# extracting and submitting files - malware analysis **URL:** \ **Category:** Zeek\ **Created:** [September 1, 2016, 7:44am UTC](https://community.zeek.org/t/extracting-and-submitting-files-malware-analysis/4320 "2016-09-01T07:44:06Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![clautos](https://avatars.discourse-cdn.com/v4/letter/c/f04885/32.png) [@clautos](https://community.zeek.org/u/clautos)\ **Post date:** [September 1, 2016, 7:44am UTC](https://community.zeek.org/t/extracting-and-submitting-files-malware-analysis/4320/1 "2016-09-01T07:44:06Z")
Hello, I’ve just installed a security onion (the last release in date) for testing purposes and I’m trying to extract files plus scan them with virustotal or any other engine in an automated way. I’ve seen the script detect-MHR.bro that seems appropriate for that. I’ve downloaded a pcap containing some adult websites samples including malware executables downloaded by the client. I’ve ran the command bro -r ~/Downloads/zeus-sample-1.pcap /opt/bro/share/bro/policy/frameworks/files/extract-all-files.bro Everything fine, I have the malware sample but when I run the command bro -r ~/Downloads/zeus-sample-1.pcap /opt/bro/share/bro/policy/frameworks/files/hash-all-files.bro I get no output, same for the command detect-MHR. So my questions are : Did I miss something ? Was the output sent somewhere else than the current repository ? (btw the executable is flagged red by almost 50 antivirus engines on VirusTotal) Is there any better solution for automated malware samples in files detection ? Thanks for your reply ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/extracting-and-submitting-files-malware-analysis/4320/2 "2022-05-06T15:43:59Z")