diff --git a/cmd/malwareExecuteScan.go b/cmd/malwareExecuteScan.go
index 44ef855be..7fab5329e 100644
--- a/cmd/malwareExecuteScan.go
+++ b/cmd/malwareExecuteScan.go
@@ -150,9 +150,10 @@ func selectAndPrepareFileForMalwareScan(config *malwareExecuteScanOptions, utils
 			ContainerRegistryUser:     config.ContainerRegistryUser,
 			ContainerRegistryPassword: config.ContainerRegistryPassword,
 			DockerConfigJSON:          config.DockerConfigJSON,
+			ImageFormat:               "tarball",
 		}
 
-		dClientOptions := piperDocker.ClientOptions{ImageName: saveImageOptions.ContainerImage, RegistryURL: saveImageOptions.ContainerRegistryURL, LocalPath: ""}
+		dClientOptions := piperDocker.ClientOptions{ImageName: saveImageOptions.ContainerImage, RegistryURL: saveImageOptions.ContainerRegistryURL, LocalPath: "", ImageFormat: saveImageOptions.ImageFormat}
 		dClient := utils.newDockerClient(dClientOptions)
 
 		tarFile, err := runContainerSaveImage(&saveImageOptions, &telemetry.CustomData{}, "./cache", "", dClient, utils)