CHM

Supported formats

CHM (Microsoft Compiled HTML Help)

Description

Microsoft Compiled HTML Help (CHM) is a Microsoft help file format used to package HTML-based documentation, including text, images, links, and navigation, into a single, compressed file. CHM files can be viewed using the built-in Windows Help viewer and are commonly used for software documentation, user manuals, and technical reference materials. Because CHM files can contain active HTML elements and references to external or local resources, attackers may use them in phishing campaigns or as part of malware delivery and execution chains.

info

Available in Contextal Platform 3.0 and later.

Features

Both verbatim and LZX compressed files are supported.

Symbols

Object

• LIMITS_REACHED → limits triggered while processing the archive

Children

• CORRUPTED → this child object was not extracted due to data corruption
• TOOBIG → this child object was not extracted as it exceeds the limits

Example Metadata

{
  "object_id": "a32e2d400bb7feb63d29738d6a31959228530974fe928b9c48787fadaf17d8a0",
  "object_type": "CHM",
  "object_subtype": null,
  "recursion_level": 1,
  "size": 16311,
  "hashes": {
    "sha256": "a32e2d400bb7feb63d29738d6a31959228530974fe928b9c48787fadaf17d8a0",
    "sha1": "72638ffd88f29055f279c440b51f7d68419f68f7",
    "md5": "4b44eacbfe8299deb2c952ae5776c8c6",
    "sha512": "a2024bbde1cdafd3bcba1a4a7001580a3e6e51fd697cda7f0db5b8dda6fa5df4362274c8f3a6a595e0865395e7e71655f9d4eb3b6b128d9661f3262cff423605"
  },
  "ctime": 1789743791.708997,
  "entropy": 5.157267478094528,
  "patterns": [],
  "relation_metadata": {
    "name": "a32e2d400bb7feb63d29738d6a31959228530974fe928b9c48787fadaf17d8a0.chm"
  },
  "ok": {
    "symbols": [],
    "object_metadata": {
      "_backend_version": "3.0.0",
      "entry_count": 20
    },
    "children": [
      {
        "object_id": "e392252cf7a82507d2e8313073f10817b40f3151fc19703d3deb7975dc718f28",
        "object_type": "HTML",
        "object_subtype": null,
        "recursion_level": 2,
        "size": 6775,
        "hashes": {
          "md5": "0486db1daf7956ba936ded880845285b",
          "sha256": "e392252cf7a82507d2e8313073f10817b40f3151fc19703d3deb7975dc718f28",
          "sha512": "27dad646bedc5d1b34846b11131e23c5f2fd7b8f853a460b5af4eba02e18820298d0f65ed22104053c076fdb9f064078ccdad92a5f09b306c59c3ca5c9f2c22a",
          "sha1": "1a03e3263172e7ae4a6b525d3970919357fcffdb"
        },
        "ctime": 1789743791.708997,
        "entropy": 5.39874778006348,
        "patterns": [
          "5333220e046f24815397b949d6085ee9",
          "9e1223dbd86814823bba4ce2b9dbbfce",
          "d19a2d95e53c9fb6f9d29a1d654ad8d2"
        ],
        "relation_metadata": {
          "entry_length": 6775,
          "name": "/page_1.html"
        },
        "ok": {
          "symbols": [
            "SCRIPT_LOLBIN"
          ],
          "object_metadata": {
            "_backend_version": "3.0.0",
            "embed_src": [],
            "encoding": "utf-8",
            "forms": [],
            "hidden_active_content": false,
            "img_data_src": [],
            "img_src": [],
            "input_types": [],
            "lang": "en",
            "objects": [],
            "script_stats": {
              "count": 1,
              "external_count": 0,
              "inline_count": 1,
              "max_size": 905,
              "total_size": 905
            },
            "script_urls": [],
            "scripts": [],
            "tag_count": 77,
            "tag_counters": {
              "button": 1,
              "code": 4,
              "div": 5,
              "h1": 1,
              "li": 27,
              "meta": 2,
              "ol": 1,
              "p": 11,
              "pre": 1,
              "script": 1,
              "strong": 17,
              "style": 1,
              "title": 1,
              "ul": 4
            },
            "unique_domains": [],
            "unique_hosts": [],
            "uris": []
          },
[...]

Configuration Options

• max_processed_size → maximum size of the input object that will be processed (default: 262144000)
• max_children → maximum number of children objects to create (default: 100)
• max_child_input_size → maximum size of a single input children object (default: 41943040)
• max_child_output_size → maximum size of a single output children object (default: 41943040)