I read in Peter Szor's Art of Computer Virus Research and Defense that, in the past, a 16-byte malware signature was sufficient to 16-bit detect malware, but that longer signatures are necessary for 32-bit malware. I am wondering how large the typical signature is for modern malware.

  • 1
    I find it hard to believe that the length of the address bus or registers directly corelates to the length of a malware signature. It's far more likely that malware was simpler back then, and thus required shorter signatures to detect it. As software (malware included) increases in complexity, so do signatures.
    – MechMK1
    Nov 7 '19 at 19:16
  • Yeah, I can see that being the case. I'm still interesting in knowing how long a viable signature is nowadays.
    – chillsauce
    Nov 7 '19 at 19:41

What antivirus vendors mean when they use the term signature is not digital signature/hash/checksum. A malware signature here is really best described as a short program written in a domain specific language that can classify whether a file is or isn't malware. It does not necessarily have a specific length to it, but rather depends on the complexity of distinguishing it from legitimate software.

Further reading: How do antiviruses scan for thousands of malware signatures in a short time?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.