new file mode 100644

@@ -0,0 +1,89 @@

+# ClamAV File Types

+

+ClamAV maintains it's own file typing format and assigns these types using either:

+

+- Evaluation of a unique sequence of bytes at the start of a file (file type magic).

+- File type indicators when parsing container files.

+  - For example:

+    CL_TYPE_SCRIPT may be assigned to data contained in a PDF when the PDF indicates that a stream of bytes is "Javascript"

+- File type determination based on the names or characteristics contained within the file.

+  - For example:

+    CL_TYPE_OOXML_WORD may be assigned to a Zip file containing files with specific names.

+

+## CL_TYPE's

+

+ClamAV Types are prefixed with `CL_TYPE_`.  The following is an exhaustive list of all current CL_TYPE's.

+

+| CL_TYPE                | Description                                                                       |

+|------------------------|-----------------------------------------------------------------------------------|

+| `CL_TYPE_7Z`           | 7-Zip Archive                                                                     |

+| `CL_TYPE_7ZSFX`        | Self-Extracting 7-Zip Archive                                                     |

+| `CL_TYPE_APM`          | Disk Image - Apple Partition Map                                                  |

+| `CL_TYPE_ARJ`          | ARJ Archive                                                                       |

+| `CL_TYPE_ARJSFX`       | Self-Extracting ARJ Archive                                                       |

+| `CL_TYPE_AUTOIT`       | AutoIt Automation Executable                                                      |

+| `CL_TYPE_BINARY_DATA`  | binary data                                                                       |

+| `CL_TYPE_BINHEX`       | BinHex Macintosh 7-bit ASCII email attachment encoding                            |

+| `CL_TYPE_BZ`           | BZip Compressed File                                                              |

+| `CL_TYPE_CABSFX`       | Self-Extracting Microsoft CAB Archive                                             |

+| `CL_TYPE_CPIO_CRC`     | CPIO Archive (CRC)                                                                |

+| `CL_TYPE_CPIO_NEWC`    | CPIO Archive (NEWC)                                                               |

+| `CL_TYPE_CPIO_ODC`     | CPIO Archive (ODC)                                                                |

+| `CL_TYPE_CPIO_OLD`     | CPIO Archive (OLD, Little Endian or Big Endian)                                   |

+| `CL_TYPE_CRYPTFF`      | Files encrypted by CryptFF malware                                                |

+| `CL_TYPE_DMG`          | Apple DMG Archive                                                                 |

+| `CL_TYPE_ELF`          | ELF Executable (Linux/Unix program or library)                                    |

+| `CL_TYPE_GPT`          | Disk Image - GUID Partition Table                                                 |

+| `CL_TYPE_GRAPHICS`     | TIFF (Little Endian or Big Endian)                                                |

+| `CL_TYPE_GZ`           | GZip Compressed File                                                              |

+| `CL_TYPE_HTML_UTF16`   | Wide-Character / UTF16 encoded HTML                                               |

+| `CL_TYPE_HTML`         | HTML data                                                                         |

+| `CL_TYPE_HWP3`         | Hangul Word Processor (3.X)                                                       |

+| `CL_TYPE_HWPOLE2`      | Hangul Word Processor embedded OLE2                                               |

+| `CL_TYPE_INTERNAL`     | Internal properties                                                               |

+| `CL_TYPE_ISHIELD_MSI`  | Windows Install Shield MSI installer                                              |

+| `CL_TYPE_ISO9660`      | ISO 9660 file system for optical disc media                                       |

+| `CL_TYPE_JAVA`         | Java Class File                                                                   |

+| `CL_TYPE_LNK`          | Microsoft Windows Shortcut File                                                   |

+| `CL_TYPE_MACHO_UNIBIN` | Universal Binary/Java Bytecode                                                    |

+| `CL_TYPE_MACHO`        | Apple/NeXTSTEP Mach-O Executable file format                                      |

+| `CL_TYPE_MAIL`         | Email file                                                                        |

+| `CL_TYPE_MBR`          | Disk Image - Master Boot Record                                                   |

+| `CL_TYPE_MHTML`        | MHTML Saved Web Page                                                              |

+| `CL_TYPE_MSCAB`        | Microsoft CAB Archive                                                             |

+| `CL_TYPE_MSCHM`        | Microsoft CHM help archive                                                        |

+| `CL_TYPE_MSEXE`        | Microsoft EXE / DLL Executable file                                               |

+| `CL_TYPE_MSOLE2`       | Microsoft OLE2 Container file                                                     |

+| `CL_TYPE_MSSZDD`       | Microsoft Compressed EXE                                                          |

+| `CL_TYPE_NULSFT`       | NullSoft Scripted Installer program                                               |

+| `CL_TYPE_OLD_TAR`      | TAR archive (old)                                                                 |

+| `CL_TYPE_OOXML_HWP`    | Hangul Office Open Word Processor (5.X)                                           |

+| `CL_TYPE_OOXML_PPT`    | Microsoft Office Open XML PowerPoint                                              |

+| `CL_TYPE_OOXML_WORD`   | Microsoft Office Open Word 2007+                                                  |

+| `CL_TYPE_OOXML_XL`     | Microsoft Office Open Excel 2007+                                                 |

+| `CL_TYPE_PART_HFSPLUS` | Apple HFS+ partition                                                              |

+| `CL_TYPE_PDF`          | Adobe PDF document                                                                |

+| `CL_TYPE_POSIX_TAR`    | TAR archive                                                                       |

+| `CL_TYPE_PS`           | Postscript                                                                        |

+| `CL_TYPE_RAR`          | RAR Archive                                                                       |

+| `CL_TYPE_RARSFX`       | Self-Extracting RAR Archive                                                       |

+| `CL_TYPE_RIFF`         | Resource Interchange File Format container formatted file                         |

+| `CL_TYPE_RTF`          | Rich Text Format document                                                         |

+| `CL_TYPE_SCRENC`       | Files encrypted by ScrEnc malware                                                 |

+| `CL_TYPE_SCRIPT`       | Generic type for scripts that don't have their own type (Javascript, Python, etc) |

+| `CL_TYPE_SIS`          | Symbian OS Software Installation Script Archive                                   |

+| `CL_TYPE_SWF`          | Adobe Flash File (LZMA, Zlib, or uncompressed)                                    |

+| `CL_TYPE_TEXT_ASCII`   | ASCII text                                                                        |

+| `CL_TYPE_TEXT_UTF16BE` | UTF-16BE text                                                                     |

+| `CL_TYPE_TEXT_UTF16LE` | UTF-16LE text                                                                     |

+| `CL_TYPE_TEXT_UTF8`    | UTF-8 text                                                                        |

+| `CL_TYPE_TNEF`         | Microsoft Outlook & Exchange email attachment format                              |

+| `CL_TYPE_UUENCODED`    | UUEncoded (Unix-to-Unix) binary file (Unix email attachment format)               |

+| `CL_TYPE_XAR`          | XAR Archive                                                                       |

+| `CL_TYPE_XDP`          | Adobe XDP - Embedded PDF                                                          |

+| `CL_TYPE_XML_HWP`      | Hangul Word Processor XML (HWPML) Document                                        |

+| `CL_TYPE_XML_WORD`     | Microsoft Word 2003 XML Document                                                  |

+| `CL_TYPE_XML_XL`       | Microsoft Excel 2003 XML Document                                                 |

+| `CL_TYPE_XZ`           | XZ Archive                                                                        |

+| `CL_TYPE_ZIP`          | Zip Archive                                                                       |

+| `CL_TYPE_ZIPSFX`       | Self-Extracting Zip Archive                                                       |

@@ -21,14 +21,13 @@ Table of Contents

         - [Logical signatures](#logical-signatures)

         - [Subsignature Modifiers](#subsignature-modifiers)

     - [Special Subsignature Types](#special-subsignature-types)

-        - [Macro subsignatures (clamav-0.96) : `${min-max}MACROID$`](#macro-subsignatures-clamav-096--min-maxmacroid)

-        - [Byte Compare Subsignatures (clamav-0.101) : `subsigid_trigger(offset#byte_options#comparisons)`](#byte-compare-subsignatures-clamav-0101--subsigid_triggeroffsetbyte_optionscomparisons)

-        - [PCRE subsignatures (clamav-0.99) : `Trigger/PCRE/[Flags]`](#pcre-subsignatures-clamav-099--triggerpcreflags)

+        - [Macro subsignatures](#macro-subsignatures)

+        - [Byte Compare Subsignatures](#byte-compare-subsignatures)

+        - [PCRE subsignatures](#pcre-subsignatures)

     - [Icon signatures for PE files](#icon-signatures-for-pe-files)

     - [Signatures for Version Information metadata in PE files](#signatures-for-version-information-metadata-in-pe-files)

     - [Trusted and Revoked Certificates](#trusted-and-revoked-certificates)

     - [Signatures based on container metadata](#signatures-based-on-container-metadata)

-    - [Signatures based on ZIP/RAR metadata (obsolete)](#signatures-based-on-ziprar-metadata-obsolete)

     - [Whitelist databases](#whitelist-databases)

     - [Signature names](#signature-names)

     - [Using YARA rules in ClamAV](#using-yara-rules-in-clamav)

@@ -480,9 +479,17 @@ Keywords used in `TargetDescriptionBlock`:

 - `NumberOfSections`: Required number of sections in executable (range; 0.96)

-- `Container:CL_TYPE_*`: File type of the container which stores the scanned file. Specifying `CL_TYPE_ANY` matches on root objects only.

+- `Container:CL_TYPE_*`: File type of the container which stores the scanned file.

-- `Intermediates:CL_TYPE_*>CL_TYPE_*`: File types of intermediate containers which stores the scanned file. Specify 1-16 file types separated by ’`>`’ in top-down order (’`>`’ separator not needed for single file type), last type should be the immediate container for the malicious content. `CL_TYPE_ANY` can be used as a wildcard file type. (expr; 0.100.0)

+  Specifying `CL_TYPE_ANY` matches on root objects only (i.e. the target file is explicitely _not_ in a container). Chances slim that you would want to use `CL_TYPE_ANY` in a signature, because placing the malicious file in an archive will then prevent it from alerting.

+

+  Every ClamAV file type has the potential to be a container for additional files, although some are more likely than others. When a file is parsed and data in the file is identified to be scanned as a unique type, that parent file becomes a container the moment the embedded content is scanned. For a list of possible CL_TYPEs, refer to the [File Types Reference](ClamAV-File-Types.md).

+

+- `Intermediates:CL_TYPE_*>CL_TYPE_*`: Specify one or more layers of file types containing the scanned file. _This is an alternative to using `Container`._

+

+  You may specify up to 16 layers of file types separated by ’`>`’ in top-down order. Note that the ’`>`’ separator is not needed if you only specify a single container. The last type should be the immediate container containing the malicious file. Unlike with the `Container` option, `CL_TYPE_ANY` can be used as a wildcard file type. (expr; 0.100.0)

+

+  For a list of possible CL_TYPEs, refer to the [File Types Reference](ClamAV-File-Types.md).

 - `IconGroup1`: Icon group name 1 from .idb signature Required engine functionality (range; 0.96)

@@ -498,9 +505,13 @@ Modifiers for subexpressions:

 - `A>X`: If the SUB-EXPRESSION A refers to a single signature then this signature must get matched more than X times; if it refers to a (logical) block of signatures then this block must generate more than X matches (with any of its sigs).

-- `A>X,Y`: If the SUB-EXPRESSION A refers to a single signature then this signature must get matched more than X times; if it refers to a (logical) block of signatures then this block must generate more than X matches and at least Y different signatures must be matched.

+- `A>X,Y`: If the SUB-EXPRESSION A refers to a single signature then this signature must get matched more than X times; if it refers to a (logical) block of signatures then this block must generate more than X matches _and_ at least Y different signatures must be matched.

-- `A<X` and `A<X,Y` as above with the change of "more" to "less".

+- `A<X`: Just like `A>Z` above with the change of "more" to "less".

+

+  If the SUB-EXPRESSION A refers to a single signature then this signature must get matched less than X times; if it refers to a (logical) block of signatures then this block must generate less than X matches (with any of its sigs).

+

+- `A<X,Y`: Similar to `A>X,Y`. If the SUB-EXPRESSION A refers to a single signature then this signature must get matched less than X times; if it refers to a (logical) block of signatures then this block must generate less than X matches _and_ at least Y different signatures must be matched.

 Examples:

@@ -523,7 +534,7 @@ dcf43987e4f519d629b103375;SL+550:6300680065005c0046006900

 ### Subsignature Modifiers

 ClamAV (clamav-0.99) supports a number of additional subsignature

-modifiers for logical signatures. This is done by specifying ’::’

+modifiers for logical signatures. This is done by specifying `::`

 followed by a number of characters representing the desired options.

 Signatures using subsignature modifiers require `Engine:81-255` for

 backwards-compatibility.

@@ -563,7 +574,11 @@ clamav-wide-C0;Engine:81-255,Target:0;0&1;414141;68656c6c6f::iwfa

 ## Special Subsignature Types

-### Macro subsignatures (clamav-0.96) : <span class="nodecor">`${min-max}MACROID$`</span>

+### Macro subsignatures

+

+Introduced in ClamAV 0.96

+

+Format: `${min-max}MACROID$`

 Macro subsignatures are used to combine a number of existing extended

 signatures (`.ndb`) into a on-the-fly generated alternate string logical

@@ -599,7 +614,11 @@ to:

 - For more information and examples please see <https://bugzilla.clamav.net/show_bug.cgi?id=164>.

-### Byte Compare Subsignatures (clamav-0.101) : <span class="nodecor">`subsigid_trigger(offset#byte_options#comparisons)`</span>

+### Byte Compare Subsignatures

+

+Introduced in ClamAV 0.101

+

+Format: `subsigid_trigger(offset#byte_options#comparisons)`

 Byte compare subsignatures can be used to evaluate a numeric value at a given offset from the start of another (matched) subsignature within the same logical signature. These are executed after all other subsignatures within the logical subsignature are fired, with the exception of PCRE subsignatures. They can evaluate offsets only from a single referenced subsignature, and that subsignature must give a valid match for the evaluation to occur.

@@ -627,8 +646,11 @@ Byte compare subsignatures can be used to evaluate a numeric value at a given of

   - `Comparison_value` is a required field which must be a numeric hex or decimal value. If all other conditions are met, the byte compare subsig will evalutate the extracted byte sequence against this number based on the provided `comparison_symbol`.

+### PCRE subsignatures

-### PCRE subsignatures (clamav-0.99) : <span class="nodecor">`Trigger/PCRE/[Flags]`</span>

+Introduced in ClamAV 0.99

+

+Format: `Trigger/PCRE/[Flags]`

 PCRE subsignatures are used within a logical signature (`.ldb`) to specify regex matches that execute once triggered by a conditional based on preceding subsignatures. Signatures using PCRE subsignatures require `Engine:81-255` for backwards-compatibility.

@@ -827,7 +849,7 @@ where the corresponding fields are:

 - `VirusName:` Virus name to be displayed when signature matches

-- `ContainerType:` one of

+- `ContainerType:` The file type containing the target file.  For example:

   - `CL_TYPE_ZIP`,

   - `CL_TYPE_RAR`,

   - `CL_TYPE_ARJ`,

@@ -835,8 +857,10 @@ where the corresponding fields are:

   - `CL_TYPE_7Z`,

   - `CL_TYPE_MAIL`,

   - `CL_TYPE_(POSIX|OLD)_TAR`,

-  - `CL_TYPE_CPIO_(OLD|ODC|NEWC|CRC)` or

-  - `*` to match any of the container types listed here

+  - `CL_TYPE_CPIO_(OLD|ODC|NEWC|CRC)`

+

+  Use `*` as a wild card to indicate that container type may be any file type.

+  For a full list of ClamAV file types, see the [ClamAV File Types Reference](ClamAV-File-Types.md)

 - `ContainerSize:` size of the container file itself (eg. size of the zip archive) specified in bytes as absolute value or range `x-y`

@@ -846,48 +870,16 @@ where the corresponding fields are:

 - `FileSizeReal:` usually uncompressed size; for MAIL, TAR and CPIO == `FileSizeInContainer`; absolute value or range

-- `IsEncrypted`: 1 if the target file is encrypted, 0 if it’s not and `*` to ignore

+- `IsEncrypted:` 1 if the target file is encrypted, 0 if it’s not and `*` to ignore

-- `FilePos`: file position in container (counting from 1); absolute value or range

+- `FilePos:` file position in container (counting from 1); absolute value or range

-- `Res1`: when `ContainerType` is `CL_TYPE_ZIP` or `CL_TYPE_RAR` this field is treated as a CRC sum of the target file specified in hexadecimal format; for other container types it’s ignored

+- `Res1:` when `ContainerType` is `CL_TYPE_ZIP` or `CL_TYPE_RAR` this field is treated as a CRC sum of the target file specified in hexadecimal format; for other container types it’s ignored

-- `Res2`: not used as of ClamAV 0.96

+- `Res2:` not used as of ClamAV 0.96

 The signatures for container files are stored inside `.cdb` files.

-## Signatures based on ZIP/RAR metadata (obsolete)

-

-The (now obsolete) archive metadata signatures can be only applied to

-ZIP and RAR files and have the following format:

-

-```

-    virname:encrypted:filename:normal size:csize:crc32:cmethod:

-    fileno:max depth

-```

-

-where the corresponding fields are:

-

-- Virus name

-

-- Encryption flag (1 – encrypted, 0 – not encrypted)

-

-- File name (this is a regular expression - \* to ignore)

-

-- Normal (uncompressed) size (\* to ignore)

-

-- Compressed size (\* to ignore)

-

-- CRC32 (\* to ignore)

-

-- Compression method (\* to ignore)

-

-- File position in archive (\* to ignore)

-

-- Maximum number of nested archives (\* to ignore)

-

-The database file should have the extension of `.zmd` or `.rmd` for zip or rar metadata respectively.

-

 ## Whitelist databases

 To whitelist a specific file use the MD5 signature format and place it inside a database file with the extension of `.fp`. To whitelist a specific file with the SHA1 or SHA256 file hash signature format, place the signature inside a database file with the extension of `.sfp`. To whitelist a specific signature from the database you just add its name into a local file called local.ign2 stored inside the database directory. You can additionally follow the signature name with the MD5 of the entire database entry for this signature, eg:

@@ -1263,7 +1263,7 @@ int32_t json_get_int(int32_t objid);

 //double json_get_double(int32_t objid);

 /* ----------------- END 0.98.4 APIs ---------------------------------- */

-/* ----------------- BEGIN 0.100.0 APIs ------------------------------- */

+/* ----------------- BEGIN 0.101.0 APIs ------------------------------- */

 /* ----------------- Scan Options APIs -------------------------------- */

 /**

 \group_engine