Generating Virus Signatures - The Automated Way
Summary: Cisco Talos describes pe-sig, a Ruby tool that uses the PE parsing and signature library from Metasploit 3 to automatically generate PE section signatures for known PE packers suitable for loading into ClamAV. When run against a file packed with pklite, pe-sig produced output very similar to a signature released in mid-2008, and for unpacked or unrecognized packers it outputs all sections of the PE file.
Key Takeaway: Analysts who must hand-write signatures for each new packer crossing their desk can instead record once where a packer stores its data, such as .rsrc, and reuse that knowledge the next time the same packer appears.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026