Malware Fingerprinting

Analyzes the executable file without running it, examining its structural and syntactic properties.

• Byte N-grams: Sequences of raw bytes used to identify code patterns.
• PE Header Analysis: Extracts metadata from the Portable Executable format, including compile timestamps, imported DLLs, and section entropy.
• String Extraction: Identifies embedded ASCII and Unicode strings like URLs, registry keys, and mutex names.
• Opcode Frequency: Counts the distribution of assembly instructions to classify compiler families or packing tools. Static features are fast to compute but vulnerable to obfuscation and packing.

Captures runtime actions by detonating the sample in a controlled sandbox environment.

• API Call Sequences: Logs the order and frequency of Windows API calls (e.g., NtAllocateVirtualMemory, CreateRemoteThread) to map process injection techniques.
• Network Traffic Patterns: Records DNS queries, HTTP requests, and TLS handshake metadata to fingerprint command-and-control (C2) infrastructure.
• Filesystem Modifications: Tracks file creation, deletion, and registry persistence mechanisms.
• Mutex and Pipe Names: Identifies hardcoded synchronization objects used for single-instance checks. Behavioral fingerprints are resilient to static packing but require evasive malware to be tricked into executing.

Employs similarity digest algorithms like ssdeep and TLSH to compute hashes that correlate with file similarity, not just exact matches.

• Context-Triggered Piecewise Hashing (CTPH): ssdeep's core algorithm that resets hash boundaries based on internal file patterns, enabling detection of patched variants.
• Trend Micro Locality Sensitive Hash (TLSH): A distance metric that groups similar files even when compiled with different toolchains.
• Use Case: Clustering polymorphic malware families where each generation is slightly mutated. Fuzzy hashing bridges the gap between brittle cryptographic hashes and computationally expensive full-file comparisons.

Represents the malware's logic as a graph structure to capture semantic intent beyond syntactic changes.

• Control Flow Graphs (CFGs): Nodes represent basic blocks of instructions; edges represent jumps and calls. Subgraph isomorphism can identify reused code regardless of register renaming.
• Call Graphs: Maps the relationships between functions, revealing the high-level program structure.
• Abstract Syntax Trees (ASTs): Used for script-based malware (PowerShell, JavaScript) to fingerprint deobfuscated logic. Graph-based methods are computationally intensive but highly resistant to superficial obfuscation techniques.

Leverages machine learning to project extracted features into a dense, high-dimensional vector space where similar malware samples cluster together.

• Autoencoder Networks: Train on static or behavioral features to learn a compressed latent representation that serves as the fingerprint.
• Siamese Networks: Learn a similarity function directly, ensuring that variants of the same family have a small cosine similarity distance.
• Operational Benefit: Enables approximate nearest neighbor (ANN) search using libraries like FAISS to query millions of samples in milliseconds. Embedding-based fingerprints excel at generalizing to never-before-seen variants of known families.

Distinguishes between fingerprints designed for exact identification and those designed for variant detection.

• Cryptographic Hashes (SHA-256, MD5): Brittle indicators of compromise (IOCs). A single byte change yields a completely different hash. Useful for blocklisting a specific, known-bad binary.
• Perceptual/Similarity Hashes: Designed to survive modifications. A small change in the file produces a proportionally small change in the hash.
• Hybrid Approach: Modern threat intelligence platforms combine both. A cryptographic hash triggers an exact-match alert, while a fuzzy hash or embedding links the sample to a broader campaign or threat actor group.

The process of analyzing a malicious executable without executing it to derive a fingerprint. Key features extracted include:

• Byte n-grams: Frequency distributions of byte sequences
• Opcode sequences: Patterns in disassembled instruction mnemonics
• PE header metadata: Compilation timestamps, section entropy, imported DLLs
• Printable strings: Embedded URLs, registry keys, and mutex names These features are often vectorized and fed into gradient-boosted trees or deep neural networks for family classification.

Identifies reused code fragments across malware samples by comparing control flow graphs (CFGs) and abstract syntax trees at the function level. This granular fingerprinting detects code sharing between different families and identifies statically linked libraries. Techniques include:

• Graph isomorphism heuristics on normalized CFGs
• Birthmarking: Extracting inherent, hard-to-modify characteristics of a function's logic
• Deep graph neural networks that learn function embeddings for efficient similarity search in large-scale malware corpora