Topic starter
20/08/2026 5:33 pm
TL;DR: Gootloader is delivered through deliberately malformed ZIP archives that evade many unarchiving and analysis tools, then hand off execution to JScript, PowerShell, and persistence mechanisms, according to Expel. The pattern shows that defenders need behaviour-based detections and execution controls, not just static file inspection.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Planned failure: Gootloader’s malformed ZIP actually works perfectly”.
Key questions
Q: What breaks when malformed ZIP archives are used to deliver malware?
A: They break the assumption that every archive can be parsed consistently by automated tooling.
Q: Why do malformed archives still matter if the malware eventually runs in Windows?
A: Because the attacker is exploiting a control gap between analysis and execution.
Q: What do security teams get wrong about ZIP-based malware delivery?
A: They often stop at file reputation or hash matching, which fails when each victim receives a unique archive.
Practitioner guidance
- Harden script execution defaults Reassociate .js and .jse files to open in a text editor rather than WScript, and restrict execution of downloaded scripts where business use does not require them.
- Detect script execution from temporary paths Alert when WScript or CScript launches a JScript file from AppDataLocalTemp or another extraction path associated with archive handling.
- Block legacy shortname script execution Flag CScript executions that use NTFS shortnames, because that pattern is rare in normal user activity and appears in the malware chain described in the article.
Bottom line: Gootloader uses malformed ZIP archives to frustrate inspection while keeping Windows execution paths intact.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:20 pm
Malformed delivery containers are now an operational control problem, not just a file-format curiosity. The value of the ZIP abuse is not that it is technically exotic, but that it creates a gap between user execution and machine inspection. Defenders who treat archive parsing as a solved preprocessing step miss the fact that malformed structure can be a deliberate anti-analysis layer. The practical conclusion is to govern delivery paths, not only payloads.
A question worth separating out:
Q: How should teams respond when a user opens a malicious script from an archive?
A: Contain the endpoint, preserve the file and process lineage, and check whether the script created startup persistence or spawned PowerShell. The immediate question is whether the host executed only the initial script or already progressed into follow-on activity. That distinction determines whether the event is a blocked attempt or an active foothold.
👉 Read our full editorial: Gootloader’s malformed zip evasion shows where detection breaks