peHash: a novel approach to fast malware clustering

摘要: Data collection is not a big issue anymore with available honeypot software and setups. However malware collections gathered from these systems often suffer massive sample counts, data analysis like sandboxes cannot cope with. Sophisticated self-modifying able to generate new polymorphic instances of itself different message digest sums for each infection attempt, thus resulting in many samples stored the same specimen. Scaling that are fed by databases rely on uniqueness based digests only feasible certain extent. In this paper we introduce non cryptographic, fast calculate hash function binaries Portable Executable format transforms structural information about into value. Grouping values calculated allows detection multiple specimen as well broken e.g. due transfer errors. Practical evaluation sets shows significant reduction counts.