This is the third post in a series of blog posts about the Content IQ Test. We look at how ClamAV would handle detecting the target string when embedded in polymorphic files. If you were to compute the MD5 checksum of these test files, you’d see that not two are the same. This is what I mean when a text file contains a file contained in a zip file. This means that not only one of the test files is found to contain a target string, but not all of them are polymorphic.”]
Source: https://blog.talosintelligence.com/2012/04/clamav-vs-content-iq-test-part-3.html