The tool has not been tested on exploited files. Those should be detected, possibly even dumping the exploit code.