Malware Theory - Imphash algorithm explained
Channel: MalwareAnalysisForHedgehogs
Date: 2021-04-14

The imphash or import hash by Mandiant has been widely adopted by malware databases, security software and PE tools. What is it used for? How does it work? And can it be improved?

My malware analysis course for beginners: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?referralCode=EE0E2DC9FA7388FF25B7
Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: https://twitter.com/struppigel

Mandiant article: https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html
Earlier mentions of import hashing: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-malware-supply-chain.pdf
Defeating imphash: https://malcomvetter.medium.com/defeating-imphash-fb7cf0183ac
pefile: https://github.com/erocarrera/pefile
Fuzzy import hashing: https://researchportal.port.ac.uk/portal/files/23272948/FUZZ_IEEE_20_Fuzzy_Import_Hashing.pdf
TypeRef hash article: https://www.gdatasoftware.com/blog/2020/06/36164-introducing-the-typerefhash-trh
TypeRef hash implementation on Github https://github.com/secana/PeNet/blob/master/docfx/articles/typerefhash.md