← All detection heuristics · HWP
info
HWP_STREAM_RAW_FALLBACK
What it means
A payload-bearing stream did not inflate as raw DEFLATE and was scanned in its original form.
Why it fires
HWP's document-level compressed flag does not guarantee every BinData stream is compressed; images may remain raw. This coverage note distinguishes a safe raw-byte fallback from a skipped stream.
Other HWP heuristics
HWP_EMBEDDED_PE HWP_PE_MSHTA_REMOTE_EXEC HWP_OLE_PACKAGE_EXECUTABLE HWP_OLE_CLICK_TO_EXEC_LURE HWP_PS_EXEC HWP_PS_CVX_EXEC HWP_PS_SYSTEM HWP_SHELL_CMD HWP_POSTSCRIPT HWP_PS_HEXCODE HWP_JAVASCRIPT HWP_PS_FILE HWP_URL HWP_PS_FILTER HWP_SCRIPTS_STREAM HWP_BINDATA HWP_COMPRESSED HWP_SEMANTIC_FINGERPRINT