Hash techniques

← maldev README · docs/index

The hash/ package supplies three families of hashing primitives: cryptographic (MD5, SHA-1, SHA-256, SHA-512) for integrity and identifiers, API hashing (ROR13 + ROR13Module) for shellcode-style plaintext-free function resolution, and fuzzy hashing (ssdeep, TLSH) for variant detection and similarity scoring.

TL;DR

Where to start (novice path):

  1. Need to fingerprint a buffer? → SHA256 (cryptographic-hashes.md). Standard integrity hash.
  2. Need to resolve Win32 APIs by hash (no plaintext name in the binary)? → ROR13 + ROR13Module. Pair with syscalls/api-hashing for the runtime resolution side.
  3. Need to score similarity between samples (variant detection, morph verification)? → fuzzy-hashing — ssdeep + TLSH.

Packages

PackageTech pageDetectionOne-liner
hashcryptographic-hashes.md · fuzzy-hashing.mdvery-quietMD5/SHA-* (integrity), ROR13 (API hashing), ssdeep + TLSH (similarity)

Quick decision tree

You want to…Use
…identify a payload by contenthash.SHA256
…compute a Windows API name hash for a shellcode resolverhash.ROR13
…compute a module-name hash matching PEB-walk shellcodehash.ROR13Module
…score similarity between two samples (variant detection)hash.SsdeepCompare or hash.TLSHCompare
…screen a directory of suspicious binaries against a known-bad seedsee Advanced example

MITRE ATT&CK

The hash package itself is utility. It is referenced from techniques that consume it:

Used byWhy
win/api.ResolveByHashPlaintext-free Win32 API resolution (T1027.007)
Researcher / hunter workflowsVariant detection, signature defeat measurement
pe/morphBuild-time fingerprint shifting; pair with fuzzy hashing to verify the morph kept the family intact

See also