← All detection heuristics · General
info
POLYGLOT_PDF_APPENDED_ZIP_SCAN_INCOMPLETE
What it means
A ZIP appended after PDF EOF could not be fully scanned.
Why it fires
ZIP bytes were found after the PDF EOF marker, but the appended archive member scan failed or could not run. Parent PDF findings remain valid, but child payload attribution may be incomplete.
Other General heuristics
POLYGLOT_PDF_APPENDED_ZIP_CVE_BUNDLE EXTRACTED_FILE_CLAMAV POLYGLOT_GIF_PDF_FORCEDENTRY_SHAPE SPEC_DIVERGENCE_HIGH PDF_EXTENSION_MISMATCH POLYGLOT_PDF_ZIP_APPENDED EXTRACTED_FILE_STATIC_TRIAGE CORPUS_HISTORICALLY_MALICIOUS POLYGLOT_TEXT_PDF POLYGLOT_ZIP_PREFIXED FORMAT_NEUTRAL_SCAN PPT_FOPT_COMPLEX_DATA_OVERFLOW PPT_FOPT_PROPERTY_TABLE_TRUNCATED CORPUS_RARE_COMBINATION CORPUS_RARE_STRUCTURAL_FEATURE_SET ANALYSIS_TIMEOUT_PARTIAL EMBEDDED_URL MACRO_VALID_PUBLISHER_SIGNATURE SCAN_OPTIONAL_STAGES_SKIPPED SCAN_INCOMPLETE UNKNOWN_FORMAT