<div dir="ltr"><div>Hi,</div><div>Following my previous email, Zeek started extracting some .exe files but not all. If for example I download twenty .exe files over http from a certain website, Zeek extracts like 2 or 3 out of 20. Is there a reason why Zeek is not recognizing and extracting all.exe files? Also, I added Binary .bin files to be extracted, however it is not extracting them. <br></div><div>Note: I am downloading all files over http protocol only and not SSL.</div><div>Thank you for your help</div><div>Regards,</div><div>Hank<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 29 Apr 2020 at 23:42, Hank Duo <<a href="mailto:jradih20@gmail.com">jradih20@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hi all,</div><div><br></div><div>I would like to extract .exe and office files for static and dynamic malware analysis purpose. I used the attached script however .exe or .docs files are not extracted except for html, txt or zip files.</div><div><br></div><div>Note that I modified the main.zeek file which is located in /usr/local/zeek/share/zeek/zeekctl/main.bro by adding <a href="https://github.com/load" target="_blank">@load</a> /frameworks/files/extract-myfiles (which is the script file name) and commented the default one and the script was applied properly.</div><div><br></div><div>Also, is there a way to extract files only from http or smb protocols while excluding https?</div><div>Thank you guys</div><div><br></div></div>
</blockquote></div>