diff --git a/custom_signatures.yml b/custom_signatures.yml new file mode 100644 index 0000000..21df082 --- /dev/null +++ b/custom_signatures.yml @@ -0,0 +1,108 @@ +#file: noinspection SpellCheckingInspection +- bof: (?i)^576F726450726F0DFB000000000000000005985C8172030040CCC1BFFFBDF970 + extension: .lwp + puid: x-fmt/340 + signature: Lotus WordPro Document +- bof: (?i)^00001A000(3|4|5)10040000000000 + extension: '.123' + puid: aca-fmt/1 + signature: Lotus 1-2-3 Spreadsheet +- bof: (?i)(50|70)726F67(49|69)64[0-9A-F]{2,20}576f72642e446f63756d656e74 + extension: .doc + puid: aca-fmt/2 + signature: Microsoft Word Markup +- bof: (?i)(50|70)726F67(49|69)64[0-9A-F]{2,18}457863656C2E5368656574 + extension: .xls + puid: aca-fmt/3 + signature: Microsoft Excel Markup +- bof: (?i)75726e3a736368656d61732d6d6963726f736f66742d636f6d3a6f66666963653a657863656c + extension: .xls + puid: aca-fmt/3 + signature: Microsoft Excel Markup +- bof: (?i)^1a000003000014000000 + extension: .ntf + puid: aca-fmt/5 + signature: Lotus Notes Template +- bof: (?i)^0300000041505052 + extension: .adx + puid: aca-fmt/6 + signature: Lotus Approach Index File +- bof: (?i)^1a000004000029000000 + eof: (?i)bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb + extension: .nsf + operator: AND + puid: aca-fmt/8 + signature: Lotus Notes Database +- bof: (?i)4D696E644d616E61676572 + extension: .mmap + puid: aca-fmt/4 + signature: MindManager Mind Map +- bof: (?i)010000002E010000(43|03)000000 + extension: .id + puid: aca-fmt/7 + signature: ID File +- bof: (?i)474946383961 + extension: .gif + puid: fmt/4 + signature: GIF 1989a +- bof: (?i)010690080004000000000001000100010790060008000000E404000000000000E80001088007001800000049504D2E4D6963726F736F6674204D61696C2E4E6F746500310801 + extension: .dat + puid: aca-fmt/9 + signature: Microsoft email attachments archive (winmail) +- bof: (?i)010690080004000000000001000100010790060008000000E404000000000000E800010 + extension: .dat + puid: aca-fmt/9 + signature: Microsoft email attachments archive (winmail) +- bof: (?i)^789F3E22 + extension: .dat + puid: aca-fmt/9 + signature: Microsoft email attachments archive (winmail) +- bof: (?i)41636365737356657273696F6E.{0,1024}30362E + extension: .mdb + puid: aca-fmt/10 + signature: MS Access 95 +- bof: (?i)41636365737356657273696F6E.{0,1024}30372E + extension: .mdb + puid: aca-fmt/11 + signature: MS Access 97 +- bof: (?i)410063006300650073007300560065007200730069006F006E.{0,2048}300038002E00 + extension: .mdb + puid: aca-fmt/12 + signature: MS Access 2000 +- bof: (?i)410063006300650073007300560065007200730069006F006E.{0,2048}300039002E00 + extension: .mdb + puid: aca-fmt/13 + signature: MS Access 2002/3 +- bof: (?i)^000100005374616E64617264204A65742044420000000000 + extension: .mdb + puid: aca-fmt/14 + signature: MS Access database unspecified version (Jet 3 DB) +- bof: (?i)^000100005374616E64617264204A65742044420001000000 + extension: .mdb + puid: aca-fmt/15 + signature: MS Access database unspecified version (Jet 4 DB) +- bof: (?i)000100005374616E646172642041434520444200 + extension: .mdb + puid: aca-fmt/16 + signature: MS Access database unspecified version (ACE DB) +- bof: (?i)00A0E150E161BA2A6AB1A2A2FA5A9B5A7B5D90F1723131F2B0F17234F57639CA4A9A0A8ADA4A8AD161A390D1137A5A9B5A4A8ADB2B6DCBDBDF42B2F55C8CCD8C7CBD0D3D7FDC2C2F90 + extension: .map + puid: aca-fmt/17 + signature: MapInfo MAP file +- bof: (?i)^504B0304{26}6D696D65747970656170706C69636174696F6E2F766E642E6F617369732E6F70656E646F63756D656E742E74657874 + extension: .odt + puid: aca-fmt/18 + signature: OpenDocument Text (unspecified version) +- bof: (?i)41007000700072006F0061006300680044006F006300 + extension: .apr + puid: aca-fmt/19 + signature: Lotus Approach View File +- bof: (?i)^217461626C650D0A2176657273696F6E.{20,512}446566696E6974696F6E205461626C65 + extension: .tab + puid: aca-fmt/20 + signature: MapInfo TAB file +- bof: (?i)^bWltZXR5cGVhcHBsaWNhdGlvbi92bmQub2FzaXMub3BlbmRvY3VtZW50LnNwcmVhZHNoZWV0 + extension: .ods + plain_bof: mimetypeapplication/vnd.oasis.opendocument.spreadsheet + puid: aca-fmt/21 + signature: OpenDocument Spreadsheet (unspecified version)