ClamAV vs. Content IQ Test, part 2
Summary: Cisco Talos tested ClamAV against files carrying a target string in auto-executing embedded content, and the scanner alerted on test files 10, 11, 13, 14, 15 and 16 by parsing PDF objects, extracting ZIP contents, and pulling Flash files out of Excel, PowerPoint and PDF containers. Test file 12, an auto-executing Flash file, did not alert until the signature's target type was changed from 7 to 0 so the code was no longer treated as ASCII normalized text, and that detection required a development release with a scanners.c change rather than the latest stable build.
What's compelling: Detection here depended on ClamAV unpacking each layer - ZIP, then Excel, then Flash, then ActionScript - and on a signature tweak that only worked in a development build, so a scanner that stops at the container sees nothing.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026