ClamAV vs. Content IQ Test, part 1
Summary: Cisco Talos ran ClamAV against the Content IQ Test, a set of benign files that hide a target string at varying depths, and found the scanner caught most of them by treating Office Open XML, PDF and archive files as containers to extract and inspect. It failed on Test file 4, a PowerPoint 2011 document, until the signature was rewritten to alert on "eval" followed by "unescape" within 200 bytes, then followed by "('%65%76%69%6c%28%29'))" within another 200 bytes.
Why it matters: A signature tuned to normalized ASCII text passed the plain text, Word, Excel and PDF cases but missed the same string inside a pptx - the detection gap sat in how the file was parsed, not in what the string said.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026