1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
|
#------------------------------------------------------------------------------
# $File: fsav,v 1.22 2021/04/26 15:56:00 christos Exp $
# fsav: file(1) magic for datafellows fsav virus definition files
# Anthon van der Neut (anthon@mnt.org)
# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
0 beshort 0x1575 fsav macro virus signatures
>8 leshort >0 (%d-
>11 byte >0 \b%02d-
>10 byte >0 \b%02d)
# ftp://ftp.f-prot.com/pub/sign.zip
#10 ubyte <12
#>9 ubyte <32
#>>8 ubyte 0x0a
#>>>12 ubyte 0x07
#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d-
#>>>>10 byte 0 \b01-
#>>>>10 byte 1 \b02-
#>>>>10 byte 2 \b03-
#>>>>10 byte 3 \b04-
#>>>>10 byte 4 \b05-
#>>>>10 byte 5 \b06-
#>>>>10 byte 6 \b07-
#>>>>10 byte 7 \b08-
#>>>>10 byte 8 \b09-
#>>>>10 byte 9 \b10-
#>>>>10 byte 10 \b11-
#>>>>10 byte 11 \b12-
#>>>>9 ubyte >0 \b%02d)
# ftp://ftp.f-prot.com/pub/sign2.zip
#0 ubyte 0x62
#>1 ubyte 0xF5
#>>2 ubyte 0x1
#>>>3 ubyte 0x1
#>>>>4 ubyte 0x0e
#>>>>>13 ubyte >0 fsav virus signatures
#>>>>>>11 ubyte x size %#02x
#>>>>>>12 ubyte x \b%02x
#>>>>>>13 ubyte x \b%02x bytes
# Joerg Jenderek: joerg dot jenderek at web dot de
# clamav-0.100.2\docs\html\node60.html
# https://github.com/vrtadmin/clamav-faq/raw/master/manual/clamdoc.pdf
# ClamAV virus database files start with a 512 bytes colon separated header
# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
# + gzipped (optional) tarball files
# output can often be verified by `sigtool --info=FILE`
0 string ClamAV-VDB: Clam AntiVirus
# padding spaces implies database
>511 ubyte =0x20 database
!:mime application/x-clamav-database
# empty build time
>>10 string =:: (unsigned)
# sigtool(1) man page
!:ext cud
# display some text to avoid error like:
# Magdir/fsav, 78: Warning: Current entry does not yet have a description for adding a EXTENSION type
# file: could not find any valid magic files! (No error)
>>10 default x (with buildtime)
#>>10 default x
# clamtmp is used for temporarily database like update process
# for pure tar database only cld extension found
!:ext cld/cvd/clamtmp/cud
>511 default x file
!:mime application/x-clamav
!:ext info
>11 string >\0
# buildDate empty or like "22 Mar 2017 12-57 -0400"; verified by `sigtool -i FILE`
>>11 regex \^[^:]{0,23} \b, %s
# version like 25170
>>>&1 regex \^[^:]{1,6} \b, version %s
# signaturesNumbers like 4566249
>>>>&1 regex \^[^:]{1,10} \b, %s signatures
# functionalityLevelRequired like 60
>>>>>&1 regex \^[^:]{1,4} \b, level %s
# X for nothing or MD5
#>>>>>>&1 regex \^[^:]{1,32} \b, MD5 "%s"
>>>>>>&1 regex \^[^:]{1,32}
# X for nothing or digital signature starting like AIzk/LYbX
#>>>>>>>&1 regex \^[^:]{1,255} \b, signature "%s"
>>>>>>>&1 regex \^[^:]{1,255}
# builder like neo
>>>>>>>>&1 regex \^[^:]{1,32} \b, builder %s
# buildTime like 1506611558
#>>>>>>>>>&1 regex \^[^:]{1,10} \b, %s
>>>>>>>>>&1 regex \^[^:]{1,10}
# padding with spaces
#>>>>>>>>>>&1 ubequad x \b, padding %#16.16llx
>510 ubyte =0x20
# inspect real database content
#>>512 ubeshort x \b, database MAGIC %#x
# ./archive handle pure tar archives
>>1012 quad =0 \b, with
>>>512 use tar-file
# not pure tar
>>1012 quad !0
# one space at the end of text and then handles gzipped archives by ./compress
>>>512 string \037\213 \b, with
>>>>512 indirect x
# Type: Grisoft AVG AntiVirus
# From: David Newgas <david@newgas.net>
0 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data
0 string X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR
>33 string -STANDARD-ANTIVIRUS-TEST-FILE!$H+H* EICAR virus test files
# From: Joerg Jenderek
# URL: https://www.avira.com/
# Note: found in directory %ProgramData%\Avira\Antivirus\INFECTED (Windows)
# tested with version 15.0.43.23 at November 2019
0 string AntiVir\ Qua Avira AntiVir quarantined
!:mime application/x-avira-qua
#!:mime application/octet-stream
!:ext qua
>156 string SUSPICIOUS_FILE
# file path of suspicious file
>>220 lestring16 x %s
>156 string !SUSPICIOUS_FILE
# file path of virus file
>>228 lestring16 x %s
# quarantined date
>60 ldate x at %s
# virus/danger name
>156 string !SUSPICIOUS_FILE
>>156 string x \b, category "%s"
|
