
<name>: the description of the virus
<value>: the value of a succesful hit

<header>
	<subject>: the subject of the email. Multiple are allowed.
</header>

<body>
	<patterns>: a block of strings and offset that define patterns in the attachment

		<pattern>: a block for containg pattern, child of <patterns>

			<offset>: child of <pattern>, contains the byte offset of the string to be matched. Optional.

			<string>: child of <pattern>, a byte string to be matched exactly (possible in  the future a regex)
</body>

<attachments>
	<fileSize>: a rule to match the size of the file in bytes

	<fileName excludes="pattern">: the file name of the attachment, can be a pattern
	



	<checksum type=sometype>: the checksum value of the extension, valid type values include CRC16, CRC21, MD5 and RC4


	<patterns>: a block of strings and offset that define patterns in the body of the attachment. This allows for checking for source code, for byte strings, etc. 

		<pattern>: a block for containg pattern, child of <patterns>

			<offset>: child of <pattern>, contains the byte offset of the string to be matched. Optional.

			<string>: child of <pattern>, a byte string to be matched exactly (possible in  the future a regex)

</attachments>


