ClamAV File Types

ClamAV has two file typing systems for filtering signature matches: Target Types and File Types.

Target Types

A Target Type is an integer that indicates which kind of file the signature will match against. Target Type notation was first created for the purposes writing efficient signatures. A signature with a target type of 0 will be run against every file type, and thus is not ideal. However, the Target Type notation is limited and it may be unavoidable.

Although the newer CL_TYPE string name notation has replaced the Target Type for some signature formats, many signature formats require a target type number.

This is the current list of available Target Types:

Important: HTML, ASCII, Javascript are all normalized:

• ASCII - All lowercase.
• HTML - Whitespace transformed to spaces, tags/tag attributes normalized, all lowercase.
• Javascript - All strings are normalized (hex encoding is decoded), numbers are parsed and normalized, local variables/function names are normalized to n001 format, argument to eval() is parsed as JS again, unescape() is handled, some simple JS packers are handled, output is whitespace normalized.

File Types

ClamAV maintains it's own file typing format and assigns these types using either:

• Evaluation of a unique sequence of bytes at the start of a file (File Type Magic).

• File type indicators when parsing container files.

  • For example: CL_TYPE_SCRIPT may be assigned to data contained in a PDF when the PDF indicates that a stream of bytes is "Javascript"

• File type determination based on the names or characteristics contained within the file.

  • For example: CL_TYPE_OOXML_WORD may be assigned to a Zip file containing files with specific names.

ClamAV File Types are prefixed with CL_TYPE_. The following is an exhaustive list of all current file types.