Quantcast
Channel: Malware – Didier Stevens
Viewing all articles
Browse latest Browse all 102

.ISO Files With Zone.Identifier

$
0
0

An .iso file downloaded from the Internet (thus with a Zone.Identifier ADS) opened in Windows 10 will not propagate this “mark-of-the-web” to the contained files.

Here is an example with file demo.iso, marked as downloaded from the Internet:

When this file is opened (double-clicked), it is mounted as a drive (E: in this example), and we see the content (a Word document: demo.docx):

This file is not marked as downloaded from the Internet:

Word does not open it in Protected View:



Viewing all articles
Browse latest Browse all 102

Trending Articles