[clamav-users] Email payload in .img container

[Steve Basford]

On 2020-02-18 02:02, Paul Kosinski via clamav-users wrote:
> How big is the img file? ClamAV has a 4 GB (2**32-1) size limit (alas),
> maybe others do too.
> 
Here's 3 samples from a few days ago, so vary in size but not near  4 
GB...



7z l *.img

Path = DOC_9862833__.img
Type = Iso
Physical Size = 122880
Created = 2020-02-14 10:41:32
Modified = 2020-02-14 10:41:32

    Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  
------------------------
2020-02-14 08:25:01 .....        61440        61440  DOC_9862833  .exe
------------------- ----- ------------ ------------  
------------------------
2020-02-14 08:25:01              61440        61440  1 files

Listing archive: INVOICE88889.IMG

--
Path = INVOICE88889.IMG
Type = Udf
Physical Size = 1245184
Comment = INVOICE88889
Cluster Size = 2048
Created = 2020-02-14 06:52:20

    Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  
------------------------
2020-02-14 06:43:22 .....       114688       114688  INVOICE88889.exe
------------------- ----- ------------ ------------  
------------------------
2020-02-14 06:43:22             114688       114688  1 files

Listing archive: Purchase_Order_LPO141223.img

--
Path = Purchase_Order_LPO141223.img
Type = Iso
Physical Size = 118784
Created = 2020-02-14 07:15:20
Modified = 2020-02-14 07:15:20

    Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  
------------------------
2020-02-14 07:10:15 .....        57344        57344  Purchase Order 
LPO141223.exe
------------------- ----- ------------ ------------  
------------------------
2020-02-14 07:10:15              57344        57344  1 files

------------------- ----- ------------ ------------  
------------------------
2020-02-14 08:25:01             233472       233472  3 files

Archives: 3
Volumes: 3
Total archives size: 1486848



clamscan --database=foxhole_filename.cdb *.img

DOC_9862833__.img: Sanesecurity.Foxhole.Iso_fs1729.UNOFFICIAL FOUND
INVOICE88889.img: Sanesecurity.Foxhole.Iso_fs1493.UNOFFICIAL FOUND
Purchase_Order_LPO141223.img: Sanesecurity.Foxhole.Iso_fs1146.UNOFFICIAL 
FOUND



clamscan --database=foxhole_all.cdb *.img
DOC_9862833__.img: Sanesecurity.Foxhole.Iso_exe.UNOFFICIAL FOUND
INVOICE88889.img: Sanesecurity.Foxhole.Iso_exe.UNOFFICIAL FOUND
Purchase_Order_LPO141223.img: Sanesecurity.Foxhole.Iso_exe.UNOFFICIAL 
FOUND




-- 
Cheers,

Steve
Sanesecurity