Forest Global Training Partners

Cyber Risks · Cisco Talos

ClamAV vs. Content IQ Test, part 3

Summary: Cisco Talos published the third post in its ClamAV vs. Content IQ Test series, testing whether ClamAV detects a target string embedded in polymorphic files whose MD5 checksums are all different. ClamAV detected the string in a text file inside a polymorphic zip, in a text file buried several zip levels deep, and in a Flash (SWF) file inside a polymorphic zip using a feature still under testing and not in the latest stable release, but it failed on Test file 20's compiled executable until a new signature, TestSig2, added detection of the Unicode-encoded string.

What's compelling: The Flash detection required downloading the development release and uncommenting code in libclamav/scanners.c before compiling, so a stable-release deployment would not have caught that case. Test file 20 showed the same string slipping past a signature written for its ASCII form once it appeared Unicode-encoded in a compiled executable.

Read the original at Cisco Talos ↗

Topics
Malware
Related