOM
  • Detect mismatches between declared and actual shipped components
  • Use unpacking output to feed into static, dynamic, or behavioral scanners

Use cases

  • Deep Malware Hunting: Discovering payloads embedded in signed or compressed files

  • Software Assurance for Enterprises: Unpacking vendor-delivered software to verify integrity

  • Binary Transparency Audits:Validating what's inside release candidates before signing

Additional considerations

  • Requires format-awareness and support for nested and obfuscated archives
  • Should be tightly integrated with SBOM tools and malware analysis platforms
  • Needs strong error handling for corrupted or malicious containers
  • Plays a critical role in the software supply chain and DevSecOps workflows

Featured Articles

Ready to get started?

Contact us for a personalized demo

schedule a demo