Enum KnownType

pub enum KnownType<'a> {
    ELF(Elf<'a>),
    EXE(EXE<'a>),
    MachO(Macho<'a>),
    FatMachO(FatMacho<'a>),
    PEF(Pef<'a>),
    Office95(Office95<'a>),
    PDF(PDF<'a>),
    RTF(Rtf<'a>),
    Unknown(&'a [u8]),
}

Types known to MalwareDB

Variants

ELF(Elf<'a>)

Linux, *BSD, Haiku, Solaris, etc binaries

EXE(EXE<'a>)

Windows, DOS, OS/2 Executables. Anything ending with:

• .cpl
• .dll
• .exe
• .ocx
• .sys

MachO(Macho<'a>)

Single architecture macOS (and derivatives) binaries

FatMachO(FatMacho<'a>)

Multiple architecture macOS (and derivatives) binaries

PEF(Pef<'a>)

Classic Mac OS and Be OS

Office95(Office95<'a>)

Microsoft Office Compound Document Format

PDF(PDF<'a>)

Adobe PDF document

RTF(Rtf<'a>)

Rich Text File

Unknown(&'a [u8])

Files for which we don’t have an analytic or feature extractor, or are of an unknown type

Implementations

impl<'a> KnownType<'a>

pub fn new(data: &'a [u8]) -> Result<Self>

Known type from a sequence of bytes

Errors

Returns an error if the parser fails to process the detect type.

pub fn is_exec(&self) -> bool

Whether the sample is an executable file

pub fn is_doc(&self) -> bool

Whether the sample is a document type

pub fn created(&self) -> Option<DateTime<Utc>>

When the file was created

pub fn exec(self) -> Option<Box<dyn ExecutableFile + Send + 'a>>

Get the file’s inner executable type

pub fn children(&self) -> Option<Vec<KnownType<'_>>>

If the sample has a child KnownType, currently only supports [FatMachO]

pub fn contents(&self) -> &'a [u8]

Raw bytes of the sample

pub fn doc(self) -> Option<Box<dyn DocumentFile + Send + 'a>>

Get the inner document type

Trait Implementations

impl<'a> Clone for KnownType<'a>

fn clone(&self) -> KnownType<'a>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Debug for KnownType<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.