Embedded Engine

Malware config extraction support

Python Unpacking & Decompilation for PyInstaller, Nuitka, and py2exe

Improved error reporting

Added long path support on Windows

Added HTTP redirection support

Included disassembly of exported functions for Windows binaries

Threat indicator to flag when executable files have two different sections with the same section name

Extraction of VBA macro code from DWG files (shown as OLE Stream in File Details section)

Enhanced script language detection using the guesslang library

Fine-tuned several threat indicators to reduce false positive ratio

Improved detection for phishing calendar invites

Enhanced recursive analysis of active content containers (email, Office documents, PDF, etc.)

Improved scan process for corrupt OLE2 documents

Fixed several issues with existing threat indicators (ELF binaries, URL extraction, EML)

Improved engine performance and stability

Implemented configurable OPSWAT Reputation secret in engine global config

New indicators for Windows APIs related to specific activities

Implemented flagging for LSASS dump using minidump

Extracted remote templates inside xTable struct in MS Office documents

Implemented parser for Debian packages

Expanded malware configuration extractors to encompass the latest and most pertinent threats

Improved detection of dynamic syscalls using the HellsGate bypass technique

Enhanced Quishing and Phishing email detection

Improved the capabilities of Batch, CSV, HTA, JavaScript, LNK, PowerShell, VBA, and VBScript emulation and fine-tuned timeout handling

Fixed several UTF-8 parsing issues in content parsers (related to HTML & OLE files)

Ensured that all whitelisted submissions get the Benign verdict

Improved the stability of concurrent OSINT lookup tasks

Updated Threat Indicators

Improved office file emulation

Improved PE file analysis

Updated YARA ruleset

Improved disassembly for x64 architecture

Improved file type detection

New IOC types for Crypto wallets

New Executive Summary (ChatGPT report)

Crypto Wallets IOCs sometimes parsed and displayed incorrectly on the UI

Support filenames with various Unicode characters

Support unpacking of 64-bit executables

Support malicious documents embedded in PDF files hidden as ActiveMime objects in MHTML format

New threat indicators to detect the WikiLoader malware family (Microsoft Office files)

Detection and extraction of embedded RTF files in Office documents, as described in CVE-2023-36884

Enhance Threat Indicator for Mavinject

Improved office file emulation

Improved application security

Improved large file processing

Updated Threat Indicators

Improved office file emulation

Improved verdict calculation

Fixed global config “reset to defaults” feature

Improved office file emulation

Updated YARA ruleset

Updated Threat Indicators

Updated verdict calculation

Updated logging for MetaDefender Core support package

Improved handling of embedded JavaScript files

Enabled XML file support by default

Updated reputation sources

Improved verdict calculation

Fixed global config reset to default values feature

Fixed report generation for files including Email IOCs

Updated YARA rule database

YARA matches displayed on MDCore UI

Dependency check on startup

Scan results are extended with the list of IOCs

Rapid mode support added and enabled by default

Reputation lookup support added and enabled by default

Reputation lookup verdict improvements

Improved embedded engine performance

Improved Microsoft Office file handling

Security and performance improvements

First versions of Embedded and Remote engines for MetaDefender Core customers