
Operationalizing Threat Intelligence
By :

We wanted to wrap up the last section of this chapter by talking about hashing and fingerprinting tools that are widely used for similarity analysis. The core difference between using the grouping techniques we talked about earlier in this chapter and those in this section is that hashing and fingerprinting tools are typically executed on files or unique artifacts. These are then used to determine the similarity between the files or data that's being analyzed. The methods we have talked about so far have all pivoted off artifacts and indicators of malware and infrastructure. Let's discuss the first tool concept – import hashing.
Import hashing (imphashing) is a technique in which hash values are created and calculated based on the library or imported function names and their order within the executable. Simply put, imphashing is where you compute a hash of the Import Address Table (IAT). We first introduced you...
Change the font size
Change margin width
Change background colour