contents matcher - for malwares