SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
hashing-and-fingerprinting-files
0
Computes cryptographic and fuzzy fingerprints for malware samples: MD5/SHA-1/SHA-256 for exact identity, plus import hashing (imphash), section hashing, and fuzzy hashes (ssdeep, TLSH) to cluster related variants. Activates for requests to hash a sample, compute imphash, or fingerprint files for similarity clustering.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Hashing and Fingerprinting Files ## When to Use - You need a stable identity for a sample to look up, deduplicate, or share as an IOC. - You want to cluster related variants that differ slightly using fuzzy/similarity hashes. - You are computing imphash or section hashes to pivot across a malware family. **Do not use** cryptographic hashes alone to judge similarity — a single byte change yields a completely different SHA-256; use fuzzy/import hashing for relatedness. ## Prerequisites - Python with `hashlib` (stdlib); optionally `ssdeep`/`python-tlsh` for fuzzy hashes and `pefile` for imphash. - Samples handled in the isolated lab per the safe-handling skill. ## Safety & Handling - Treat every sample as live: never execute it during hashing; operate on the inert file only. - Store samples encrypted/password-protected and reference them by hash, not by original name. ## Workflow ### Step 1: Compute cryptographic hashes Generate MD5, SHA-1, and SHA-256. SHA-256 is the canonical identity for sharing; MD5/SHA-1 aid lookups in legacy feeds. ```bash python scripts/analyst.py hash sample.bin ``` ### Step 2: Compute structural hashes (PE) For PE files, compute imphash (hash of the import table) and per-section hashes to pivot across samples built from the same toolchain. ### Step 3: Compute fuzzy/similarity hashes Generate ssdeep and/or TLSH digests so near-duplicates can be matched even when bytes differ. ### Step 4: Record and cross-reference Store all digests with the sample metadata; query threat-intel feeds by SHA-256 and cluster by imphash/fuzzy hash. ## Validation - The same input always yields identical cryptographic hashes (deterministic). - Imphash matches across known-related samples; fuzzy hashes score high similarity for variants. - Digests are recorded alongside sample metadata for later pivoting. ## Pitfalls - Treating MD5 collisions as identity proof; use SHA-256 as canonical. - Assuming different cryptographic hashes mean unrelated files; check fuzzy/import hashes. - Computing imphash on packed samples (imports are stubbed) and over-trusting the result. ## References - See [`references/api-reference.md`](references/api-reference.md) for the hashing helper. - ssdeep and TLSH (linked in frontmatter).