search

maliceio / malice

VirusTotal Wanna Be - Now with 100% more Hipster
Apache License 2.0
1.65k stars 265 forks source link

Add full libmagic description string #28

Closed knowmalware closed 7 years ago

knowmalware commented 8 years ago

The libmagic full description string contains more information than just the mimetype. For example, it indicates multi-typed files, such as self-executing (SFX) archives.

Here is what I am thinking: 530a256

I am not a go coder, so may have done that wrong. Still figuring out how to test my changes.

blacktop commented 8 years ago

I like that idea. I was only using libmagic to decide how to filter the plugins so I don't do something dumb like waste time running a Pexe plugin on a Word Doc, but since I have a hold of the file I should pull that info out. Also the mimetype might not have enough granularity for me to really decide what tool to use. example: RTF or OLE etc etc

You can see here how I am trying to filter plugins to their mimetypes: https://github.com/maliceio/malice/blob/master/plugins/plugins.toml

If you want you can submit this change as a Pull Requests: https://help.github.com/articles/about-pull-requests/