SquashFS Format Package

We are happy to announce support for the SquashFS file system format. The new SquashFS Format package lets you browse and extract files from SquashFS images directly within the application.

SquashFS is a compressed, read-only file system widely used in Linux distributions, embedded devices, firmware images, container technologies, and snap/AppImage application packages. It supports multiple compression algorithms and is designed for high compression ratios with fast random access. Having native support in Cerbero Suite means analysts can inspect SquashFS images encountered during firmware analysis, malware triage, or forensic investigations without needing external tools.

XFA Interactive Form Inspection

The upcoming 0.9.2 version of the Profiler introduces detection of Acro/XFA interactive forms inside PDFs. This technology has been abused numerous times (some recent cases come to mind), so it is now being reported as a potential threat.

The video below shows the inspection of a XFA Interactive Form and how to load a base64-encoded GIF image embedded in it.

Stay tuned!