mirror of
https://github.com/Cisco-Talos/clamav.git
synced 2025-10-29 15:14:14 +00:00
44 lines
1.8 KiB
Markdown
44 lines
1.8 KiB
Markdown
# Signatures based on container metadata
|
||
|
||
ClamAV 0.96 allows creating generic signatures matching files stored inside different container types which meet specific conditions. The signature format is:
|
||
|
||
```
|
||
VirusName:ContainerType:ContainerSize:FileNameREGEX:
|
||
FileSizeInContainer:FileSizeReal:IsEncrypted:FilePos:
|
||
Res1:Res2[:MinFL[:MaxFL]]
|
||
```
|
||
|
||
where the corresponding fields are:
|
||
|
||
- `VirusName:` Virus name to be displayed when signature matches.
|
||
|
||
- `ContainerType:` The file type containing the target file. For example:
|
||
- `CL_TYPE_ZIP`,
|
||
- `CL_TYPE_RAR`,
|
||
- `CL_TYPE_ARJ`,
|
||
- `CL_TYPE_MSCAB`,
|
||
- `CL_TYPE_7Z`,
|
||
- `CL_TYPE_MAIL`,
|
||
- `CL_TYPE_(POSIX|OLD)_TAR`,
|
||
- `CL_TYPE_CPIO_(OLD|ODC|NEWC|CRC)`
|
||
|
||
Use `*` as a wild card to indicate that container type may be any file type.
|
||
For a full list of ClamAV file types, see the [ClamAV File Types Reference](ClamAVFileTypes.md).
|
||
|
||
- `ContainerSize:` size of the container file itself (eg. size of the zip archive) specified in bytes as absolute value or range `x-y`.
|
||
|
||
- `FileNameREGEX:` regular expression describing name of the target file
|
||
|
||
- `FileSizeInContainer:` usually compressed size; for MAIL, TAR and CPIO == `FileSizeReal`; specified in bytes as absolute value or range.
|
||
|
||
- `FileSizeReal:` usually uncompressed size; for MAIL, TAR and CPIO == `FileSizeInContainer`; absolute value or range.
|
||
|
||
- `IsEncrypted:` 1 if the target file is encrypted, 0 if it’s not and `*` to ignore
|
||
|
||
- `FilePos:` file position in container (counting from 1); absolute value or range.
|
||
|
||
- `Res1:` when `ContainerType` is `CL_TYPE_ZIP` or `CL_TYPE_RAR` this field is treated as a CRC sum of the target file specified in hexadecimal format; for other container types it’s ignored.
|
||
|
||
- `Res2:` not used as of ClamAV 0.96.
|
||
|
||
The signatures for container files are stored inside `.cdb` files.
|