reverse-skills-max/vendor-new/analyst-ai-pack/skills/diffing-malware-samples-to-find-changes/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
diffing-malware-samples-to-find-changes	Compares two related malware samples to surface what changed between variants using section-level hashing, import-set differences, and fuzzy similarity scoring. Activates for requests to diff two samples, compare malware variants, or measure similarity between two binaries for variant tracking.	cybersecurity	reverse-engineering	reverse-engineering bindiff variant-analysis similarity triage	1.0.0	analyst-ai-pack	Apache-2.0	T1587.001 T1027 T1588.001	D3-FA D3-DA	PE Format — https://learn.microsoft.com/windows/win32/debug/pe-format ssdeep fuzzy hashing (CTPH) — https://ssdeep-project.github.io/ssdeep/

Diffing Malware Samples to Find Changes

When to Use

• You have two related samples (suspected variants of one family) and want a fast, structural diff before a full BinDiff.
• You need to quantify similarity and pinpoint changed sections/imports for variant tracking.

Do not use this as authoritative function-level diffing — that requires BinDiff/Diaphora on disassembly. This skill does structural/statistical diffing and executes nothing.

Prerequisites

• Two sample files (read inertly). Optional: ssdeep/tlsh for fuzzy scores (degrade gracefully).

Workflow

Step 1: Structural diff

python scripts/analyst.py diff a.bin b.bin

Compares file size, per-section SHA-256 and entropy, and the import name sets, reporting added/ removed/changed sections and imports.

Step 2: Similarity score

Reports a byte-level similarity ratio and, if available, ssdeep/tlsh fuzzy-hash comparison scores.

Step 3: Prioritize changed regions

Changed sections (same name, different hash) and new imports are the high-value targets for deeper disassembly diffing.

Step 4: Document

Record what changed and the similarity score to support variant/lineage tracking.

Validation

• Section comparison keys on section name; identical sections report equal hashes.
• Import diff lists are accurate (added vs removed vs common).
• Fuzzy-hash scores are reported only when the library is available, else clearly omitted.

Pitfalls

• Recompilation shifting addresses makes raw byte diff noisy — rely on section/import structure.
• Packers making both samples look similar (packed) while the payloads differ — unpack first.
• Treating a high byte-similarity as proof of same author without corroboration.

References

• See references/api-reference.md for the differ.
• PE format and ssdeep references (linked in frontmatter).