Sanesecurity's ClamAV - Phishing and Scam/Spam Signatures

	... mad about email, sane about security ...
	Phishing and Scam Signatures for ClamAV

Wiki

Here's some brief documentation:

Signature making method used: method.pdf based on ClamAV signature docs

Signature making Example (using ClamAV Extended Database Format .NDB):
SaneSecurity.Phishing.Auction.2099:3:*: 656261792073656e742074686973206d65737361676521
SaneSecurity.Phishing.Auction	SaneSecurity Header
.2099	Database Line number
:3	:FileType: 0 = any file 3 = HTML (normalised) 4 = Mail file 7 = ASCII text file (normalised)
:*	Anywhere in file
:656261792073656e742074686973206d65737361676521	Hex of the Phishing email, to match: Eg: ebay_sent this message!

Current SaneSecurity signature meanings:

SaneSecurity Signature meanings (phish.ndb)
Sanesecurity.Doc	Fake phishing documents
Sanesecurity.Fake	Fake emails from companies/spear phishing
Sanesecurity.Phishing.Auction	Phishing emails from Ebay
Sanesecurity.Phishing.Azon	Phishing emails from Amazon
Sanesecurity.Phishing.Bank	Phishing emails from Banks
Sanesecurity.Phishing.Card	Phishing Postcards
Sanesecurity.Phishing.Cur	Simple phishing heuristics based on headers/urls and content
Sanesecurity.Phishing.Dca	Html based doubleclick revenue link
Sanesecurity.Phishing.Fake	Fake emails from companies/spear phishing
Sanesecurity.Phishing.GiftCard	Phishing Postcards
Sanesecurity.Phishing.Hex	Simple Heuristics based hex urls
Sanesecurity.Phishing.Ivt	Html based invalid tags
Sanesecurity.Phishing.Jsc	Html based
Sanesecurity.Phishing.Nam	Html based common fake html editor
Sanesecurity.Phishing.Onf	Html based
Sanesecurity.Phishing.Pay	Phishing emails from PayPal
Sanesecurity.Phishing.Rdi	Phishing redirects
Sanesecurity.Phishing.Rock	Phishing emails generated with the rockfish toolkit
Sanesecurity.Phishing.RockGen	Phishing emails generated with the rockfish toolkit
Sanesecurity.Phishing.Shop	Phishing emails for shops
Sanesecurity.Phishing.Slw	Html based
Sanesecurity.Phishing.Url	Url based phishing detection
Sanesecurity.Phishing.Wrd	Fake phishing documents
Sanesecurity.PhishingTestSig	Sanesecurity Test Signature
TestSig_Type3_Bdy	Sanesecurity Test Signature
TestSig_Type4_Bdy	Sanesecurity Test Signature
TestSig_Type4_Hdr	Sanesecurity Test Signature

SaneSecurity Signature meanings (scam.ndb)
Sanesecurity.Spam	General high hitting spam
Sanesecurity.Spam
Sanesecurity.Cred
Sanesecurity.Dipl	Diploma scams
Sanesecurity.Hdr	Spam based on fake headers
Sanesecurity.Img	Image Spam
Sanesecurity.Job	Job scams
Sanesecurity.Loan	Loan Scams
Sanesecurity.Porn	Porn Spam
Sanesecurity.ImgO	OEM Image scams/spam
Sanesecurity.Scam4	419 scams
Sanesecurity.ScamL	Lottery scams
Sanesecurity.Stk	Stock scams
Sanesecurity.TestSig	Sanesecurity test signature

SaneSecurity Signature meanings (junk.ndb)
Sanesecurity.Junk	General high hitting junk, containing spam/phishing/lottery/jobs etc.

SaneSecurity Signature meanings (rogue.hdb)
Sanesecurity.Rogue	Rogue anti-virus software
Sanesecurity.Trojan	Fake codecs or other malware

SaneSecurity Signature meanings (lott.ndb)
Sanesecurity.Lott	Fake Lottery companys, prizes and winnings.

SaneSecurity Signature meanings (spear.ndb)
Sanesecurity.Spear	Spear phishing email addresses (autogenerated from data here)

SaneSecurity Signature meanings (spamimg.hdb)
Sanesecurity.SpamImg	Spam images

SaneSecurity Signature meanings (spam.ldb)
Sanesecurity.Spam.ldb	Spam detected using the new Logical Signature type.

Disclaimer:

Whilst every effort has been made by Sanesecurity to ensure that the signatures don't lead to false positives, we make no warranty that the signatures will meet your requirements, be uninterrupted, complete, timely, secure or error free. You must therefore use them at your own risk.