topic Re: Wildfire cannot test some Word docs - unsupported file type in General Topics

Wildfire cannot test some Word docs - unsupported file type

SDorsey — Mon, 18 May 2015 17:13:32 GMT

Greetings all!

I have discovered WF is not able to test some Word docs; it gives the following error:

Unsupported file type: HTML document, ASCII text, with CRLF line terminators

However, I am able to open these Word docs within a VM. They contain malicious macros and they are in tact. Has anyone else run into this? I haven't dug deeply yet but am wondering if they are altering the format as a method of sandbox evasion.

Re: Wildfire cannot test some Word docs - unsupported file type

SDorsey — Mon, 18 May 2015 17:29:33 GMT

Upon inspecting the Word docs within a text editor, the formatting is for sure way different.

Re: Wildfire cannot test some Word docs - unsupported file type

mivaldi — Mon, 18 May 2015 17:51:41 GMT

When we look at a file, we don't pay attention to the filename's extension.

A .doc file does not make it a Microsoft Office Document.

The file you have is an HTML file that was renamed to have a .doc extension.

We support Microsoft Office Documents, but don't currently support HTML files.

Re: Wildfire cannot test some Word docs - unsupported file type

SDorsey — Wed, 27 May 2015 15:14:38 GMT

mivaldi - just curious. Are there plans to add support for HTML docs? The number of these I am seeing are rather high on a daily basis.

Re: Wildfire cannot test some Word docs - unsupported file type

mivaldi — Wed, 27 May 2015 15:51:20 GMT

I couldn't find any Feature Request on record to support HTML files. The best way to request these be supported is to file an FR through the Palo Alto Networks SE. If you didn't know who your SE was, please contact your sales representative or Support to find who the right contact for your account is.