How do I scan encrypted archives, Office documents, and PDFs?

Saferwall can try passwords while scanning encrypted ZIP, RAR, and 7-Zip archives; password-protected Office documents (.docx, .xlsx, .pptx, .doc, and .xls); and encrypted PDFs. It also tries the common passwords configured by the platform operator. Supplying the expected password is still the most reliable approach.

Why does an encrypted archive parent have no scan results?

When an encrypted archive is decrypted successfully, Saferwall deliberately skips downstream antivirus and sandbox scanning for the encrypted parent container. The static service still identifies the parent, records its metadata and decryption status, links its derived files, and marks its processing as finished. It then enrolls every unique extracted file as a child sample and scans those children independently.

This means an encrypted archive parent can correctly show no MultiAV or behavior results even though the scan completed successfully. Open Derived files in the parent report and review the verdict for each extracted child. A Finished or Benign state on the parent describes the handled container; it is not a verdict that the archive's contents are benign.

Office documents and PDFs currently behave differently. Their encrypted parent is still sent to MultiAV, while successfully decrypted content is enrolled and scanned as a separate derived file. Sandbox analysis continues to depend on the file type and selected scan options.

Scan from the website

1. Sign in and select or drop the encrypted file on the upload page.
2. In Configure scan, enter a candidate in the Password field. Use Add another password for additional candidates.
3. Select Start scan. If the file already exists, select Create new scan first so you can provide new passwords.

The API accepts at most 10 candidate passwords per request.

Scan through the API

Send each password as a repeated passwords field in the multipart upload:

curl --request POST "https://api.saferwall.com/v1/files/" \
  --header "Authorization: Bearer ${SAFERWALL_TOKEN}" \
  --form "file=@./locked.zip" \
  --form "passwords=infected" \
  --form "passwords=another-password"

See Submit a new file for scanning for the complete request. To try different passwords for an existing sample, use Rescan an existing file and include a JSON passwords array.

Interpret the result

When a password succeeds, the parent report lists the decrypted document or extracted archive members under Derived files. Each child has its own report and links back to the encrypted original.

Useful API fields include:

Field	Meaning
encrypted	The uploaded file requires a password.
decryption_success	At least one candidate unlocked the content.
derived_files	Decrypted or extracted samples created from the upload.
parent_sha256	The encrypted parent associated with a derived sample.

If decryption fails, verify the password and rescan with other candidates. A report for the encrypted parent does not mean its protected contents were inspected. Malformed files, unsupported encryption methods, or deployment extraction limits can also prevent complete processing; contact the platform operator when a known-good password still fails.