A question about remove suffix

[malicialab]

A question about remove suffix

[malicialab]

Suffix removal needs to balance the amount of noise it removes with the data that may be lost. There is no perfect solution, we try to achieve a balance. More concretely, keeping the whole suffix would introduce quite a bit of noise in the results. Of course, you can comment out suffix removal in your local copy and see if you prefer the results that way.

If you have any specific AV engine(s) that you think we are dropping important information in the suffixes, feel free to open an issue. But, you will need to provide the name(s) of the AV engine(s) and as many examples (hashes) as possible where the problem manifests. In other words, it needs to be specific enough so that we can take a look.