[Tool] Magic Extractor — identify and unpack unknown files, installers and embedded payloads on Windows

I wanted a Windows-friendly alternative to tools such as Binwalk and UniExtract, focused on identifying unknown files and automatically choosing the appropriate extraction method.

That idea eventually became Magic Extractor, an open-source utility intended to help with static triage and the initial unpacking of suspicious samples.

It can be useful for:

• Identifying files whose extension is missing or misleading
• Unpacking installers, SFX archives and uncommon compression formats
• Extracting nested archives recursively
• Listing contents without extraction
• Carving archives and payloads embedded at arbitrary offsets
• Trying multiple handlers when detection is ambiguous

Detection combines PureMagic, custom magic signatures, Detect It Easy, Binwalk and Magika. The detected type is then routed to the appropriate bundled extractor.

Example:

magic-extractor identify suspicious.bin

magic-extractor extract suspicious.bin --recursive

magic-extractor carve firmware.bin --list

It currently supports more than 80 formats, including archives, installers, disk images, forensic images and embedded content.

This is not a malware detector, sandbox or replacement for dynamic analysis. It is mainly intended as a supporting tool for file identification, unpacking and static analysis workflows.

GitHub:

https://github.com/xchwarze/magic-extractor

Feedback from malware analysts and reverse engineers would be especially useful, particularly regarding formats, packers or installers that are currently difficult to extract.

As always, suspicious files should only be handled inside an isolated analysis environment.