SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
diffing-malware-samples-to-find-changes
0
Compares two related malware samples to surface what changed between variants using section-level hashing, import-set differences, and fuzzy similarity scoring. Activates for requests to diff two samples, compare malware variants, or measure similarity between two binaries for variant tracking.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Diffing Malware Samples to Find Changes ## When to Use - You have two related samples (suspected variants of one family) and want a fast, structural diff before a full BinDiff. - You need to quantify similarity and pinpoint changed sections/imports for variant tracking. **Do not use** this as authoritative function-level diffing — that requires BinDiff/Diaphora on disassembly. This skill does structural/statistical diffing and executes nothing. ## Prerequisites - Two sample files (read inertly). Optional: `ssdeep`/`tlsh` for fuzzy scores (degrade gracefully). ## Workflow ### Step 1: Structural diff ```bash python scripts/analyst.py diff a.bin b.bin ``` Compares file size, per-section SHA-256 and entropy, and the import name sets, reporting added/ removed/changed sections and imports. ### Step 2: Similarity score Reports a byte-level similarity ratio and, if available, ssdeep/tlsh fuzzy-hash comparison scores. ### Step 3: Prioritize changed regions Changed sections (same name, different hash) and new imports are the high-value targets for deeper disassembly diffing. ### Step 4: Document Record what changed and the similarity score to support variant/lineage tracking. ## Validation - Section comparison keys on section name; identical sections report equal hashes. - Import diff lists are accurate (added vs removed vs common). - Fuzzy-hash scores are reported only when the library is available, else clearly omitted. ## Pitfalls - Recompilation shifting addresses makes raw byte diff noisy — rely on section/import structure. - Packers making both samples look similar (packed) while the payloads differ — unpack first. - Treating a high byte-similarity as proof of same author without corroboration. ## References - See [`references/api-reference.md`](references/api-reference.md) for the differ. - PE format and ssdeep references (linked in frontmatter).