EVOLUTION-MANAGER
Edit File: HashSignatures.html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta http-equiv="Content-Style-Type" content="text/css" /> <meta name="generator" content="pandoc" /> <title></title> <style type="text/css">code{white-space: pre;}</style> <link rel="stylesheet" href="/en/github.css" type="text/css" /> </head> <body> <h1 id="file-hash-signatures">File hash signatures</h1> <p>The easiest way to create signatures for ClamAV is to use filehash checksums, however this method can be only used against static malware.</p> <hr /> <h2 id="md5-hash-based-signatures">MD5 hash-based signatures</h2> <p>To create a MD5 signature for <code>test.exe</code> use the <code>--md5</code> option of<br /> sigtool:</p> <pre> zolw@localhost:/tmp/test$ sigtool --md5 test.exe > test.hdb zolw@localhost:/tmp/test$ cat test.hdb 48c4533230e1ae1c118c741c0db19dfb:17387:test.exe </pre> <p>That’s it! The signature is ready for use:</p> <pre> zolw@localhost:/tmp/test$ clamscan -d test.hdb test.exe test.exe: test.exe FOUND ----------- SCAN SUMMARY ----------- Known viruses: 1 Scanned directories: 0 Engine version: 0.92.1 Scanned files: 1 Infected files: 1 Data scanned: 0.02 MB Time: 0.024 sec (0 m 0 s) </pre> <p>You can change the name (by default sigtool uses the name of the file) and place it inside a <code>*.hdb</code> file. A single database file can include any number of signatures. To get them automatically loaded each time <code>clamscan</code>/<code>clamd</code> starts just copy the database file(s) into the local virus database directory (eg. <code>/usr/local/share/clamav</code>).</p> <p><em>The hash-based signatures shall not be used for text files, HTML and any other data that gets internally preprocessed before pattern matching. If you really want to use a hash signature in such a case, run <code>clamscan</code> with <code>--debug</code> and <code>--leave-temps</code> flags as described above and create a signature for a preprocessed file left in <code>/tmp</code>. Please keep in mind that a hash signature will stop matching as soon as a single byte changes in the target file.</em></p> <hr /> <h2 id="sha1-and-sha256-hash-based-signatures">SHA1 and SHA256 hash-based signatures</h2> <p>ClamAV 0.98 has also added support for SHA1 and SHA256 file checksums. The format is the same as for MD5 file checksum. It can differentiate between them based on the length of the hash string in the signature. For best backwards compatibility, these should be placed inside a <code>*.hsb</code> file. The format is:</p> <pre> HashString:FileSize:MalwareName </pre> <hr /> <h2 id="hash-signatures-with-unknown-size">Hash signatures with unknown size</h2> <p>ClamAV 0.98 has also added support for hash signatures where the size is not known but the hash is. It is much more performance-efficient to use signatures with specific sizes, so be cautious when using this feature. For these cases, the ’*’ character can be used in the size field. To ensure proper backwards compatibility with older versions of ClamAV, these signatures must have a minimum functional level of 73 or higher. Signatures that use the wildcard size without this level set will be rejected as malformed.</p> <p>Sample .hsb signature matching any size:<br /> <pre><br /> HashString:<em>:MalwareName:73<br /> </pre><br /> Sample .msb signature matching any size:<br /> <pre><br /> </em>:PESectionHash:MalwareName:73<br /> </pre></p> <hr /> <h2 id="pe-section-based-hash-signatures">PE section based hash signatures</h2> <p>You can create a hash signature for a specific section in a PE file. Such signatures shall be stored inside <code>.mdb</code> (MD5) and <code>.msb</code> files in the following format:</p> <pre> PESectionSize:PESectionHash:MalwareName </pre> <p>The easiest way to generate MD5 based section signatures is to extract target PE sections into separate files and then run sigtool with the option <code>--mdb</code></p> <p>ClamAV 0.98 has also added support for SHA1 and SHA256 section based signatures. The format is the same as for MD5 PE section based signatures. It can differentiate between them based on the length of the hash string in the signature. For best backwards compatibility, these should be placed inside a <code>*.msb</code> file.</p> </body> </html>