-
-
Notifications
You must be signed in to change notification settings - Fork 9
/
Copy pathswitch.dat
69 lines (61 loc) · 4.04 KB
/
switch.dat
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
# Switch file for phpMussel.
# Used by the ClamAV General and the ClamAV ASCII signature files to ignore certain signatures.
# ---
!ISSET:infectable;FD-RX:377f068[23]002de218:A:8;infectable=false
!ISSET:infectable;FD:252150532d41646f62652d:A:11;infectable=false
!ISSET:infectable;FD:28546869732066696c65206d75737420626520636f6e76657274656420776974682042696e48657820342e3029:A:45;infectable=false
!ISSET:infectable;FD:2e524d46:A:4;infectable=false
!ISSET:infectable;FD:2f5247420a49440affffffffffffffffffffffffffffffffffffffffffffffff:0:128;infectable=false
!ISSET:infectable;FD:494433:A:3;infectable=false
!ISSET:infectable;FD:4f676753:A:4;infectable=false
!ISSET:infectable;FD:5349502d48495420285349502f48:A:14;infectable=false
!ISSET:infectable;FD:53514c69746520666f726d6174203300:A:16;infectable=false
!ISSET:infectable;FD:53594d430100:A:6;infectable=false
!ISSET:infectable;FD:d9d505f920a163d7:A:8;infectable=false
!ISSET:infectable;FD:fffb90:A:3;infectable=false
!ISSET:infectable;infectable=true
# Assists with determining the most probable file format, and thus, probable types of content.
# ---
FD-RX:435753|465753|5a5753:A:3;is_swf=true
!ISSET:is_swf;FN:\.[Ss][Ww][FfTt]$;is_swf=true
!ISSET:is_swf;is_swf=false
FD:25504446:A:4;pdf_magic=true
!ISSET:pdf_magic;pdf_magic=false
$pdf_magic:true;is_pdf=true
FN:\.[Pp][Dd][Ff]$;is_pdf=true
!ISSET:is_pdf;is_pdf=false
!ISSET:fileswitch;FN:\.[Mm][Pp]?4.?$;FD-RX:63(?:686170|6c6970|72676e|746162)|66726565|66747970|696d6170|6a7032|6b6d6174|6c6f6164|6d(?:617474|646174|6f6f66|6f6f76)|70696374|706e6f74|73(?:637074|6b6970|737263|796e63)|746d6364|75647461|75756964|77696465:4:4;fileswitch=mp4
!ISSET:fileswitch;FD:4d5a:A:2;fileswitch=pefile
FD-RX:cafe(?:babe|d00d)|c[ef]faedfe|feedfac[ef]:A:4;is_macho=true
!ISSET:is_macho;is_macho=false
!ISSET:fileswitch;$is_macho:true;fileswitch=java
!ISSET:fileswitch;FD-RX:494433|fffb90:A:3;fileswitch=mp3
!ISSET:fileswitch;FD-NORM-RX:23212f7573722f(?:6c6f63616c2f)?62696e2f(?:656e76)?7065726c:A:24;fileswitch=perl
!ISSET:fileswitch;FD:43723234:A:4;fileswitch=chrome
!ISSET:fileswitch;FD:4c00000001140200:A:8;fileswitch=lnk
!ISSET:fileswitch;FD:d0cf11:A:3;fileswitch=docfile
!ISSET:fileswitch;FD-NORM-RX:23212f7573722f(?:6c6f63616c2f)?62696e2f(?:656e76)?707974686f6e:A:26;fileswitch=py
!ISSET:fileswitch;FD-NORM:6372656174656f626a656374;fileswitch=vb
!ISSET:fileswitch;FD-NORM:406563686f;fileswitch=bat
!ISSET:fileswitch;FD-NORM-RX:3c736372697074.{0,128}(?:6c616e67756167653d2[27]76627363726970742[27]|747970653d2[27]746578742f76627363726970742[27]);fileswitch=vb
!ISSET:fileswitch;FD-NORM-RX:3c736372697074.{0,128}(?:6c616e67756167653d2[27]6a6176617363726970742[27]|747970653d2[27]746578742f6a6176617363726970742[27]);fileswitch=js
!ISSET:fileswitch;FD-NORM-RX:3c25406c616e67756167653d(?:2[27])?76627363726970742e656e636f6465;fileswitch=vb
!ISSET:fileswitch;FD-NORM-RX:23212f7573722f(?:6c6f63616c2f)?62696e2f(?:656e76)?72756279:A:24;fileswitch=ruby
!ISSET:fileswitch;FN:\.(?:[Bb][Aa][Tt]|[Cc][Mm][Dd]|[Bb][Tt][Mm])$;fileswitch=bat
!ISSET:fileswitch;FN:\.(?:[Vv][Bb].{0,3}|[Ww][Ss][CcFf]|[Hh][Tt][Aa]?[Mm]?[Ll]?)$;fileswitch=vb
!ISSET:fileswitch;FN:\.[Mm][Pp].$;fileswitch=mp3
!ISSET:fileswitch;FD:3c25:A:2;fileswitch=asp
!ISSET:fileswitch;FN:\.(?:[Aa][Uu][Tt][Oo][Rr][Uu][Nn]|[Ii][Nn][Ff]|[Ii][Nn][Ii]|[Cc][Ff][Gg])$;fileswitch=inf
!ISSET:fileswitch;FN:\.[Aa][Ss][Pp].?$;fileswitch=asp
!ISSET:fileswitch;FN:\.[Jj][Ss](?:[Pp][Xx]?|[Oo][Nn])?$;fileswitch=js
!ISSET:fileswitch;FN:\.[Pp][Yy].?$;fileswitch=py
!ISSET:fileswitch;FN:\.[Jj][Aa](?:[Vv][Aa]|[Rr])$;fileswitch=java
!ISSET:fileswitch;FN:\.[Pp](?:[Ee][Rr])?[Ll]$;fileswitch=perl
!ISSET:fileswitch;FN:\.[Cc][Gg][Ii]$;fileswitch=cgi
!ISSET:fileswitch;FN:\.(?:[Rr][Uu]?[Bb][WwYy]?|[Gg][Ee][Mm])$;fileswitch=ruby
!ISSET:fileswitch;$is_swf:true;fileswitch=swf
!ISSET:fileswitch;$is_pdf:true;fileswitch=pdf
!ISSET:fileswitch;FN:\.(?:[Cc][Vv][Dd]|[Ii][Nn][Cc]|[Mm][Dd]|[Tt][Xx][Tt])$;fileswitch=ignore
!ISSET:fileswitch;FD-RX:(?:1f8b|425a68|504b|52617221|7f454c46):A:4;fileswitch=vt_interest
!ISSET:fileswitch;FD:7801:A:2;FD:6b6f6c79:-512;fileswitch=vt_interest
!ISSET:fileswitch;fileswitch=unassigned