Embedded Engine

• Upgraded to Java 17 and Python 3.10 for all relevant Sandbox components
• Support for AutoIT script files, including compiled AutoIT Portable Executables
• Parsing of MSI metadata and actions, including implementation for filtered file extraction
• Parsing of ODF files and macro extraction
• Parsing of Python pickle files, including implementation for malicious Threat Indicators
• Capability to identify potential obfuscation for extracted macro code
• New Threat Indicator for deceptive filenames commonly used for phishing files
• New Threat Indicator for undetected Equation Editor RTF exploit
• Enhanced parsing of LNK metadata and actions, including new Threat Indicators
• Improved Python-specific Threat Indicators
• Include proper tags for Golang, Rust and compiled-Python Portable Executables
• Improved processing for nested extracted files
• Enhanced Threat Indicators for imported APIs and emulation respectively

Fixes and improvements:

• Fixed minor bugs and misdetections
• Improved emulation efficacy
• Improved application security

• Ensured support for Ubuntu 22.04
• Added new threat indicators
• Disabled IP address OSINT lookups to avoid false positive findings
• Added verdict to IOCs on the UI
• Reduced false positive / false negative detection
• Updated YARA rule-set
• Fixed office file emulation errors

• Malware config extraction support
• Python Unpacking & Decompilation for PyInstaller, Nuitka, and py2exe
• Improved error reporting
• Added long path support on Windows
• Added HTTP redirection support
• Included disassembly of exported functions for Windows binaries
• Threat indicator to flag when executable files have two different sections with the same section name
• Extraction of VBA macro code from DWG files (shown as OLE Stream in File Details section)
• Enhanced script language detection using the guesslang library
• Fine-tuned several threat indicators to reduce false positive ratio
• Improved detection for phishing calendar invites
• Enhanced recursive analysis of active content containers (email, Office documents, PDF, etc.)
• Improved scan process for corrupt OLE2 documents
• Fixed several issues with existing threat indicators (ELF binaries, URL extraction, EML)

• Improved engine performance and stability
• Implemented configurable OPSWAT Reputation secret in engine global config
• New indicators for Windows APIs related to specific activities
• Implemented flagging for LSASS dump using minidump
• Extracted remote templates inside xTable struct in MS Office documents
• Implemented parser for Debian packages
• Expanded malware configuration extractors to encompass the latest and most pertinent threats
• Improved detection of dynamic syscalls using the HellsGate bypass technique
• Enhanced Quishing and Phishing email detection
• Improved the capabilities of Batch, CSV, HTA, JavaScript, LNK, PowerShell, VBA, and VBScript emulation and fine-tuned timeout handling
• Fixed several UTF-8 parsing issues in content parsers (related to HTML & OLE files)
• Ensured that all whitelisted submissions get the Benign verdict
• Improved the stability of concurrent OSINT lookup tasks

• Updated Threat Indicators
• Improved office file emulation
• Improved PE file analysis
• Updated YARA rule-set
• Improved disassembly for x64 architecture
• Improved file type detection
• New IOC types for Crypto wallets
• New Executive Summary (ChatGPT report)

• Crypto Wallets IOCs sometimes parsed and displayed incorrectly on the UI

• Support filenames with various Unicode characters
• Support unpacking of 64-bit executables
• Support malicious documents embedded in PDF files hidden as ActiveMime objects in MHTML format
• New threat indicators to detect the WikiLoader malware family (Microsoft Office files)
• Detection and extraction of embedded RTF files in Office documents, as described in CVE-2023-36884
• Enhance Threat Indicator for Mavinject
• Improved office file emulation
• Improved application security
• Improved large file processing

• Updated Threat Indicators
• Improved office file emulation
• Improved verdict calculation

• Fixed global config “reset to defaults” feature
• Improved office file emulation
• Updated YARA ruleset
• Updated Threat Indicators
• Updated verdict calculation

• Updated logging for MetaDefender Core support package
• Improved handling of embedded JavaScript files

• Enabled XML file support by default
• Updated reputation sources
• Improved verdict calculation
• Fixed global config reset to default values feature
• Fixed report generation for files including Email IOCs

• Updated YARA rule database
• YARA matches displayed on MDCore UI
• Dependency check on startup

• Scan results are extended with the list of IOCs
• Rapid mode support added and enabled by default
• Reputation lookup support added and enabled by default
• Reputation lookup verdict improvements
• Improved embedded engine performance

• Improved Microsoft Office file handling
• Security and performance improvements

• First versions of Embedded and Remote engines for MetaDefender Core customers