4

I'm reading a sans paper on IOCs (indicators of compromise) in malware forensics and I came across this interesting obstacle:

polymorphic and metamorphic codes (Paxson, 2011) result in multiple hash identities for the same class of malware

Now I understand the existence of IOCs and the frameworks (such as OpenIOC) purpose is to account for this flaw in using hashing as a way of identification. But I'm trying to dig in a little deeper into the way we use hashing, and perhaps create a solution. Unless there's already a solution in which case that'd be the answer to this question

Is there an alternative to using hashing to identify malware?

My idea is to create a way to hash something that expresses the level of difference between the two, maybe call this a "measured hash," where the first, middle, or last portion of hash of length x, shows the same values for binaries with the same values. Maybe, by definition, what I'm describing is no longer a hash but it'd still be a program or function that takes a binary and outputs a fixed length representation of that binary for identification purposes. Then if only one small element of the binary is different, we'd be looking at a hash that is very similar to the hash of the original.

Using sha1 hash as an example: CA422BBF6E52040FF0580F7C209F399897020A7A

Is the result of this sentence:

I'm stealing all your files using this binary but then I'll recompile another binary after adding or subtracting a few blocks of code

Now if I change the last three words of this sentence I get: F5BB055C7F7E76275C6F0528D2ACD6F288CE7496

Which is no surprise for anyone who knows hashing 101. My proposal is to use a mechanism that gets me something like this for the before CA422BBF6E52040FF0580F7C209F399897020A7A and this for the after: CA422BBF6E52040FF0580F7C209F399897029B10 because, after all, only three words were deleted and replaced by a single word.

What I'm NOT looking for in an answer, is a list of artifacts or frameworks that are already being used to identify malware. What I would like to know is if such a tool already exists or if my idea is preposterous and wouldn't be of value to forensic investigators looking to share the intelligence of their research.

9
  • 1
    You appear to omit any heuristic/behaviours for identifying malware. Does that mean that you are looking for a better "signature-based" approach?
    – schroeder
    Commented Nov 18, 2019 at 19:54
  • 1
    Hashing is not what you need to look at. You need to compare the raw binary and look for similarities. Hashing will lead you away from that.
    – schroeder
    Commented Nov 18, 2019 at 19:57
  • 1
    Do you understand that polymorphic viruses result is very different outputs and not something that is akin to changing "the last 3 words"?
    – schroeder
    Commented Nov 18, 2019 at 19:58
  • 2
    @Robert If you need a question deleted for legal reasons (for example) then flag the question with "In need of moderator intervention" and explain the situation to the moderators. However, schroeder's comments do not mean the question should be deleted. Commented Jan 7, 2022 at 16:58
  • 4
    @RobertHoughton Actually the website won't let you delete it because deleting the question means deleting the answers as well. Since the answers are considered good (they have upvotes), you can't delete. (see meta.stackexchange.com/a/5222). If you have a good reason for deleting, flag the question. Vandalizing the post will not help (see meta.stackexchange.com/a/209438) Commented Jan 7, 2022 at 17:26

2 Answers 2

2

It depends for what you need to use hash-based signatures, but if we look in clamav signatures there are some options:

  • Hash-based signatures

To create MD5 signature you can use sigtool:

sigtool --md5 test.exe > test.hdb

You can also go with SHA1 and SHA256 signatures:

HashString:FileSize:MalwareName

Another options is Hash signatures with unknown size:

HashString:*:MalwareName:73

Is there an alternative to using hashing to identify malware?

  • And then you have body-based signatures.

ClamAV stores all body-based signatures in a hexadecimal format. In this section by a hex-signature we mean a fragment of malware’s body converted into a hexadecimal string which can be additionally extended using various wildcards.

Simple rule format can be used in this way:

MalwareName=HexSignature

You can also check YARA tool for creating body-based signatures.

1

Something I don't see mentioned here yet is context triggered piecewise hashes (CTPH), more commonly known as fuzzy hashing. These hash functions differ from regular cryptographic hash functions in that they don't they provide diffusion (i.e. there is no avalanche effect), but still obscure the relation between the input and the hash.

Fuzzy hashes are already used in malware detection and analysis, common ones being SSDeep and TLSH. Although I cannot readily find any research on the effectiveness of fuzzy hashing against polymorphic malware, this blog post suggests Microsoft has attempted to combine fuzzy hashing with deep learning for better results at catching polymorphic malware

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .