vlad/reverse-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
reverse-skills-max/vendor-new/analyst-ai-pack/skills/hashing-and-fingerprinting-files/SKILL.md

3.1 KiB
Raw Permalink Blame History

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references
name description domain subdomain tags version author license mitre_attack d3fend references
hashing-and-fingerprinting-files Computes cryptographic and fuzzy fingerprints for malware samples: MD5/SHA-1/SHA-256 for exact identity, plus import hashing (imphash), section hashing, and fuzzy hashes (ssdeep, TLSH) to cluster related variants. Activates for requests to hash a sample, compute imphash, or fingerprint files for similarity clustering. cybersecurity lab-foundations
lab-foundations
hashing
fingerprinting
imphash
fuzzy-hashing
clustering
1.0.0 analyst-ai-pack Apache-2.0
T1027
D3-FH
ssdeep fuzzy hashing — https://ssdeep-project.github.io/ssdeep/
TLSH locality-sensitive hashing — https://github.com/trendmicro/tlsh

Hashing and Fingerprinting Files

When to Use

  • You need a stable identity for a sample to look up, deduplicate, or share as an IOC.
  • You want to cluster related variants that differ slightly using fuzzy/similarity hashes.
  • You are computing imphash or section hashes to pivot across a malware family.

Do not use cryptographic hashes alone to judge similarity — a single byte change yields a completely different SHA-256; use fuzzy/import hashing for relatedness.

Prerequisites

  • Python with hashlib (stdlib); optionally ssdeep/python-tlsh for fuzzy hashes and pefile for imphash.
  • Samples handled in the isolated lab per the safe-handling skill.

Safety & Handling

  • Treat every sample as live: never execute it during hashing; operate on the inert file only.
  • Store samples encrypted/password-protected and reference them by hash, not by original name.

Workflow

Step 1: Compute cryptographic hashes

Generate MD5, SHA-1, and SHA-256. SHA-256 is the canonical identity for sharing; MD5/SHA-1 aid lookups in legacy feeds.

python scripts/analyst.py hash sample.bin

Step 2: Compute structural hashes (PE)

For PE files, compute imphash (hash of the import table) and per-section hashes to pivot across samples built from the same toolchain.

Step 3: Compute fuzzy/similarity hashes

Generate ssdeep and/or TLSH digests so near-duplicates can be matched even when bytes differ.

Step 4: Record and cross-reference

Store all digests with the sample metadata; query threat-intel feeds by SHA-256 and cluster by imphash/fuzzy hash.

Validation

  • The same input always yields identical cryptographic hashes (deterministic).
  • Imphash matches across known-related samples; fuzzy hashes score high similarity for variants.
  • Digests are recorded alongside sample metadata for later pivoting.

Pitfalls

  • Treating MD5 collisions as identity proof; use SHA-256 as canonical.
  • Assuming different cryptographic hashes mean unrelated files; check fuzzy/import hashes.
  • Computing imphash on packed samples (imports are stubbed) and over-trusting the result.

References