Clam 938 velvet sweatshop

[ragusaa]

Draft PR. NOT ready for review.

[lgtm-com]

This pull request introduces 1 alert when merging db73947 into 197113c - view on LGTM.com

new alerts:

• 1 for Multiplication result converted to larger type

[lgtm-com]

This pull request introduces 1 alert when merging 3d9f3e6 into b3a3b35 - view on LGTM.com

new alerts:

• 1 for Multiplication result converted to larger type

[lgtm-com]

This pull request fixes 1 alert when merging ac87635 into b3a3b35 - view on LGTM.com

fixed alerts:

• 1 for Multiplication result converted to larger type

[val-ms]

Outside of some very minor issues, this looks awesome. Very nice work, @ragusaa

I'm happy with the code review.

Next up,

1. I would like if you could can add a non-malware test case for the supported encryption type(s). If you can provide the samples/signatures, I'd be happy to create the test itself under clamscan_test.,py, or else you are welcome to do it.
2. We should do some regression testing on a big set from the zoo, and see what happens.

[lgtm-com]

This pull request fixes 1 alert when merging 7044d86 into a4e6868 - view on LGTM.com

fixed alerts:

• 1 for Multiplication result converted to larger type

[lgtm-com]

This pull request fixes 1 alert when merging 2694f89 into cf81299 - view on LGTM.com

fixed alerts:

• 1 for Multiplication result converted to larger type

[lgtm-com]

This pull request fixes 1 alert when merging 3d91a04 into cf81299 - view on LGTM.com

fixed alerts:

• 1 for Multiplication result converted to larger type

[lgtm-com]

This pull request fixes 1 alert when merging 13d1290 into cf81299 - view on LGTM.com

fixed alerts:

• 1 for Multiplication result converted to larger type

[lgtm-com]

This pull request fixes 1 alert when merging 47b9b0b into 449bcd2 - view on LGTM.com

fixed alerts:

• 1 for Multiplication result converted to larger type

[lgtm-com]

This pull request fixes 1 alert when merging 25eef13 into 449bcd2 - view on LGTM.com

fixed alerts:

• 1 for Multiplication result converted to larger type

[lgtm-com]

This pull request fixes 1 alert when merging 276ee61 into 449bcd2 - view on LGTM.com

fixed alerts:

• 1 for Multiplication result converted to larger type

[val-ms]

For any readers -- we moved the test to our internal repo, because the (entirely non-malicious) test file Andy created is detected by some antivirus for being understandably suspicious. We don't want the clam source, or even decrypted clam test files to be flagged by AV's.

Testing looked good in the jenkins pipelines. Merging.

[SecT0uch]

I'm having a sample that seems to be encrypted with VelvetSweatshop but clamav outputs "EncryptedWithVelvetSweatshop":0.

Is this because of LibClamAV debug: ole2: Invalid second bit, must be 0 ?

msoffcrypto-tool file.xls out.xls -p VelvetSweatshop works with no issue.

You can download the sample here: https://bazaar.abuse.ch/sample/ef30b686955d11c92ab89e6c5c5e4e61fc3d9797aca3d16d3011a1a6474847a6/