Difference between revisions of "ReNamer:Binary Signatures"
Jump to navigation
Jump to search
(HxD Hex Editor, and some rephrasing.) |
(Updated the file signature list to ReNamer 7.3) |
||
| Line 3: | Line 3: | ||
These signatures in files can be seen only with specialized tools, such as [http://mh-nexus.de/hxd HxD Hex Editor] and [http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm XVI32 Hex Editor]. | These signatures in files can be seen only with specialized tools, such as [http://mh-nexus.de/hxd HxD Hex Editor] and [http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm XVI32 Hex Editor]. | ||
| − | The signature list below | + | The signature list below corresponds to '''ReNamer 7.3''' dated 14 April 2021. |
<pre style="overflow:auto"> | <pre style="overflow:auto"> | ||
482B424544562050726F6475637473204C6963656E7365204B65792046696C650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001A, KEY, Avira Product Key | 482B424544562050726F6475637473204C6963656E7365204B65792046696C650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001A, KEY, Avira Product Key | ||
FFFE570069006E0064006F0077007300200052006500670069007300740072007900200045006400690074006F0072002000560065007200730069006F006E00200035002E0030003000, REG, Registry Data File 5.00 | FFFE570069006E0064006F0077007300200052006500670069007300740072007900200045006400690074006F0072002000560065007200730069006F006E00200035002E0030003000, REG, Registry Data File 5.00 | ||
| + | 504B0304????????????????????????????????????????????????????6D696D65747970656170706C69636174696F6E2F657075622B7A6970, EPUB, Open Publication Structure eBook | ||
| + | 504B0304????????????????????????????????????????????????????5B436F6E74656E745F54797065735D2E786D6C, DOCX|XLSX|PPTX, Microsoft Office Open XML Format document | ||
| + | 1A45DFA3010000000000001F4286810142F7810142F2810442F381084282847765626D42878102428581021853806701, WEBM, WebM Video File | ||
41565020416E7469766972616C2044617461626173652E202863294B6173706572736B79204C616220313939372D32, AVC, Kaspersky Anti-Virus Database | 41565020416E7469766972616C2044617461626173652E202863294B6173706572736B79204C616220313939372D32, AVC, Kaspersky Anti-Virus Database | ||
00000002FFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000, MAC, MacPaint Bitmap Graphic | 00000002FFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000, MAC, MacPaint Bitmap Graphic | ||
1A45DFA3934282886D6174726F736B61428781014285810118538067, MKV, Matroska Video Stream | 1A45DFA3934282886D6174726F736B61428781014285810118538067, MKV, Matroska Video Stream | ||
| + | 00000018667479706D7034320000000069736F6D6D703432, MP4, MP4 Video File | ||
| + | 000000186674797069736F6D0000000169736F6D61766331, MP4, MP4 Video File | ||
| + | 0000001C667479706D7034320000000069736F6D61766331, MP4, MP4 Video File | ||
24464C3240282329205350535320444154412046494C45, SAV, SPSS Data | 24464C3240282329205350535320444154412046494C45, SAV, SPSS Data | ||
4C0000000114020000000000C000000000000046, LNK, Windows Shortcut | 4C0000000114020000000000C000000000000046, LNK, Windows Shortcut | ||
| Line 33: | Line 39: | ||
414F4C204665656462616720, BAG, AOL Instant Messenger Buddy List | 414F4C204665656462616720, BAG, AOL Instant Messenger Buddy List | ||
52494646????????41434F4E, ANI, Windows Animated Cursor | 52494646????????41434F4E, ANI, Windows Animated Cursor | ||
| + | 52494646????????57454250, WEBP, Google WebP image file | ||
EFBBBF234558544D33550D0A, M3U8, MP3 Playlist (UTF-8) | EFBBBF234558544D33550D0A, M3U8, MP3 Playlist (UTF-8) | ||
110000005343410F000000, PF, Windows Prefetch | 110000005343410F000000, PF, Windows Prefetch | ||
| Line 44: | Line 51: | ||
67696D702078636620, GZ, GIMP Image | 67696D702078636620, GZ, GIMP Image | ||
234558544D33550D0A, M3U, MP3 Playlist | 234558544D33550D0A, M3U, MP3 Playlist | ||
| − | D0CF11E0A1B11AE1, DOC|PPT|XLS, Microsoft Office Document | + | D0CF11E0A1B11AE1, DOC|PPT|XLS|MSI|PUB, Microsoft Office or Installer Document |
5245474544495434, REG, Windows Registry Data | 5245474544495434, REG, Windows Registry Data | ||
300000004C664C65, EVT, Windows NT/2000 Event Viewer Log | 300000004C664C65, EVT, Windows NT/2000 Event Viewer Log | ||
Latest revision as of 03:48, 1 April 2022
ReNamer's Extension rule uses an internal binary signature database for detecting various file extensions.
These signatures in files can be seen only with specialized tools, such as HxD Hex Editor and XVI32 Hex Editor.
The signature list below corresponds to ReNamer 7.3 dated 14 April 2021.
482B424544562050726F6475637473204C6963656E7365204B65792046696C650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001A, KEY, Avira Product Key FFFE570069006E0064006F0077007300200052006500670069007300740072007900200045006400690074006F0072002000560065007200730069006F006E00200035002E0030003000, REG, Registry Data File 5.00 504B0304????????????????????????????????????????????????????6D696D65747970656170706C69636174696F6E2F657075622B7A6970, EPUB, Open Publication Structure eBook 504B0304????????????????????????????????????????????????????5B436F6E74656E745F54797065735D2E786D6C, DOCX|XLSX|PPTX, Microsoft Office Open XML Format document 1A45DFA3010000000000001F4286810142F7810142F2810442F381084282847765626D42878102428581021853806701, WEBM, WebM Video File 41565020416E7469766972616C2044617461626173652E202863294B6173706572736B79204C616220313939372D32, AVC, Kaspersky Anti-Virus Database 00000002FFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000, MAC, MacPaint Bitmap Graphic 1A45DFA3934282886D6174726F736B61428781014285810118538067, MKV, Matroska Video Stream 00000018667479706D7034320000000069736F6D6D703432, MP4, MP4 Video File 000000186674797069736F6D0000000169736F6D61766331, MP4, MP4 Video File 0000001C667479706D7034320000000069736F6D61766331, MP4, MP4 Video File 24464C3240282329205350535320444154412046494C45, SAV, SPSS Data 4C0000000114020000000000C000000000000046, LNK, Windows Shortcut 5B436C6F6E6543445D0D0A56657273696F6E3D, CCD, CloneCD Control File 000100005374616E6461726420414345204442, ACCDB, Access 2007 Database File 000100005374616E64617264204A6574204442, MDB, Microsoft Access Database 4D454449412044455343524950544F52, MDS, Media Descriptor CD Image File 0006156100000002000004D200001000, DB, Netscape Navigator (v4) database file 52494646????????43444441666D7420, CDA, Compact Disc Digital Audio (CD-DA) 52494646????????415649204C495354, AVI, Windows Audio Video Interleave 52494646????????524D494464617461, RMI, Windows Musical Instrument Digital Interface 52494646????????57415645666D7420, WAV, Waveform Audio 89504E470D0A1A0A0000000D49484452, PNG, Portable Network Graphics 50532D58204558450000000000000000, EXE, Playstation Executable 3026B2758E66CF11A6D900AA0062CE6C, WMA|WMV|ASF, Windows Media File 4F67675300020000000000000000, OGG, Ogg Vorbis Audio ??BE000000AB0000000000000000, WRI, Microsoft Write Document 0000000020000000FFFF0000FFFF, RES, Resource File 0000020006040600080000000000, WK1, 1-2-3 Spreadsheet 38425053000100000000000000, PSD, Photoshop Image ??????10123A001019040010, SIS, Symbian OS Installer File 414F4C204665656462616720, BAG, AOL Instant Messenger Buddy List 52494646????????41434F4E, ANI, Windows Animated Cursor 52494646????????57454250, WEBP, Google WebP image file EFBBBF234558544D33550D0A, M3U8, MP3 Playlist (UTF-8) 110000005343410F000000, PF, Windows Prefetch 4D54686400000006000100, MID, Musical Instrument Digital Interface (MIDI) 5B6175746F72756E5D0D0A, INF, Autorun File 64383A616E6E6F756E6365, TORRENT, BitTorrent Metainfo File 504B0304140008000800, JAR, Java Archive 424547494E3A564D5347, VMG, Nokia Text Message 5B706C61796C6973745D, PLS, Winamp Playlist 2E524D460000001200, RM, RealMedia Streaming Media 67696D702078636620, GZ, GIMP Image 234558544D33550D0A, M3U, MP3 Playlist D0CF11E0A1B11AE1, DOC|PPT|XLS|MSI|PUB, Microsoft Office or Installer Document 5245474544495434, REG, Windows Registry Data 300000004C664C65, EVT, Windows NT/2000 Event Viewer Log 4D53434600000000, CAB, Microsoft Cabinet File ????????6D6F6F76, MOV, QuickTime Movie FF4B455942202020, SYS, Keyboard Driver 255044462D312E, PDF, Adobe Portable Document Format 526172211A0700, RAR, WinRAR Compressed Archive 000001BA210001, MPG, MPEG 1 System Stream 52454745444954, REG, Registry Data File 377ABCAF271C, 7Z, 7-Zip Compressed Archive AC9EBD8F0000, QDF, Quicken Data D7CDC69A0000, WMF, Windows Metafile 010009000003, WMF, Windows 3.x Metafile 4A4152435300, JAR, JARCS Compressed Archive 424547494E3A, VCF, vCard File 2E7261FD00, RA, RealMedia Streaming Media 7B5C727466, RTF, Rich Text Format File 000001BA44, MPG, ProgDVBR MPEG2 Video 464F524D00, AIFF, Audio Interchange File 49735A21, ISZ, UltraISO ISO Zipped Format 4B4C7377, KEY, Kaspersky Anti-Virus Key 4D502B07, MPC, Musepack Audio 93B20000, LNG, SourceEdit Language Definition DF0000?F, DCU, Delphi Compiled Unit 00000100, ICO, Windows Icon 01000000, EMF, Extended (Enhanced) Windows Metafile Format CFAD12FE, DBX, Outlook Express E-mail Folder 47494638, GIF, Graphic Interchange Format 49492A00, TIF, Tagged Image Format 4D4D002A, TIF, Tagged Image Format 00000200, CUR, Windows Cursor C5D0D3C6, EPS, Encapsulated PostScript 3F5F0300, HLP, Windows Help File 49536328, CAB, Install Shield v5.x or 6.x Compressed File 504B0304, ZIP, ZIP Compressed Archive E3828596, PWL, Windows Password List EDABEEDB, RPM, RedHat Package Manager 50533244, SYS, PlayStation 2 Icon FF575043, WPD, WordPerfect Document 464C5601, FLV, Flash Video 000001, MPG, MPEG Video File 465753, SWF, Macromedia Flash Format 435753, SWF, Shockwave Flash (v5+) FFD8FF, JPG, JPEG/JIFF Image 1F8B08, GZ, GZip Compressed Archive 1F9D90, Z, UNIX Compressed Archive 494433, MP3, MP3 Audio FFFB, MP3, MP3 Audio FFFA, MP3, MP3 Audio 4D5A, EXE|COM|DLL|SYS, Windows Executable 424D, BMP, Windows OS/2 Bitmap Graphics 9501, SKR, PGP Private Keyring 9901, PKR, PGP Public Keyring
For more information regarding known file signatures look here: