Skip to main content

Definitions

AMWScan ships its built-in detection data through the Signatures API. These definitions do not require a download or remote reputation lookup.

Embedded definitions include:

  • Plain text fragments and optimized regular expressions.
  • Exact SHA-256 malware hashes generated from the repository fixture corpus.
  • Fixed-width known-malware MD5-prefix candidates.
  • Normalized legacy-core SHA-256 signatures used by the optional WordPress module.
  • 54 suspicious domains curated from malware fixtures and excluded when found in clean fixtures or identified as legitimate shared services.

Integrity manifests​

Trusted manifests report missing, modified, and unexpected managed files. WordPress core integrity covers root core files, wp-admin, and wp-includes; it excludes user-managed wp-content, including optional bundled plugins and themes. On Windows, manifest paths are compared case-insensitively to match filesystem behavior.

The WordPress plugin offers a Restore trusted file action for missing files recorded by a trusted WordPress core manifest when ext-zip is available, including optional bundled files retained in historical reports. It downloads the matching official WordPress release, extracts only the selected file, verifies its trusted manifest checksum, and writes it inside the scanned WordPress root. Exceptions remain available for findings that are expected in the site's configuration.

Local Maltrail definitions​

At scan startup, AMWScan downloads the current Maltrail malware-domain trails into its private operating-system cache and rebuilds the local index. The cache is outside the scanned project and never needs to be committed. Reports expose its record count, source hash, generated index hash, and update time.

Domain matches are warning-level indicators because previously malicious infrastructure can be remediated or reassigned. A truncated hash or historical domain reference is insufficient to confirm malware by itself.