I have a bunch of PE files for which I need to create the ICON_HAHS based
signatures, In documentation, here
it says

The ICON_HASH field can be obtained from the debug output of libclamav.

I have ran the clamscan on PE files with --debug flag but there is no field
named ICON_HASH in output.
I am also confused about the purpose of IconGroup1 or IconGroup2  and how I
need to define them in .idb file.

My apologies, if I am missing something obvious. I spent around 3 hours to
find an answer about this before sending this email.

Thank you all.

Irshad Muhammad.
clamav-users mailing list

Help us build a comprehensive ClamAV guide:


Reply via email to