Digital Forensics and Incident Response - Second Edition

ClamAV

One first step in conducting a static analysis is to determine if the potential malware under analysis has been previously identified. A single sample's hash can be uploaded to sites such as VirusTotal, but if a responder has acquired a number of files through their analysis, they will need to be able to determine if there are any that warrant further examination. One technique is to use a commercial anti-virus scanner to scan the directory. In this case, a free, open source tool that can be leveraged is ClamAV.

ClamAV is a command-line utility that allows responders to scan a directory with a variety of suspicious file formats. From here, suspicious files that are identified can be further analyzed by the responder. To get started ...