Recursive Unpacking

Recursive unpacking is the process of extracting and analyzing nested files, archives, and compressed containers within a software artifact to reveal all embedded components. It’s essential for identifying deeply buried code, dependencies, or threats that are not visible through surface-level inspection.

Threat actors often hide malware or unauthorized files within multi-layered packaging formats (e.g., ZIP files within JAR files within EXE files). Without recursive unpacking, security tools may overlook critical payloads or vulnerable components embedded deep within software artifacts, especially in compiled or packaged releases.

A recursive unpacking engine:

1. Detects compressed or embedded file structures (e.g., TAR, JAR, MSI, ELF sections)
2. Extracts each layer iteratively until all subfiles are exposed
3. Applies static and/or dynamic analysis to each extracted layer
4. Rebuilds file trees and component relationships to support software bill of materials (SBOM) generation or threat analysis

It’s used in conjunction with binary analysis tools, malware detection engines, and Software Bill of Materials (SBOM) extractors.

• Improves Malware Detection by exposing hidden threats in layered files
• Supports Complete SBOM Generation by revealing all embedded components
• Enhances Third-Party Software Auditing with deeper visibility
• Strengthens Software Integrity Checksfor compliance and trustworthiness

• Automatically unpack all file layers before analysis or deployment
• Identify hidden components or tools not declared in the source SBOM
• Detect mismatches between declared and actual shipped components
• Use unpacking output to feed into static, dynamic, or behavioral scanners

• Deep Malware Hunting: Discovering payloads embedded in signed or compressed files
• Software Assurance for Enterprises: Unpacking vendor-delivered software to verify integrity
• Binary Transparency Audits:Validating what's inside release candidates before signing

• Requires format-awareness and support for nested and obfuscated archives
• Should be tightly integrated with SBOM tools and malware analysis platforms
• Needs strong error handling for corrupted or malicious containers
• Plays a critical role in the software supply chain and DevSecOps workflows