It appears to hash the file locally, then look it up on a number of aggregators (or local scanner such as clamav), see: https://github.com/pandora-analysis/pand

It appears to hash the file locally, then look it up on a number of aggregators (or local scanner such as clamav), see: https://github.com/pandora-analysis/pandora/tree/main/pandora/workers https://github.com/pandora-analysis/pandora/tree/main/pandor... for list. For example, check the "usual" sites like virustotal immediately, and do local inspection into embedded document objects. You will need to be subscribed to those services that are not free and have API keys for each one. There are some modules that also analyse the MSOffice XML format for bad code, that check OLE (don't know what is OLE? https://threatpost.com/like-macros-before-it-attackers-shifting-to-ole-to-spread-malware/118706/ https://threatpost.com/like-macros-before-it-attackers-shift...) and macro deobfuscators. CIRCL is the Luxembourg CERT, more or less.