#
# File Type Signatures
#

01 06 01 00;Job File
1F 8B 08;GZIP
25 50 44 46;PDF
30 00 00 00 4C 66 4C 65;EVT Event Viewer File
50 4B 03 04 14 00 06 00;Office
50 4B 53 70 58;PKSFX
37 7A BC AF 27 1C;7Zip
46 75 6E 63 74 69 6F 6E;VBS
42 5A 68;BZip2
5F 27 A8 89;JAR
FF D8 FF;JPEG
50 4B 05 06;PKZIP
52 61 72 21 1A 07;RAR
57 69 6E 5A 69 70;WinZIP
72 65 67 66;Registry Hive
7B 5C 72 74;RTF
75 73 74 61 72;TAR
D4 C3 B2 A1;WINPCAP
A1 B2 C3 D4;LIBPCAP
A1 B2 CD 34;LIBPCAP
FF 4B 45 59 42 20 20 20;SYS Keyboard Driver
FF FE 3C 00 3F 00 78 00 6D 00 6C;Windows At Job
3C 3F 70 68 70;PHP
0D 44 4F 43;DOC
FF D8 FF E0;JPEG
1F 8B 08;GZIP
23 20 44 69 73 6B 20 44;VMDK
30 00 00 00 4C 66 4C 65;EVT
45 6C 66 46 69 6C;EVTX
41 45 53;AESCrypt
43 4F 57 44;VMDK
43 57 53;SWF
5A 57 53;SWF
46 57 53;SWF
46 49 4C 45;NTFS MFT
4A 41 52 43 53 00;JARCS
4B 44 4D;VMDK
4C 00 00 00 01 14 02 00;LNK
4D 53 43 46;CAB
50 4B 03 04;ZIP
3C 3F 78 6D 6C;XML
63 6F 6E 65 63 74 69 78;VHD
D0 CF 11 E0 A1 B1 1A E1;OLE
40 65 63 68;BATCH
40 45 43 48;BATCH
FF FE 90 02 01 00;Trace Log File
23 21 2F;UNIX SCRIPT
4D 44 4D 50;MDMP
FF FE 3C 00 25 00;JSP
FE FF 00 3C 00 25;JSP
43 57 53;CWS
5A 57 53;ZWS
46 57 53;FWS (Flash)
30 3A 30 30 3A 30 30;Log Relative
7F 45;ELF
23 21;Script
1F 9D;TARZ
1F A0;TARZ
3C 25;JSP
3C 25 40;ASP
FF FE 3C 00 25 00 40 00;ASP
FE FF 00 3C 00 25 00 40;ASP
4D 5A;EXE
FF FE;UTF16-Encoded File LE
FE FF;UTF16-Encoded File BE
01 F7;AIX XCOFF
CF FA ED FE;MACH-O
CE FA ED FE;MACH-O
CA FE BA BE 00 00 00 00;MACH-O
CA FE BA BE 00 00 00 01;MACH-O
CA FE BA BE 00 00 00 02;MACH-O
CA FE BA BE 00 00 00 03;MACH-O
CA FE BA BE 00 00 00 04;MACH-O
CA FE BA BE 00 00 00 05;MACH-O
CA FE BA BE 00 00 00 06;MACH-O
CA FE BA BE 00 00 00 07;MACH-O
CA FE BA BE 00 00 00 08;MACH-O
CA FE BA BE 00 00 00 09;MACH-O
CA FE BA BE 00 00 00 0A;MACH-O
CA FE BA BE 00 00 00 0B;MACH-O
CA FE BA BE 00 00 00 0C;MACH-O
CA FE BA BE 00 00 00 0D;MACH-O
CA FE BA BE 00 00 00 0E;MACH-O
CA FE BA BE 00 00 00 0F;MACH-O
CA FE BA BE 00 00 00 10;MACH-O
CA FE BA BE 00 00 00 11;MACH-O
CA FE BA BE 00 00 00 12;MACH-O
CA FE BA BE 00 00 00 13;MACH-O
CA FE BA BE 00 00 00 14;MACH-O
CA FE BA BE 00 00 00 15;MACH-O
CA FE BA BE 00 00 00 16;MACH-O
CA FE BA BE 00 00 00 17;MACH-O
CA FE BA BE 00 00 00 18;MACH-O
CA FE BA BE 00 00 00 19;MACH-O
CA FE BA BE 00 00 00 1A;MACH-O
CA FE BA BE 00 00 00 1B;MACH-O
CA FE BA BE 00 00 00 1C;MACH-O
CA FE BA BE 00 00 00 1D;MACH-O
CA FE BA BE 00 00 00 1E;MACH-O
CA FE BA BE 00 00 00 1F;MACH-O
64 65 78 0A;DEX
CA FE;Java Class or DYLIB

# Special
41 64 6d 69 6e 69 73 74 72 61 74 6f 72 3a 35 30 30;SAMDUMP File
41 64 6D 69 6E 69 73 74 72 61 74 6F 72 28 63 75 72;GSecDump File
5B 30 30 30 30 30 30 30 30 3A;MimiLSA Log
4D 44 4D 50 93 A7 B1 61 0E;LSASS Dump File
58 56 00 00;DLL cloaking with XV instead of MZ used in Troj/Plugx-W variant
FF FE 73 00 63 00 72 00 65 00 65 00 6E;RDP
65 63 68 6F;BATCH
40 65 63 68 6F;BATCH
3F 50 4E 47;Fake PNG
0D 0A 3C 3F;Web Script
5B 49 6E 74;Internet Shortcut
FF FE 76 00 61 00 72 00;Emotet JS
76 61 72 20;JS Obfuscated
5B 76 65 72;INI Files
32 30;Log File
FF FE 56 00 65 00 72 00 73 00 69 00 6F;WER
56 00 65 00 72 00 73 00 69 00 6F 00 6E;WER
23 40 7E 5E;VBE Encoded
66 75 6E 63 74 69 6F 6E;PowerShell
41 54 26 54 46 4F 52 4D;Gitlab EXIF

# APT
3C 62 6F 64 79 3E;Web
4F 6E 20 45 72 72 6F 72 20 52 65 73 75 6D 65;VBS
3C 68 74 6D 6C;HTML
3C 48 54 4D 4C;HTML
3C 21 64 6F 63 74 79 70 65 20 68 74 6D 6C 3E;Doctype HTML
3C 21 64 6F 63 74 79 70 65 20 48 54 4D 4C 3E;Doctype HTML
3C 21 44 4F 43 54 59 50 45 20 48 54 4D 4C 3E;Doctype HTML
3C 21 44 4F 43 54 59 50 45 20 68 74 6D 6C 3E;Doctype HTML
0D 0A 3C 25 40;Line Break JSP
3C 25 2D 2D;JSP
3C 43 46 53 45 54;ColdFusion
3C 63 66 73 65 74;ColdFusion
76 82;Mimikatz Kirbi
31 30 2E;IP Log
31 39 32 2E;IP Log
31 37 32 2E;IP Log
49 6D 70 61 63 6B 65 74;Impacket
55 73 69 6E 67 20 27;Mimikatz Logfile
2D 2D 2D 2D 2D 42 45 47 49 4E;Certificate PEM
53 61 6C 74 65 64 5F 5F;OpenSSL Salted Format

# APT Extra
76 61;Malicious JS
75 73 69 6E 67;.NET sources
EF BB BF 75 73 69 6E 67;.NET source file
0A 09 09 09;Sidewinder JS Dropper
54 56;Base64 EXE
CA FE BA BE;Java Class
31 30;Decimal Payloads
B2 A6;RoyalRoad 8.t Helper File

# Base64
4A 41 42;Base64 File JAB
49 41 42;Base64 File IAB
53 55 56 59;Base64 File SUVY
53 51 42 46 41 46;Base64 File SQBFAF
63 77 42 68 41;Base64 File cwBhA
61 57 56 34;Base64 File aWV4
61 51 42 6C 41;Base64 File aQBlA
64 67 42 68 41;Base64 File dgBhA
64 58 4E 70 62 6D;Base64 File dXNpbm

# Statistical Evaluation
FF FE 43 00 6F 00 6E 00;PSD1
23 20 45 78 70 6C;WSF
3C 21 2D 2D 0D 0A;Web Comment
69 6D 70 6F 72 74;Import
3C 73 63 72 69 70;Script
3C 23 0A 2E 53 59;PowerShell
3C 3F 0D 0A 0D 0A;Web
0A 3C 23 0A 2E 53;PowerShell
23 75 73 61 67 65;Python
EF BB BF 49 6D 70 6F 72 74;PowerShell
70 6F 77 65 72 73;BAT PowerShell
EF BB BF 3C 23 0A 2E 53 59;PowerShell
3C 6A 73 70 3A 72;JSP
23 2F 75 73 72 2F;Shell
23 52 65 71 75 69;PowerShell
3C 6A 73 70 3A 75;JSP
43 56 45 2D 32 30;CVE File
20 3C 3F 70 68 70;PHP
50 72 69 76 61 74;VBA
0A 44 69 6D 20 72;VBS
44 69 6D 20;VBS
3C 3F 0D 0A 0D 0A;Web

# GIF
47 49 46 38 37 61;GIF
47 49 46 38 39 61;GIF
