Hi All,

First time poster, and just now starting to attempt to develop some signatures for ClamAV. I was wondering though (I know this maybe a dumb question), is it possible to develop a signature based off a UNICODE STRING inside of the file? Some EXE's that I have been seeing, have a very specific STRING, and I was wondering if I could make it fire off of that alone. Any help is much appreciated. Thank you in advance.

Darksider

Sure, it's possible to get a signature for anything you can see in a debugger/hex editor/disassembler. It if is really unique, it might hold up and not have any false positives. I prefer to stay away from formatting type stuff, but I think something like that fairly new Unicode trick of reversing the extension so it does not appear at the end of the filename might work. Not many legitimate executable files would do that.

Watch it though--every time I think I have found something unique, it seems to get false positives!

Regards,