// REFERENCE

CHM help file signature

Signature (hex): 49 54 53 46 (ITSF) High risk

A compiled Windows help file (.chm) starts with 49 54 53 46 (ITSF). It can run scripts and embedded objects: a phishing and malware vector heavily used by APT groups.

Related tools

Work with this in:

Magic bytes identifier
Email analyzer

pdf
PDF signature ole
OLE2 signature (legacy DOC/XLS/PPT/MSI) docx
DOCX/XLSX/PPTX signature rtf
RTF signature epub
EPUB signature odt
OpenDocument (ODT/ODS/ODP) signature

Signatures verifiable with CyberEscudo's magic-bytes identifier. Educational content.