Chapter 0¶

Disclaimer : There is no such chapter in the actual Practical Malware Analysis book.

In the midst of working with a few malware samples, I realised that some of them have similar code structure, functions and imports despite difference in hash.
The purpose of this chapter is to prevent double work for malware analysis.
Whilst I understand the reason for using the same malware (lesson objectives) I am using the malware in this book as samples to practice on, build an analysis workflow and gain confidence hence the need to not do double work.
This will also has the added benefit of teaching how to identify variants of the same malware or when polymorphism techniques are used.

SSDEEP¶

A quick and dirty method employed here will be to use this tool SSDEEP which is a fuzzy hashing tool.
While there are other techniques used like ImpHash and section hash, SSDEEP is the only tool known to me that can do it at scale and automatically.

ssdeep -d -r -c ./Folder_with_malware