Detonation of more than one file

[Jakub Banaszek]

Hi Team, 

I have a question: It is possible to detonate more than one file for example i have a folder with one .exe file and .dll + some folders with static files (pdf, words) -  .exe program use all this files

My question is that is it possible to push it all to CAS, as a ZIP and run .exe file to analyze behavior? What i have to write in Execution Arguments (Advanced Options)?

[Gunnar Hahlweg]

Hi,

the later versions of CASMA have a plugin called "ghost_user_with_unpacker.py" which should do exactly that.

Quick test on my machine seems to confirm - zip is unpacked to c:\windows\temp\archive_unpacker\ and the (first) exe is started. I didn't add any additional execution arguments.

Give it a shot. Maybe you can adapt that python script to your needs if needed.

BR!

Gunnar