-3

I'm looking to store two types of hashes for recognizing blacklisted code. These are the FireEye "import hash" (or imphash) and the ssdeep "fuzzy hash". Is there a regex (or formal documentation) I can use for type-checking these hashes?

The examples I've seen of an imphash look like MD5, but I haven't found a formal commitment to 32 hex characters. Similarly, I've seen a few examples of a fuzzy hash, but no commitment to a particular length, character set, or format.

Thanks.... (Cross-posted to Cryptography)

closed as off-topic by user45139, Deer Hunter, schroeder Oct 10 '15 at 16:06

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Community, Deer Hunter, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Please do not cross-post on StackExchange sites – schroeder Oct 9 '15 at 22:38
  • 2
    I'm also not sure this question is on-topic on either site – schroeder Oct 9 '15 at 22:40
  • 1
    What it looks like you are asking is simply about the specification of the 2 hash types you mention, and then to use those specs to design a regex. If you get the specs, you can ask the question over at stackoverflow. – schroeder Oct 9 '15 at 22:44
1

The examples I've seen of an imphash look like MD5, but I haven't found a formal commitment to 32 hex characters.

The first hit I get when googling for imphash is https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html which clearly states:

...Generating the MD5 hash of the ordered list

ssdeep hashes are completely different when looking at http://ssdeep.sourceforge.net/usage.html

Not the answer you're looking for? Browse other questions tagged or ask your own question.