/etc/sigscan.conf is in libsigscan-utils 20170124-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 | # Signature definitions file for the sigscan tool
#
# identifier offset pattern
7z 0 7z\xbc\xaf\x27\x1c
bzip2 4 \x31\x41\x59\x26\x53\x59
esedb 4 \xef\xcd\xab\x89
evt 0 \x30\x00\x00\x00LfLe\x01\x00\x00\x00\x01\x00\x00\x00
evtx 0 ElfFile\x00
ewf_e01 0 EVF\x09\x0d\x0a\xff\x00
ewf_l01 0 LVF\x09\x0d\x0a\xff\x00
gzip 0 \x1f\x8b
jpeg 0 \xff\xd8\xff
lnk 0 \x4c\x00\x00\x00\x01\x14\x02\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00\x46
msiecf 0 Client\x20UrlCache\x20MMF\x20Ver\x20
nk2 0 \x0d\xf0\xad\xba\xa0\x00\x00\x00\x01\x00\x00\x00
olecf 0 \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1
olecf_beta 0 \x0e\x11\xfc\x0d\xd0\xcf\x11\x0e
pdf 0 %PDF
pff 0 !BDN
qcow 0 QFI\xfb
rar 0 Rar!\x1a\x07\x00
regf 0 regf
sqlite2 0 **\x20This\x20file\x20contains\x20an\x20SQLite\x202
sqlite3 0 SQLite\x20format\x203\x00
tar 257 ustar\x00
tar_old 257 ustar\x20\x20\x00
vhdi_header 0 conectix
vhdi_footer -512 conectix
wtcdb_cache 0 CMMM
wtcdb_index 0 IMMM
zip 0 PK\x03\x04
|