Real type ↔ extension
Recognises the format from magic bytes and compares it with the extension (handling aliases like jpeg/jpg).
Analysis
File analysis
The File analysis module assembles a file dossier reusing every engine in the app: real type, entropy, strings, executable headers, embedded signatures, fuzzy hash, YARA and C2PA Content Credentials.
What it does
What the File analysis module does
Shannon entropy
Global and per-block value (sparkline); flags already-compressed formats to avoid false alarms.
ASCII and UTF-16 strings
Extracts printable strings, including Windows-style UTF-16LE; URLs/emails/IPs highlighted.
Executable headers
PE/ELF/Mach-O: architecture, sections, imports; for PE also imphash and packer detection.
Fuzzy hash & hash-sets
ssdeep to find similar files and comparison against known hash-sets (NSRL-style lists).
YARA & C2PA
Applies YARA rules from an updatable endpoint and reads/validates C2PA Content Credentials.
Active content of attachments
What an attachment would do if you opened it, without opening it: VBA macros with their source and the procedures that run by themselves (PowerPoint included), Excel 4 macros, remote templates, DDE fields, embedded or linked objects, .lnk shortcuts (command, arguments, origin machine), HTML and SVG pages with forms, redirects and HTML smuggling, RTF with the Equation Editor, scripts with decoded PowerShell commands, files hidden in OneNote, encrypted documents, double extensions.
Technical facts only
Severity states the file's capability (“runs code when opened”), not an intent: no judgement of the text, no reputation. The addresses found are listed, never opened. The macro source matches olevba, the reference tool, character by character.
C2PA: signature and binding to the file
Besides the manifest signature, Probatio recomputes the file hash the manifest declares: a valid signature on a file modified after signing comes out as “does not match”. Cloud manifests included.
Internal structure of containers
For files that contain others — compressed wrappers, OLE documents, ZIP — the full tree of levels, with type, size, entropy, dates and SHA-256 of every element. For each embedded object it recognises the application that created it (for instance a CorelDRAW drawing inside an Outlook oledata.mso), extracts its metadata (author, dates, revision, program) and shows the previews found inside. An “Equation Native” disguised under another class, the Equation Editor exploit route, is a high finding.
EMF and WMF metafiles
EMF/WMF images, also compressed like the image001.emz Outlook attaches, are read record by record in the isolated process, without letting the system draw them: SETABORTPROC, printer escapes, colour profiles on network paths (NTLM leak), malformed records. The visible image is rebuilt from the embedded bitmaps, with its hash.
Reset
A button brings the module back to its initial state.
Step by step
How it works
- Open a file: Probatio detects the type and computes entropy on a sample.
- It extracts strings, executable headers, embedded signatures and ssdeep.
- On demand it checks hash-sets, applies YARA and analyses the C2PA manifest.
FAQ
Frequently asked questions
What does the file analysis detect?
Real type vs extension, entropy (global and per-block), ASCII/UTF-16 strings, executable headers, embedded signatures, ssdeep fuzzy hash, known hash-sets, YARA and C2PA.
Does Probatio validate the C2PA signature?
Yes: it decodes the manifest (JUMBF + CBOR) and cryptographically verifies the COSE signature (ES256/384, PS/RS256/384/512, EdDSA). It does not yet validate the chain up to a C2PA trust anchor.
Where do the YARA rules come from?
From an online endpoint configurable in Settings; the rules are downloaded, compiled and applied to the file locally.
Related modules