Notifications
Clear all
Topic starter
20/08/2026 5:33 pm
TL;DR: Gootloader is delivered through deliberately malformed ZIP archives that evade many unarchiving and analysis tools, then hand off execution to JScript, PowerShell, and persistence mechanisms, according to Expel. The pattern shows that defenders need behaviour-based detections and execution controls, not just static file inspection.
NHIMG editorial — based on content published by Expel: Gootloader malware analysis and detection opportunities in malformed ZIP archives
By the numbers:
- In past years, Gootloader made up 11% of all malware Expel saw bypassing other security tools.
Questions worth separating out
Q: What breaks when malicious scripts are allowed to run from downloaded archives?
A: User-driven archive execution collapses the boundary between file inspection and code execution.
Q: Why do malformed archives complicate threat detection in practice?
A: They exploit differences between parsers, so one tool may reject the file while another, including the victim’s default handler, opens it.
Q: How should security teams measure whether script controls are working?
A: Look for a sharp reduction in script-host launches from user download locations, especially temporary folders and startup-linked paths.
Practitioner guidance
- Reassociate JScript files away from execution Use GPO to set .js and .jse files to open in Notepad rather than WScript so double-clicking a script does not execute it.
- Block script hosts from downloaded content Restrict wscript.exe and cscript.exe from running downloaded files, and consider limiting them entirely where business use is not required.
- Detect archive anomalies before extraction Monitor for malformed ZIP structures, repeated concatenated archives, and extraction failures that differ from Windows Explorer behaviour.
What's in the full article
Expel's full article covers the operational detail this post intentionally leaves for the source:
- Hex-level comparison of well-formed versus malformed ZIP structures, including the exact bytes that confuse common tooling
- Detection logic for archive anomalies that distinguish Gootloader samples from normal ZIP files
- Process-tree examples showing how WScript, CScript, and PowerShell chain together during execution
- Detailed discussion of the startup-folder and NTFS shortname persistence mechanics
👉 Read Expel’s analysis of Gootloader’s malformed ZIP delivery and detection opportunities →
Malformed zip archives: what they mean for detection and triage?
Explore further
20/08/2026 6:20 pm
Malformed delivery is a control-evasion pattern, not a file-format curiosity. Gootloader shows that attackers can weaponise parser differences to break static analysis while preserving victim execution. That means control design has to account for how software interprets content, not just whether the content is malicious. Practitioners should treat archive parsing failure as a signal in its own right, not an exception to be ignored.
A question worth separating out:
Q: Who is accountable when a user session turns into malware execution?
A: Accountability is shared across endpoint, identity, and security operations teams because the failure sits at the boundary of user behaviour, script policy, and endpoint enforcement. Frameworks such as NIST SP 800-53 and the NIST Cybersecurity Framework both expect clear control ownership and monitoring over execution paths, not just incident response after the fact.
👉 Read our full editorial: Gootloader’s malformed zip evasion shows where detection breaks
