I'm trying to understand more about MD5 and SHA1 hashes algorithms and their behavior in serious security software(found this but not helped me more).
Why does ClamAV use additional scanning techniques(MD5 for a speciﬁc section in a PE ﬁle, Wildcards, Icon signatures for PE ﬁles....) rather than just comparing MD5 of an existing malware?
Why isn't it just calculating the MD5 hash of the entire file? (As I know MD5 and SHA1 hashes functions are extremely accurate)
I'm not talking about heuristic detection, as this is can be done by hooking into the API call of the executable.