Defender Scan Pipeline — Stage 7

Container Extraction

Recursive unpacking of 70+ archive, document & installer formats

0nUFS Handlers

25+Archive Formats

15PDF Config Flags

3AI/ML Formats

RTTI: .?AVIL_container@@ @ 0x10C7A778 • mpengine.dll

What Is Container Extraction?

Container extraction recognizes archive, document, and installer formats, then recursively extracts child objects so each one is scanned through the stages 2-13 (post-dispatch scan path).

This is one of three recursive feedback loops in the pipeline (alongside PE unpacking and script deobfuscation). A single malicious ZIP containing a macro-enabled Word doc can trigger hundreds of recursive scans.

// Key strings from mpengine.dll
"containertype"     @ 0x109E7CA8
"iscontainer"       @ 0x109E7EA0
"isincontainer"     @ 0x109E7EBC
"containertype=%s"  @ 0x10A54078
"unpack:%s"         @ 0x10A4B010

Recursive Architecture

ZIP archive (containertype=zip)

↓ extract children

OLE2 document (.doc) — stages 2-13 rescan

↓ extract VBA streams

VBA Macro code — sent to NScript (Stage 8)

↓ deobfuscate → detect

THREAT: Trojan:O97M/Downloader

70 nUFS Format Handlers

Discovered via string analysis: nUFS_* at addresses 0x10A14--- through 0x10B58---

Archives (18)

nUFS_zip nUFS_rar nUFS_rar5 nUFS_7z nUFS_cab nUFS_tar nUFS_cpio nUFS_ar nUFS_arj nUFS_arc nUFS_ace nUFS_zoo nUFS_sit nUFS_lh nUFS_bga nUFS_quantum nUFS_xar

Documents (5)

nUFS_ole2 nUFS_pdf nUFS_rtfn nUFS_mof nUFS_html

Email (7)

nUFS_mimen nUFS_tnef nUFS_pst nUFS_mbx nUFS_dbx nUFS_binhex nUFS_emb1

Installers (10)

nUFS_nsis nUFS_nsv1 nUFS_inno nUFS_wise nUFS_ishld nUFS_ishldnew nUFS_instcrea nUFS_AutoIT nUFS_nbinder nUFS_c2rdat

Disk Images (7)

nUFS_image nUFS_dmg nUFS_wim nUFS_udf nUFS_uefi nUFS_cf nUFS_fsd

AI/ML Models (3)

nUFS_onnx nUFS_gguf nUFS_pickle

Extraction Pipeline Flow

From magic-byte detection to recursive child scanning

Magic Byte ID

→

Set containertype

→

Depth Check

→

nUFS Dispatch

→

Enumerate Children

→

Recursive Scan

// Magic byte detection examples
PK\x03\x04     → ZIP    // nUFS_zip @ 0x10A2FBA0
\xD0\xCF\x11\xE0 → OLE2   // nUFS_ole2 @ 0x10A2B548
%PDF-         → PDF    // nUFS_pdf @ 0x10A28020
Rar!\x1A\x07  → RAR    // nUFS_rar @ 0x10A2CCA0
7z\xBC\xAF    → 7z     // nUFS_7z @ 0x10A153A8
MSCF          → CAB    // nUFS_cab @ 0x10A143B8
{\rtf         → RTF    // nUFS_rtfn @ 0x10A2786C
ITSF          → CHM    // nUFS_chm @ 0x10A2C8C8

// Recursive scan pseudocode
for child in handler.enumerate() {
    if item_count >= max_items { break; }
    if elapsed > time_limit {
        // "Expensive container..."
        //   @ 0x10A55050
        log_expensive();
        break;
    }
    let vfo = extract_to_vfo(child);
    set_attr(vfo, "isincontainer");
    queue_full_pipeline_scan(vfo,
        depth + 1);  // Stages 2-13
}

OLE2 & PDF Deep Parsing

Specialized sub-processors for the most weaponized document formats

OLE2 Compound Documents

Word OLE File (.doc) @ 0x10A52970

Excel OLE File (.xls) @ 0x10A5291C

PowerPoint OLE (.ppt) @ 0x10A52934

IlOLE File Generic @ 0x10A526A6

Parses FAT/DIFAT sector chains, enumerates directory entries, extracts VBA macro streams for NScript processing.

PDF Configuration Flags

PDF_ForceDeepScan       @ 0x10A27B7C
PDF_ScanAllStreams       @ 0x10A27BBC
PDF_DisableXFA           @ 0x10A27BDC
PDF_DisableXRefStreams   @ 0x10A27BEC
PDF_DisableObjectStreams @ 0x10A27C04
PDF_TrustLengthFields   @ 0x10A27C20
PDF_DecodeAllFilters    @ 0x10A27C88
PDF_DisableFilters      @ 0x10A27C74
PDF_NoOnAccessScanLimits@ 0x10A27C58
PDF_ScanSeparateScripts @ 0x10A27C38
PDF_IgnoreLengthField   @ 0x10A27B90
PDF_DisableDeepScan     @ 0x10A27BA8

Per-object logging: "PDF LOG object %d type %ls" @ 0x10A27E20

Resource Limits & Performance

DBVAR-controlled budgets prevent resource exhaustion from zip bombs and deep nesting

16Default Max Depth

0Default Max Items

256 MBMax Output Size

30sTime Budget

AMSI Shallow Mode

1Max Depth

50Max Items

10 MBMax Per-Item

amunpacker @ 0x109C7F34

Expensive Container Logging

// When time budget exceeded:
"Expensive container
 (Time=%llu, Limit=%llu,
  Type=%hs): %ls\n"
  @ 0x10A55050

// ETW event name:
"Engine.Perf.ExpensiveContainer"
  @ 0x10A54EB4

VFO System: Child Queuing

Extracted children enter the Virtual File Object queue with priority flags

vfo_add_buffer @ 0x1097EC78 — Add memory buffer as VFO

vfo_add_filechunk @ 0x1097EC88 — Add file region as VFO

ADD_VFO_PEPACKED @ 0x1097FB1C — Child is PE-packed

ADD_VFO_VOLATILE @ 0x1097FB30 — Data is temporary

ADD_VFO_LOW_PRIORITY @ 0x1097FB44 — Scan at low priority

ADD_VFO_TAKE_ACTION @ 0x1097FB00 — Act on parent if child detects

Priority Queues

svfohigh @ 0x109C7EE4
Executables, scripts, macro code

↓ scanned first

svfolow @ 0x109C7EE4
Data files, images, fonts

NID_CONTINUE_CONTAINER_SCAN_AFTER_DETECTION @ 0x10980FD8 — Continue scanning remaining children after a detection

RTTI Class Hierarchy

Container classes discovered via RTTI strings in the .data section

IL_container
  .?AVIL_container@@ @ 0x10C7A778
  |
  +-- lzstreamRAR
  |     .?AVlzstreamRAR@@ @ 0x10C79BAC
  |     +-- bitstreamRAR @ 0x10C7B008
  |     +-- UnpackFilter  @ 0x10C7D9C0
  |
  +-- RAR5::FileHeader  @ 0x10C85B40
  |     +-- RAR5::CryptHeader @ 0x10C85B20
  |
  +-- XZ helpers
  |     +-- Canceler       @ 0x10C91AD0
  |     +-- VfoWrapper     @ 0x10C91D50
  |     +-- XZReader       @ 0x10C91DB0
  |
  +-- nUFSP_replayablecontainer
        .?AVnUFSP_replayablecontainer@@
        @ 0x10C855F4

Key Design Patterns

Polymorphic Dispatch IL_container vtable provides Open/Close/HasNext/ExtractNext interface for all 70 format handlers

Boost PMR Allocator boost::container::pmr::memory_resource @ 0x10C80114 for efficient memory management

Trust Validation ValidateTrustPluginCAB @ 0x10C896EC allows signed CABs to bypass deep extraction

Installers & AI/ML Models

Specialized handlers for installer frameworks and emerging AI model formats

Installer Frameworks

NSIS nUFS_nsis @ 0x10A14E40 + nUFS_nsv1 @ 0x10A14EEC

Inno Setup nUFS_inno @ 0x10A151C4

InstallShield nUFS_ishld + nUFS_ishldnew @ 0x10A14D4C

AutoIT nUFS_AutoIT @ 0x10A14BB4

Wise / SFX nUFS_wise @ 0x10A15354 • (CABSfx) @ 0x1097EB78

AI/ML Model Scanning

nUFS_onnx @ 0x10A3AC90 — Open Neural Network Exchange models

nUFS_gguf @ 0x10A3ACE4 — GGUF format (llama.cpp LLM models)

nUFS_pickle @ 0x10A3B04C — Python pickle (arbitrary code execution risk)

These handlers indicate parser coverage for model-related formats; exact detection depth depends on loaded signatures and cloud intelligence.

Attributes & Cross-References

Container attributes flow into all downstream pipeline stages

Container Attributes

"containertype"   0x109E7CA8
"iscontainer"     0x109E7EA0
"isincontainer"   0x109E7EBC
"containerfile"   0x109D729C
"isappcontainer"  0x109855D8
"isincontaineros" 0x109C96C0

Flows Into (Downstream)

Stage 8 — NScript (VBA/JS from OLE2/PDF)

Stage 9 — BRUTE (BRUTE:PDF:Feature:)

Stage 10 — Lua scripts

Stage 11 — AAGG aggregation

Stage 3 — Static cascade (recursive)

Receives From (Upstream)

Stage 6 — Unpacked PE content

Stage 3 — containertype attribute

Stage 4 — File type metadata

DBVAR — Depth/item/size limits

AMSI — Shallow mode config

Stage 7 → Stage 2 (Recursive Full Pipeline) Each extracted child enters the pipeline at Stage 2 with scan_depth + 1

Container Extraction: Summary

0nUFS Format Handlers

25+Archive Formats

15PDF Config Flags

3AI/ML Model Parsers

10Installer Handlers

7Email Formats

7Disk Image Formats

16Max Nesting Depth

Container extraction is the recursive heart of the Defender pipeline. It peers inside archives, documents, installers, disk images, and AI model files to find threats hidden within nested structures. Each child is scanned through the stages 2-13 (post-dispatch scan path).

IL_container RTTI @ 0x10C7A778 • containertype @ 0x109E7CA8 • 70 nUFS_* handlers • mpengine.dll