85 lines
2.7 KiB
Markdown
85 lines
2.7 KiB
Markdown
---
|
|
name: diffing-malware-samples-to-find-changes
|
|
description: 'Compares two related malware samples to surface what changed between variants using
|
|
section-level hashing, import-set differences, and fuzzy similarity scoring. Activates for
|
|
requests to diff two samples, compare malware variants, or measure similarity between two binaries
|
|
for variant tracking.'
|
|
domain: cybersecurity
|
|
subdomain: reverse-engineering
|
|
tags:
|
|
- reverse-engineering
|
|
- bindiff
|
|
- variant-analysis
|
|
- similarity
|
|
- triage
|
|
version: 1.0.0
|
|
author: analyst-ai-pack
|
|
license: Apache-2.0
|
|
mitre_attack:
|
|
- T1587.001
|
|
- T1027
|
|
- T1588.001
|
|
d3fend:
|
|
- D3-FA
|
|
- D3-DA
|
|
references:
|
|
- 'PE Format — https://learn.microsoft.com/windows/win32/debug/pe-format'
|
|
- 'ssdeep fuzzy hashing (CTPH) — https://ssdeep-project.github.io/ssdeep/'
|
|
---
|
|
|
|
# Diffing Malware Samples to Find Changes
|
|
|
|
## When to Use
|
|
|
|
- You have two related samples (suspected variants of one family) and want a fast, structural diff
|
|
before a full BinDiff.
|
|
- You need to quantify similarity and pinpoint changed sections/imports for variant tracking.
|
|
|
|
**Do not use** this as authoritative function-level diffing — that requires BinDiff/Diaphora on
|
|
disassembly. This skill does structural/statistical diffing and executes nothing.
|
|
|
|
## Prerequisites
|
|
|
|
- Two sample files (read inertly). Optional: `ssdeep`/`tlsh` for fuzzy scores (degrade gracefully).
|
|
|
|
## Workflow
|
|
|
|
### Step 1: Structural diff
|
|
|
|
```bash
|
|
python scripts/analyst.py diff a.bin b.bin
|
|
```
|
|
|
|
Compares file size, per-section SHA-256 and entropy, and the import name sets, reporting added/
|
|
removed/changed sections and imports.
|
|
|
|
### Step 2: Similarity score
|
|
|
|
Reports a byte-level similarity ratio and, if available, ssdeep/tlsh fuzzy-hash comparison scores.
|
|
|
|
### Step 3: Prioritize changed regions
|
|
|
|
Changed sections (same name, different hash) and new imports are the high-value targets for deeper
|
|
disassembly diffing.
|
|
|
|
### Step 4: Document
|
|
|
|
Record what changed and the similarity score to support variant/lineage tracking.
|
|
|
|
## Validation
|
|
|
|
- Section comparison keys on section name; identical sections report equal hashes.
|
|
- Import diff lists are accurate (added vs removed vs common).
|
|
- Fuzzy-hash scores are reported only when the library is available, else clearly omitted.
|
|
|
|
## Pitfalls
|
|
|
|
- Recompilation shifting addresses makes raw byte diff noisy — rely on section/import structure.
|
|
- Packers making both samples look similar (packed) while the payloads differ — unpack first.
|
|
- Treating a high byte-similarity as proof of same author without corroboration.
|
|
|
|
## References
|
|
|
|
- See [`references/api-reference.md`](references/api-reference.md) for the differ.
|
|
- PE format and ssdeep references (linked in frontmatter).
|