ClamAV File Types

ClamAV maintains it's own file typing format and assigns these types using either:

Target Types

A Target Type is an integer that indicates which kind of file the signature will match against. Target Type notation was first created for the purposes writing efficient signatures. A signature with a target type of 0 will be run against every file type, and thus is not ideal. However, the Target Type notation is limited and it may be unavoidable.

Although the newer CL_TYPE string name notation has replaced the Target Type for some signature formats, many signature formats require a target type number.

This is the current list of available Targe Types:

**Important: HTML, ASCII, Javascript are all normalized.

CL_TYPEs

ClamAV Types are prefixed with CL_TYPE_. The following is an exhaustive list of all current CL_TYPE's.

CL_TYPE Description
CL_TYPE_7Z 7-Zip Archive
CL_TYPE_7ZSFX Self-Extracting 7-Zip Archive
CL_TYPE_APM Disk Image - Apple Partition Map
CL_TYPE_ARJ ARJ Archive
CL_TYPE_ARJSFX Self-Extracting ARJ Archive
CL_TYPE_AUTOIT AutoIt Automation Executable
CL_TYPE_BINARY_DATA binary data
CL_TYPE_BINHEX BinHex Macintosh 7-bit ASCII email attachment encoding
CL_TYPE_BZ BZip Compressed File
CL_TYPE_CABSFX Self-Extracting Microsoft CAB Archive
CL_TYPE_CPIO_CRC CPIO Archive (CRC)
CL_TYPE_CPIO_NEWC CPIO Archive (NEWC)
CL_TYPE_CPIO_ODC CPIO Archive (ODC)
CL_TYPE_CPIO_OLD CPIO Archive (OLD, Little Endian or Big Endian)
CL_TYPE_CRYPTFF Files encrypted by CryptFF malware
CL_TYPE_DMG Apple DMG Archive
CL_TYPE_ELF ELF Executable (Linux/Unix program or library)
CL_TYPE_GPT Disk Image - GUID Partition Table
CL_TYPE_GRAPHICS TIFF (Little Endian or Big Endian)
CL_TYPE_GZ GZip Compressed File
CL_TYPE_HTML_UTF16 Wide-Character / UTF16 encoded HTML
CL_TYPE_HTML HTML data
CL_TYPE_HWP3 Hangul Word Processor (3.X)
CL_TYPE_HWPOLE2 Hangul Word Processor embedded OLE2
CL_TYPE_INTERNAL Internal properties
CL_TYPE_ISHIELD_MSI Windows Install Shield MSI installer
CL_TYPE_ISO9660 ISO 9660 file system for optical disc media
CL_TYPE_JAVA Java Class File
CL_TYPE_LNK Microsoft Windows Shortcut File
CL_TYPE_MACHO_UNIBIN Universal Binary/Java Bytecode
CL_TYPE_MACHO Apple/NeXTSTEP Mach-O Executable file format
CL_TYPE_MAIL Email file
CL_TYPE_MBR Disk Image - Master Boot Record
CL_TYPE_MHTML MHTML Saved Web Page
CL_TYPE_MSCAB Microsoft CAB Archive
CL_TYPE_MSCHM Microsoft CHM help archive
CL_TYPE_MSEXE Microsoft EXE / DLL Executable file
CL_TYPE_MSOLE2 Microsoft OLE2 Container file
CL_TYPE_MSSZDD Microsoft Compressed EXE
CL_TYPE_NULSFT NullSoft Scripted Installer program
CL_TYPE_OLD_TAR TAR archive (old)
CL_TYPE_OOXML_HWP Hangul Office Open Word Processor (5.X)
CL_TYPE_OOXML_PPT Microsoft Office Open XML PowerPoint
CL_TYPE_OOXML_WORD Microsoft Office Open Word 2007+
CL_TYPE_OOXML_XL Microsoft Office Open Excel 2007+
CL_TYPE_PART_HFSPLUS Apple HFS+ partition
CL_TYPE_PDF Adobe PDF document
CL_TYPE_POSIX_TAR TAR archive
CL_TYPE_PS Postscript
CL_TYPE_RAR RAR Archive
CL_TYPE_RARSFX Self-Extracting RAR Archive
CL_TYPE_RIFF Resource Interchange File Format container formatted file
CL_TYPE_RTF Rich Text Format document
CL_TYPE_SCRENC Files encrypted by ScrEnc malware
CL_TYPE_SCRIPT Generic type for scripts (Javascript, Python, etc)
CL_TYPE_SIS Symbian OS Software Installation Script Archive
CL_TYPE_SWF Adobe Flash File (LZMA, Zlib, or uncompressed)
CL_TYPE_TEXT_ASCII ASCII text
CL_TYPE_TEXT_UTF16BE UTF-16BE text
CL_TYPE_TEXT_UTF16LE UTF-16LE text
CL_TYPE_TEXT_UTF8 UTF-8 text
CL_TYPE_TNEF Microsoft Outlook & Exchange email attachment format
CL_TYPE_UUENCODED UUEncoded (Unix-to-Unix) binary file (Unix email attachment)
CL_TYPE_XAR XAR Archive
CL_TYPE_XDP Adobe XDP - Embedded PDF
CL_TYPE_XML_HWP Hangul Word Processor XML (HWPML) Document
CL_TYPE_XML_WORD Microsoft Word 2003 XML Document
CL_TYPE_XML_XL Microsoft Excel 2003 XML Document
CL_TYPE_XZ XZ Archive
CL_TYPE_ZIP Zip Archive
CL_TYPE_ZIPSFX Self-Extracting Zip Archive