ClamAV File Types

ClamAV maintains it's own file typing format and assigns these types using either:


Target Types

A Target Type is an integer that indicates which kind of file the signature will match against. Target Type notation was first created for the purposes writing efficient signatures. A signature with a target type of 0 will be run against every file type, and thus is not ideal. However, the Target Type notation is limited and it may be unavoidable.

Although the newer CL_TYPE string name notation has replaced the Target Type for some signature formats, many signature formats require a target type number.

This is the current list of available Targe Types:

**Important: HTML, ASCII, Javascript are all normalized.


CL_TYPEs

ClamAV Types are prefixed with CL_TYPE_. The following is an exhaustive list of all current CL_TYPE's.

| CL_TYPE                | Description                                                  |
|------------------------|--------------------------------------------------------------|
| `CL_TYPE_7Z`           | 7-Zip Archive                                                |
| `CL_TYPE_7ZSFX`        | Self-Extracting 7-Zip Archive                                |
| `CL_TYPE_APM`          | Disk Image - Apple Partition Map                             |
| `CL_TYPE_ARJ`          | ARJ Archive                                                  |
| `CL_TYPE_ARJSFX`       | Self-Extracting ARJ Archive                                  |
| `CL_TYPE_AUTOIT`       | AutoIt Automation Executable                                 |
| `CL_TYPE_BINARY_DATA`  | binary data                                                  |
| `CL_TYPE_BINHEX`       | BinHex Macintosh 7-bit ASCII email attachment encoding       |
| `CL_TYPE_BZ`           | BZip Compressed File                                         |
| `CL_TYPE_CABSFX`       | Self-Extracting Microsoft CAB Archive                        |
| `CL_TYPE_CPIO_CRC`     | CPIO Archive (CRC)                                           |
| `CL_TYPE_CPIO_NEWC`    | CPIO Archive (NEWC)                                          |
| `CL_TYPE_CPIO_ODC`     | CPIO Archive (ODC)                                           |
| `CL_TYPE_CPIO_OLD`     | CPIO Archive (OLD, Little Endian or Big Endian)              |
| `CL_TYPE_CRYPTFF`      | Files encrypted by CryptFF malware                           |
| `CL_TYPE_DMG`          | Apple DMG Archive                                            |
| `CL_TYPE_ELF`          | ELF Executable (Linux/Unix program or library)               |
| `CL_TYPE_GPT`          | Disk Image - GUID Partition Table                            |
| `CL_TYPE_GRAPHICS`     | TIFF (Little Endian or Big Endian)                           |
| `CL_TYPE_GZ`           | GZip Compressed File                                         |
| `CL_TYPE_HTML_UTF16`   | Wide-Character / UTF16 encoded HTML                          |
| `CL_TYPE_HTML`         | HTML data                                                    |
| `CL_TYPE_HWP3`         | Hangul Word Processor (3.X)                                  |
| `CL_TYPE_HWPOLE2`      | Hangul Word Processor embedded OLE2                          |
| `CL_TYPE_INTERNAL`     | Internal properties                                          |
| `CL_TYPE_ISHIELD_MSI`  | Windows Install Shield MSI installer                         |
| `CL_TYPE_ISO9660`      | ISO 9660 file system for optical disc media                  |
| `CL_TYPE_JAVA`         | Java Class File                                              |
| `CL_TYPE_LNK`          | Microsoft Windows Shortcut File                              |
| `CL_TYPE_MACHO_UNIBIN` | Universal Binary/Java Bytecode                               |
| `CL_TYPE_MACHO`        | Apple/NeXTSTEP Mach-O Executable file format                 |
| `CL_TYPE_MAIL`         | Email file                                                   |
| `CL_TYPE_MBR`          | Disk Image - Master Boot Record                              |
| `CL_TYPE_MHTML`        | MHTML Saved Web Page                                         |
| `CL_TYPE_MSCAB`        | Microsoft CAB Archive                                        |
| `CL_TYPE_MSCHM`        | Microsoft CHM help archive                                   |
| `CL_TYPE_MSEXE`        | Microsoft EXE / DLL Executable file                          |
| `CL_TYPE_MSOLE2`       | Microsoft OLE2 Container file                                |
| `CL_TYPE_MSSZDD`       | Microsoft Compressed EXE                                     |
| `CL_TYPE_NULSFT`       | NullSoft Scripted Installer program                          |
| `CL_TYPE_OLD_TAR`      | TAR archive (old)                                            |
| `CL_TYPE_OOXML_HWP`    | Hangul Office Open Word Processor (5.X)                      |
| `CL_TYPE_OOXML_PPT`    | Microsoft Office Open XML PowerPoint                         |
| `CL_TYPE_OOXML_WORD`   | Microsoft Office Open Word 2007+                             |
| `CL_TYPE_OOXML_XL`     | Microsoft Office Open Excel 2007+                            |
| `CL_TYPE_PART_HFSPLUS` | Apple HFS+ partition                                         |
| `CL_TYPE_PDF`          | Adobe PDF document                                           |
| `CL_TYPE_POSIX_TAR`    | TAR archive                                                  |
| `CL_TYPE_PS`           | Postscript                                                   |
| `CL_TYPE_RAR`          | RAR Archive                                                  |
| `CL_TYPE_RARSFX`       | Self-Extracting RAR Archive                                  |
| `CL_TYPE_RIFF`         | Resource Interchange File Format container formatted file    |
| `CL_TYPE_RTF`          | Rich Text Format document                                    |
| `CL_TYPE_SCRENC`       | Files encrypted by ScrEnc malware                            |
| `CL_TYPE_SCRIPT`       | Generic type for scripts (Javascript, Python, etc)           |
| `CL_TYPE_SIS`          | Symbian OS Software Installation Script Archive              |
| `CL_TYPE_SWF`          | Adobe Flash File (LZMA, Zlib, or uncompressed)               |
| `CL_TYPE_TEXT_ASCII`   | ASCII text                                                   |
| `CL_TYPE_TEXT_UTF16BE` | UTF-16BE text                                                |
| `CL_TYPE_TEXT_UTF16LE` | UTF-16LE text                                                |
| `CL_TYPE_TEXT_UTF8`    | UTF-8 text                                                   |
| `CL_TYPE_TNEF`         | Microsoft Outlook & Exchange email attachment format         |
| `CL_TYPE_UUENCODED`    | UUEncoded (Unix-to-Unix) binary file (Unix email attachment) |
| `CL_TYPE_XAR`          | XAR Archive                                                  |
| `CL_TYPE_XDP`          | Adobe XDP - Embedded PDF                                     |
| `CL_TYPE_XML_HWP`      | Hangul Word Processor XML (HWPML) Document                   |
| `CL_TYPE_XML_WORD`     | Microsoft Word 2003 XML Document                             |
| `CL_TYPE_XML_XL`       | Microsoft Excel 2003 XML Document                            |
| `CL_TYPE_XZ`           | XZ Archive                                                   |
| `CL_TYPE_ZIP`          | Zip Archive                                                  |
| `CL_TYPE_ZIPSFX`       | Self-Extracting Zip Archive                                  |