# Common Malware File Signatures and Magic Bytes

Quick reference for identifying file types by their magic bytes (file signatures).
Essential for initial triage when file extensions cannot be trusted.

## Executable Formats

### Windows PE (Portable Executable)

| Offset | Hex | ASCII | Description |
|--------|-----|-------|-------------|
| 0x00 | `4D 5A` | `MZ` | DOS MZ header (all PE files) |
| 0x3C | (4 bytes) | - | Offset to PE signature |
| PE offset | `50 45 00 00` | `PE\0\0` | PE signature |

**Subtypes by PE Optional Header magic:**
- `0x10B` - PE32 (32-bit)
- `0x20B` - PE32+ (64-bit)

**Subsystem values (determines GUI vs console):**
- `0x02` - Windows GUI
- `0x03` - Windows Console (CUI)
- `0x01` - Native (drivers)

**Common PE malware characteristics:**
- Non-standard section names (`.UPX0`, `.themida`, `.vmp0`)
- Entry point outside first section
- Section with both write and execute permissions
- Abnormal number of sections (> 10 or just 1)

### Linux ELF (Executable and Linkable Format)

| Offset | Hex | ASCII | Description |
|--------|-----|-------|-------------|
| 0x00 | `7F 45 4C 46` | `\x7fELF` | ELF magic number |
| 0x04 | `01` or `02` | - | 32-bit or 64-bit |
| 0x05 | `01` or `02` | - | Little-endian or big-endian |
| 0x10 | (2 bytes) | - | Type: `0x02`=exec, `0x03`=shared |

**Suspicious ELF indicators:**
- Statically linked binaries (unusual for modern Linux)
- Stripped symbol tables
- UPX packed (`UPX!` marker)
- Non-standard section names

### macOS Mach-O

| Hex | Description |
|-----|-------------|
| `FE ED FA CE` | Mach-O 32-bit |
| `FE ED FA CF` | Mach-O 64-bit |
| `CE FA ED FE` | Mach-O 32-bit (reversed byte order) |
| `CF FA ED FE` | Mach-O 64-bit (reversed byte order) |
| `CA FE BA BE` | Mach-O Universal Binary (fat binary) |

## Document Formats

### Microsoft Office

**Modern Office (OOXML - ZIP-based):**

| Hex | Description |
|-----|-------------|
| `50 4B 03 04` | ZIP header (all .docx, .xlsx, .pptx) |

Distinguish by contents:
- `word/document.xml` - Word document (.docx)
- `xl/workbook.xml` - Excel workbook (.xlsx)
- `ppt/presentation.xml` - PowerPoint (.pptx)

**Legacy Office (OLE2):**

| Offset | Hex | Description |
|--------|-----|-------------|
| 0x00 | `D0 CF 11 E0 A1 B1 1A E1` | OLE2 Compound Binary |

Distinguish by internal streams:
- `WordDocument` stream - Word (.doc)
- `Workbook` stream - Excel (.xls)
- `PowerPoint Document` stream - PowerPoint (.ppt)

**Malware indicators in Office files:**
- VBA macros in `vbaProject.bin`
- External relationships (template injection)
- DDE fields
- Embedded OLE objects
- ActiveX controls

### PDF

| Offset | Hex | ASCII | Description |
|--------|-----|-------|-------------|
| 0x00 | `25 50 44 46` | `%PDF` | PDF header |

**Malicious PDF indicators:**
- `/JavaScript` or `/JS` actions
- `/OpenAction` or `/AA` (auto-action)
- `/Launch` actions
- `/EmbeddedFile` streams
- `/URI` actions
- Encoded streams (`/FlateDecode`, `/ASCIIHexDecode`)
- Multiple `/ObjStm` (object streams for obfuscation)

### RTF (Rich Text Format)

| Offset | Hex | ASCII | Description |
|--------|-----|-------|-------------|
| 0x00 | `7B 5C 72 74 66` | `{\rtf` | RTF header |

**Malicious RTF indicators:**
- Embedded OLE objects (`\objdata`)
- Equation editor exploits (CVE-2017-11882)
- Very large/obfuscated hex data blocks

## Archive Formats

| Hex | ASCII | Format |
|-----|-------|--------|
| `50 4B 03 04` | `PK..` | ZIP |
| `50 4B 05 06` | `PK..` | ZIP (empty archive) |
| `52 61 72 21 1A 07 00` | `Rar!..` | RAR v4 |
| `52 61 72 21 1A 07 01 00` | `Rar!...` | RAR v5 |
| `37 7A BC AF 27 1C` | `7z...` | 7-Zip |
| `1F 8B` | - | GZIP |
| `42 5A 68` | `BZh` | BZIP2 |
| `FD 37 7A 58 5A 00` | - | XZ |
| `78 01` or `78 9C` or `78 DA` | - | ZLIB |

**Archives commonly used in malware delivery:**
- Password-protected ZIPs (bypass email scanning)
- Double-extension files inside archives (e.g., `invoice.pdf.exe`)
- ISO/IMG disk images (`CD001` at offset 0x8001)
- CAB files (`4D 53 43 46` - `MSCF`)

## Script and Text Formats

| Signature | Description |
|-----------|-------------|
| `#!` (shebang) | Unix script (bash, python, perl, etc.) |
| `<?xml` | XML document |
| `<html` or `<!DOCTYPE html` | HTML document |
| `<HTA:APPLICATION` | HTML Application (HTA) - dangerous |
| Starts with `Set ` or `Dim ` | VBScript |
| `var `, `function `, `eval(` | JavaScript |

**Dangerous script types:**
- `.hta` - HTML Application (runs with full trust)
- `.vbs` / `.vbe` - VBScript
- `.js` / `.jse` - JScript (Windows Script Host)
- `.wsf` - Windows Script File
- `.ps1` - PowerShell script
- `.bat` / `.cmd` - Batch files
- `.scr` - Screen saver (actually PE)
- `.lnk` - Windows shortcut (can execute commands)

## Image and Media Formats

| Hex | Format | Notes |
|-----|--------|-------|
| `89 50 4E 47 0D 0A 1A 0A` | PNG | Can contain steganographic payloads |
| `FF D8 FF` | JPEG | Appended data after `FF D9` end marker |
| `47 49 46 38` | GIF | Can contain polyglot payloads |
| `42 4D` | BMP | Large BMPs may hide data in pixel values |
| `52 49 46 46` | RIFF (AVI/WAV) | |

## Other Notable Formats

| Hex | Format | Malware Relevance |
|-----|--------|-------------------|
| `4D 44 4D 50` | MDMP (minidump) | Credential dumping output |
| `72 65 67 66` | Windows registry hive | Exported registry data |
| `53 51 4C 69 74 65` | SQLite | Browser data theft targets |
| `50 4B 03 04` + `classes.dex` | APK (Android) | Mobile malware |
| `64 65 78 0A` | DEX (Dalvik) | Android executable |
| `43 44 30 30 31` at 0x8001 | ISO 9660 | Disk image malware delivery |

## Packer and Protector Signatures

| Indicator | Packer/Protector |
|-----------|-----------------|
| `UPX!` in section or overlay | UPX |
| `.UPX0`, `.UPX1` sections | UPX |
| `.aspack` section | ASPack |
| `.adata` section | ASPack |
| `.themida` section | Themida |
| `.vmp0`, `.vmp1` sections | VMProtect |
| `ENIGMA` string | Enigma Protector |
| `.ndata` section | NSIS installer |
| `Nullsoft` string | NSIS installer |
| `.rsrc` only writable section | Possible .NET packer |

## Quick Detection Script

```bash
# Read first 16 bytes as hex
xxd -l 16 -p suspicious_file

# Compare against known signatures
file suspicious_file
file --mime-type suspicious_file

# Check for packer indicators
strings suspicious_file | grep -iE "UPX|ASPack|Themida|VMProtect|Enigma|MPRESS"
```