← All detection heuristics · General
high
EXTRACTED_FILE_STATIC_TRIAGE
What it means
A file carved from inside the sample matched static suspicious-content checks.
Why it fires
The analyzer performs a lightweight triage pass on carved artifacts in addition to ClamAV. It looks for signals such as script obfuscation, long encoded blobs, PowerShell encoded commands, VBA auto-exec with execution terms, and high-entropy packed content. These are not signature matches by themselves, but they are useful evidence when an embedded payload is trying to hide behavior from simple static inspection.
Other General heuristics
POLYGLOT_PDF_APPENDED_ZIP_CVE_BUNDLE EXTRACTED_FILE_CLAMAV POLYGLOT_GIF_PDF_FORCEDENTRY_SHAPE SPEC_DIVERGENCE_HIGH PDF_EXTENSION_MISMATCH POLYGLOT_PDF_ZIP_APPENDED CORPUS_HISTORICALLY_MALICIOUS POLYGLOT_TEXT_PDF POLYGLOT_ZIP_PREFIXED FORMAT_NEUTRAL_SCAN PPT_FOPT_COMPLEX_DATA_OVERFLOW PPT_FOPT_PROPERTY_TABLE_TRUNCATED CORPUS_RARE_COMBINATION CORPUS_RARE_STRUCTURAL_FEATURE_SET ANALYSIS_TIMEOUT_PARTIAL EMBEDDED_URL MACRO_VALID_PUBLISHER_SIGNATURE SCAN_OPTIONAL_STAGES_SKIPPED POLYGLOT_PDF_APPENDED_ZIP_SCAN_INCOMPLETE SCAN_INCOMPLETE UNKNOWN_FORMAT