/hvaonline/posts/list/28.html JForum - http://www.jforum.net http://vietnamnet.vn/cntt/2006/07/594778/ I was thinking on different lines, possibly one can use magic values of different types of executables along with "filetype:" keyword. For Example: EXE -- 0x5A4D NT -- 0x4550 OS2 -- 0x454E OS2 LE -- 0x454C VXD -- 0x454C Now, if one has to search for malicious binaries in the form of .scr, .com or .pif etc then (s)he can issue the following search keywords - "intext: signature: 5A4D" filetype:scr "intext: signature: 5A4D" filetype:pif "intext: signature: 5A4D" filetype:doc or (without using "intext") signature: 00004550 filetype:scr signature: 00004550 filetype:doc The results can be narrowed down using a signature database like the one being used here http://metasploit.com/research/misc/mwsearch/index.html Similar results can also be achieved using search keywords for specific details in a PE / LE header. For example - Search for ["intext: Image File Header" filetype:scr] gives almost the same result as ["intext: signature: 5A4D" filetype:scr] Found by : ketusa ]]> /hvaonline/posts/list/2006.html#10198 /hvaonline/posts/list/2006.html#10198 GMT /hvaonline/posts/list/2006.html#10278 /hvaonline/posts/list/2006.html#10278 GMT