Monday, 3 February 2014

VirusTotal += imphash

Recently Mandiant blogged about a feature they call imphash, in Mandiant's own words:
One unique way that Mandiant tracks specific threat groups' backdoors is to track portable executable (PE) imports. Imports are the functions that a piece of software (in this case, the backdoor) calls from other files (typically various DLLs that provide functionality to the Windows operating system). To track these imports, Mandiant creates a hash based on library/API names and their specific order within the executable. We refer to this convention as an "imphash" (for "import hash"). Because of the way a PE's import table is generated (and therefore how its imphash is calculated), we can use the imphash value to identify related malware samples. We can also use it to search for new, similar samples that the same threat group may have created and used.
We are excited to announce that VirusTotal reports for Portable Executables now show this hash in the additional information tab:


When considering an individual report, this property might not be very useful on its own, however, if you happen to have an API key with additional information privileges you will also find the hash embedded in the JSON response. This means you can massively feed your own local database setup with the imphash and implement your own similarity search feature for your malware collection.

VirusTotal Intelligence users can already perform searches through our dataset according to this new property.

4 comments:

  1. シアリス:http://www.cialismall.com
    Cialis:http://www.cialismall.com
    レビトラ:http://www.levitramall.com
    levitra:http://www.levitramall.com
    精力剤:http://www.hikanpou.com
    精力剤:http://www.hakanpo.com
    威哥王:http://威哥王.kanpocom.com
    威哥王:http://xn--kwrt2jp9z.kanpocom.com
    巨人倍増:http://巨人倍増.hikanpou.com
    巨人倍増:http://xn--gmq15an1qquf.hikanpou.com
    紅蜘蛛:http://紅蜘蛛.hakanpo.com
    紅蜘蛛:http://xn--19zl5rhf.hakanpo.com

    シアリス:http://www.cialismall.com
    Cialis:http://www.cialismall.com
    レビトラ:http://www.levitramall.com
    levitra:http://www.levitramall.com
    精力剤:http://www.hikanpou.com
    精力剤:http://www.hakanpo.com
    威哥王:http://威哥王.kanpocom.com
    威哥王:http://xn--kwrt2jp9z.kanpocom.com
    巨人倍増:http://巨人倍増.hikanpou.com
    巨人倍増:http://xn--gmq15an1qquf.hikanpou.com
    紅蜘蛛:http://紅蜘蛛.hakanpo.com
    紅蜘蛛:http://xn--19zl5rhf.hakanpo.com

    シアリス:http://www.cialismall.com
    Cialis:http://www.cialismall.com
    レビトラ:http://www.levitramall.com
    levitra:http://www.levitramall.com
    精力剤:http://www.hikanpou.com
    精力剤:http://www.hakanpo.com
    威哥王:http://威哥王.kanpocom.com
    威哥王:http://xn--kwrt2jp9z.kanpocom.com
    巨人倍増:http://巨人倍増.hikanpou.com
    巨人倍増:http://xn--gmq15an1qquf.hikanpou.com
    紅蜘蛛:http://紅蜘蛛.hakanpo.com
    紅蜘蛛:http://xn--19zl5rhf.hakanpo.com

    シアリス:http://www.cialismall.com
    Cialis:http://www.cialismall.com
    レビトラ:http://www.levitramall.com
    levitra:http://www.levitramall.com
    精力剤:http://www.hikanpou.com
    精力剤:http://www.hakanpo.com
    威哥王:http://威哥王.kanpocom.com
    威哥王:http://xn--kwrt2jp9z.kanpocom.com
    巨人倍増:http://巨人倍増.hikanpou.com
    巨人倍増:http://xn--gmq15an1qquf.hikanpou.com
    紅蜘蛛:http://紅蜘蛛.hakanpo.com
    紅蜘蛛:http://xn--19zl5rhf.hakanpo.com

    シアリス:http://www.cialismall.com
    Cialis:http://www.cialismall.com
    レビトラ:http://www.levitramall.com
    levitra:http://www.levitramall.com
    精力剤:http://www.hikanpou.com
    精力剤:http://www.hakanpo.com
    威哥王:http://威哥王.kanpocom.com
    威哥王:http://xn--kwrt2jp9z.kanpocom.com
    巨人倍増:http://巨人倍増.hikanpou.com
    巨人倍増:http://xn--gmq15an1qquf.hikanpou.com
    紅蜘蛛:http://紅蜘蛛.hakanpo.com
    紅蜘蛛:http://xn--19zl5rhf.hakanpo.com

    シアリス:http://www.cialismall.com
    Cialis:http://www.cialismall.com
    レビトラ:http://www.levitramall.com
    levitra:http://www.levitramall.com
    精力剤:http://www.hikanpou.com
    精力剤:http://www.hakanpo.com
    威哥王:http://威哥王.kanpocom.com
    威哥王:http://xn--kwrt2jp9z.kanpocom.com
    巨人倍増:http://巨人倍増.hikanpou.com
    巨人倍増:http://xn--gmq15an1qquf.hikanpou.com
    紅蜘蛛:http://紅蜘蛛.hakanpo.com
    紅蜘蛛:http://xn--19zl5rhf.hakanpo.com

    シアリス:http://www.cialismall.com
    Cialis:http://www.cialismall.com
    レビトラ:http://www.levitramall.com
    levitra:http://www.levitramall.com
    精力剤:http://www.hikanpou.com
    精力剤:http://www.hakanpo.com
    威哥王:http://威哥王.kanpocom.com
    威哥王:http://xn--kwrt2jp9z.kanpocom.com
    巨人倍増:http://巨人倍増.hikanpou.com
    巨人倍増:http://xn--gmq15an1qquf.hikanpou.com
    紅蜘蛛:http://紅蜘蛛.hakanpo.com
    紅蜘蛛:http://xn--19zl5rhf.hakanpo.com

    ReplyDelete
  2. VigRx:http://www.hikanpou.com/product/VigRx.html
    D10催情剤:http://www.hikanpou.com/product/D10.html
    花痴:http://www.hikanpou.com/product/花痴.html
    威哥王:http://www.hikanpou.com/product/威哥王.html
    巨人倍増:http://www.hikanpou.com/product/巨人倍増.html
    淫インモラル:http://www.hikanpou.com/product/immoral.html
    インモラル:http://www.hikanpou.com/product/immoral.html
    妖姫:http://www.hikanpou.com/product/youhi.html
    RU486:http://www.hikanpou.com/product/RU486.html
    紅蜘蛛:http://www.hikanpou.com/product/紅蜘蛛.html
    D10:http://www.hikanpou.com/product/D10.html
    D10媚薬:http://www.hikanpou.com/product/D10.html
    三鞭粒:http://www.hikanpou.com/product/weige.html
    絶對高潮:http://www.hikanpou.com/product/絶對高潮.html
    FLY D5:http://www.hikanpou.com/product/蒼蝿水.html
    D5原液:http://www.hikanpou.com/product/蒼蝿水.html
    蒼蝿水:http://www.hikanpou.com/product/魔力蒼蝿水5.html
    三便宝:http://www.hikanpou.com/product/三便宝.html
    蟻力神:http://www.hikanpou.com/product/蟻力神1.html
    三體牛鞭:http://www.hikanpou.com/product/三体牛鞭.html
    三体牛鞭:http://www.hikanpou.com/product/三体牛鞭.html
    勃動力三體牛鞭:http://www.hikanpou.com/product/三体牛鞭.html
    狼1号:http://www.hikanpou.com/product/狼1号.html
    狼一号:http://www.hikanpou.com/product/狼1号.html
    五便宝:http://www.hikanpou.com/product/五便宝.html
    男宝:http://www.hikanpou.com/product/男宝5箱.html
    蔵八宝:http://www.hikanpou.com/product/蔵八宝.html
    新一粒神:http://www.hikanpou.com/product/新一粒神.html
    リドスプレー:http://www.hikanpou.com/product/LIDOSPRAY.html
    ビグレックス:http://www.hikanpou.com/product/VigRx.html
    vigrxプラス:http://www.hikanpou.com/product/VigRx.html
    Wenickman:http://www.hikanpou.com/product/Wenickman.html
    MaxMan:http://www.hikanpou.com/product/MaxMan.html
    情愛芳香劑:http://www.hikanpou.com/product/rush724.html
    壮天根:http://www.hikanpou.com/product/壮天根.html
    魔根:http://www.hikanpou.com/product/魔根金中草.html
    夜夜堅:http://www.hikanpou.com/product/夜夜堅.html
    壮陽一号:http://www.hikanpou.com/product/壮陽一号.html
    マカ:http://www.hikanpou.com/product/MACA.html
    黒倍王:http://www.hikanpou.com/product/黒倍王.html
    花之欲:http://www.hikanpou.com/product/花之欲.html
    美人豹:http://www.hikanpou.com/product/美人豹5.html
    妻之友:http://www.hikanpou.com/product/妻之友.html
    福源春:http://www.hikanpou.com/product/福源春.html
    蟻王:http://www.hikanpou.com/product/アリ王蟻王,ANTKING.html
    アリ王:http://www.hikanpou.com/product/アリ王蟻王,ANTKING.html
    SEX DROPS:http://www.hikanpou.com/product/SEXDROPS5.html
    片仔廣:http://www.hikanpou.com/product/片仔廣.html
    へんしこう:http://www.hikanpou.com/product/片仔廣.html
    維尼好:http://www.hikanpou.com/product/維尼好消毒液.html
    縮陰膏:http://www.hikanpou.com/product/縮陰膏.html
    牛黄清心丸:http://www.hikanpou.com/product/牛黄清心丸.html
    同仁堂牛黄清心丸:http://www.hikanpou.com/product/牛黄清心丸2.html
    消渇丸:http://www.hikanpou.com/product/消渇丸.html
    999皮炎平:http://www.hikanpou.com/product//999皮炎平.html
    同仁烏鶏白鳳丸:http://www.hikanpou.com/product/烏鶏白鳳丸.html
    婦科千金片:http://www.hikanpou.com/product/婦科千金片.html
    セフラジン:http://www.hikanpou.com/product/cefradine.html
    終極痩身:http://www.hikanpou.com/product/zhongjishoushen.html
    天天素:http://www.hikanpou.com/product/天天素.html
    スーパーファット:http://www.hikanpou.com/product/スーパーファットNEWSUPERFATBURNIN.html
    SPANISCHE FLIEGE D5:http://www.hikanpou.com/product/SPANISCHE-FLIEGED5.html
    御秀堂:http://www.hikanpou.com/product/御秀堂養顔痩身.html
    韓国痩身一号:http://www.hikanpou.com/product/韓国痩身一号.html
    痩身1号:http://www.hikanpou.com/product/韓国痩身一号.html
    曲美:http://www.hikanpou.com/product/xinqumei.html
    大印象:http://www.hikanpou.com/product/dayinxiang.html
    碧生源:http://www.hikanpou.com/product/bishengyuan.html
    V26:http://www.hikanpou.com/product/V26.html
    避妊薬:http://www.hikanpou.com/pills/避妊中絶.html
    中絶薬:http://www.hikanpou.com/pills/避妊中絶.html
    精力剤:http://www.hikanpou.com/seiryokuzai/精力剤.html
    レディーチャイナ:http://www.hikanpou.com/product/蒼蝿水5.html
    ed治療薬:http://www.hikanpou.com/seiryokuzai/ED治療.html

    ReplyDelete
  3. 勃起不全:http://www.hikanpou.com/seiryokuzai/勃起不全薬.html
    勃起障害:http://www.hikanpou.com/seiryokuzai/勃起不全薬.html
    ペニス増大:http://www.hikanpou.com/seiryokuzai/性器増大.html
    早漏防止:http://www.hikanpou.com/seiryokuzai/早漏防止.html
    ED治療:http://www.hikanpou.com/seiryokuzai/ED治療.html
    ED改善:http://www.hikanpou.com/seiryokuzai/ED治療.html
    媚薬:http://www.hikanpou.com/biyaku/女性媚薬.html
    催情剤:http://www.hikanpou.com/product/D10.html
    催情:http://www.hikanpou.com/product/D10.html
    催情粉:http://www.hikanpou.com/product/紅蜘蛛30.html
    漢方薬:http://www.hikanpou.com/kanpouyaku/漢方薬.html
    催淫カプセル:http://www.hikanpou.com/product/絶對高潮6.html
    催情剤:http://www.hikanpou.com/product/D10.html
    奇果:http://www.hikanpou.com/product/奇果.html
    LIDO SPRAY:http://www.hikanpou.com/product/LIDOSPRAY.html
    アフリカ超人:http://www.hikanpou.com/product/chaoren.html
    徳国黒金:http://www.hikanpou.com/product/徳国黒金BLACKGOLD.html
    蔵秘男宝:http://www.hikanpou.com/product/zangminanbao.html
    蔵秘雄精:http://www.hikanpou.com/product/蔵秘雄精.html
    夜狼神:http://www.hikanpou.com/product/yelangshen.html
    中華牛鞭:http://www.hikanpou.com/product/中華牛鞭.html
    モチベーター:http://www.hikanpou.com/product/Motivat.html
    力多精:http://www.hikanpou.com/product/力多精.html
    金博郎:http://www.hikanpou.com/product/JinBoLang.html
    蔵秘男宝:http://www.hikanpou.com/product/zangminanbao.html
    好漢哥:http://www.hikanpou.com/product/好漢哥.html
    立挺90度:http://www.hikanpou.com/product/立挺90度.html
    男根増長素:http://www.hikanpou.com/product/ngzzw.html

    壮三天:http://www.hikanpou.com/product/zhuangsantian.html
    九鞭粒:http://www.hikanpou.com/product/jiubianli.html
    金動力:http://www.hikanpou.com/product/jingdong.html
    黑色風暴:http://www.hikanpou.com/product/黑色風暴.html
    男露888:http://www.hikanpou.com/product/男露888.html
    法国性奴:http://www.hikanpou.com/product/fagou.html
    性霸2000:http://www.hikanpou.com/product/Xing霸.html
    Xing霸:http://www.hikanpou.com/product/Xing霸.html
    頂点3000:http://www.hikanpou.com/product/CROWN3000.html
    鹿茸腎宝:http://www.hikanpou.com/product/鹿茸腎宝.html
    西班牙蒼蝿水:http://www.hikanpou.com/product/魔力蒼蝿水5.html
    女性用バイアグラ:http://www.hikanpou.com/product/nvweige.html
    魔鬼天使性欲粉:http://www.hikanpou.com/product/魔鬼天使.html
    VOV催情粉:http://www.hikanpou.com/product/VOV.html
    悦可亭:http://www.kanpocom.com/pro/yueke.html
    司米安:http://www.hikanpou.com/product/司米安.html
    達克寧:http://www.hikanpou.com/product/達克寧.html
    毓亭緊急避妊薬:http://www.hikanpou.com/product/毓亭緊急避妊薬.html
    新顕臣粉刺浄:http://www.hikanpou.com/product/新顕臣粉刺浄.html
    安宮牛黄丸:http://www.hikanpou.com/product/安宮牛黄丸.html
    止血薬カルバゾクロム錠:http://www.hikanpou.com/product/止血薬カルバゾクロム錠.html
    潤滑剤:http://www.hikanpou.com/product/潤滑剤.html
    コンドーム:http://www.hikanpou.com/product/早漏防止.html
    日本秀身堂:http://www.hikanpou.com/product/秀身堂救急箱.html
    唯美OB:http://www.hikanpou.com/product/唯美OB蛋白痩身素.html
    悍馬壹號:http://www.hikanpou.com/product/hanma.html
    ベニクモ:http://www.hikanpou.com/product/紅蜘蛛.html
    金威龍:http://www.hikanpou.com/product/金威龍.html
    威龍:http://www.hikanpou.com/product/aeilong.html
    イリュウ:http://www.hikanpou.com/product/金威龍.html
    野生虫草王:http://www.hikanpou.com/product/野生虫草丸.html
    東方神龍生精:http://www.hikanpou.com/product/東方神龍生精.html
    房事神油:http://www.hikanpou.com/product/fangshi.html
    性福三宝:http://www.hikanpou.com/product/性福三宝.html
    五夜神:http://www.hikanpou.com/product/天宝五夜神.html
    海狗丸:http://www.hikanpou.com/product/香港宝和堂海狗丸.html
    虎力士:http://www.hikanpou.com/product/hulishi.html
    ビビッドビリリティ:http://www.hikanpou.com/product/vivid60.html
    vivid:http://www.hikanpou.com/product/vivid60.html
    房事の神油:http://www.hikanpou.com/product/fangshi.html
    九州神龍:http://www.hikanpou.com/product/九州神龍.html
    九州神龍カプセル:http://www.hikanpou.com/product/九州神龍.html
    亀鹿睾丸生精片:http://www.hikanpou.com/product/亀鹿睾丸.html
    愛妻楽:http://www.hikanpou.com/product/愛妻楽.html

    ReplyDelete
  4. 威哥王:http://www.hakanpo.com/p/pro96.html
    巨人倍増:http://www.hakanpo.com/p/pro138.html
    花痴:http://www.hakanpo.com/p/pro312.html
    D10催情剤:http://www.hakanpo.com/p/pro282.html
    蟻力神:http://www.hakanpo.com/p/pro132.html
    三便宝:http://www.hakanpo.com/p/pro149.html
    D10媚薬:http://www.hakanpo.com/p/pro282.html
    SPANISCHE FLIEGE D5:http://www.hakanpo.com/p/pro308.html
    紅蜘蛛:http://www.hakanpo.com/p/pro311.html
    曲美:http://www.hakanpo.com/p/pro25.html
    妖姫:http://www.hakanpo.com/p/pro481.html
    淫インモラル:http://www.hakanpo.com/p/pro482.html
    インモラル:http://www.hakanpo.com/p/pro482.html
    紅蜘蛛:http://www.hakanpo.com/p/pro311.html
    威哥王:http://威哥王.kanpocom.com
    D10催情剤:http://www.hakanpo.com/p/pro282.html
    花痴:http://www.hakanpo.com/p/pro312.html
    妖姫:http://www.hakanpo.com/p/pro481.html
    淫インモラル:http://www.hakanpo.com/p/pro482.html
    淫インモラル:http://www.hakanpo.com/p/pro482.html
    インモラル:http://www.hakanpo.com/p/pro482.html
    絶對高潮:http://www.hakanpo.com/p/pro133.html

    VigRx:http://www.hakanpo.com/p/pro222.html
    RU486:http://www.hakanpo.com/p/pro113.html
    D10媚薬:http://www.hakanpo.com/p/pro282.html
    三體牛鞭:http://www.hakanpo.com/p/pro331.html
    三体牛鞭:http://www.hakanpo.com/p/pro331.html
    狼1号:http://www.hakanpo.com/p/pro330.html
    狼一号:http://www.hakanpo.com/p/pro330.html
    夜狼神:http://www.hakanpo.com/p/pro574.html
    情愛芳香劑:http://hakanpo.com/p/pro551.html
    アフリカ超人:http://www.hakanpo.com/p/pro573.html
    中華牛鞭:http://www.hakanpo.com/p/pro167.html
    蔵秘雄精:http://www.hakanpo.com/p/pro575.html
    悦可亭:http://www.hakanpo.com/p/pro118.html
    女性用バイアグラ:http://www.hakanpo.com/p/pro579.html
    止血薬カルバゾクロム錠:http://www.hakanpo.com/p/pro580.html
    媚薬:http://www.hakanpo.com/CL05/38.html
    精力剤:http://www.hakanpo.com/CL02
    天天素:http://www.hakanpo.com/p/pro58.html
    リドスプレー:http://www.hakanpo.com/p/pro374.html
    LIDO SPRAY:http://www.hakanpo.com/p/pro374.html
    花之欲:http://www.hakanpo.com/p/pro292.html
    ビグレックス:http://www.hakanpo.com/p/pro386.html
    VVK:http://www.hakanpo.com/p/pro325.html
    男露888:http://www.hakanpo.com/p/pro243.html
    Wenickman:http://www.hakanpo.com/p/pro325.html
    MaxMan:http://www.hakanpo.com/p/pro97.html
    vigrxプラス:http://www.hakanpo.com/p/pro222.html
    モチベーター:http://www.hakanpo.com/p/pro327.html
    勃動力三體牛鞭:http://www.hakanpo.com/p/pro331.html
    中華牛鞭:http://www.hakanpo.com/p/pro167.html
    新一粒神:http://www.hakanpo.com/p/pro476.html
    五便宝:http://www.hakanpo.com/p/pro157.html
    三鞭粒:http://www.hakanpo.com/p/pro450.html
    男宝:http://www.hakanpo.com/p/pro375.html
    魔根:http://www.hakanpo.com/p/pro360.html
    壮天根:http://www.hakanpo.com/p/pro329.html
    黒倍王:http://www.hakanpo.com/p/pro337.html
    九鞭粒:http://www.hakanpo.com/p/pro437.html
    男露888:http://www.hakanpo.com/p/pro243.html
    西班牙蒼蝿水:http://www.hakanpo.com/p/pro284.html
    西班牙蒼蝿粉:http://www.hakanpo.com/p/pro254.html
    性霸2000:http://www.hakanpo.com/p/pro147.html
    Xing霸:http://www.hakanpo.com/p/pro147.html
    情愛芳香劑 :http://www.hakanpo.com/p/pro551.html

    花痴:http://www.hakanpo.com/p/pro312.html
    D10:http://www.hakanpo.com/p/pro282.html
    D8 催情剤:http://www.hakanpo.com/p/pro343.html
    FLY D5:http://www.hakanpo.com/p/pro318.html
    D5原液:http://www.hakanpo.com/p/pro318.html
    蒼蝿水:http://www.hakanpo.com/p/pro318.html
    花之欲:http://www.hakanpo.com/p/pro292.html
    美人豹:http://www.hakanpo.com/p/pro320.html
    福源春:http://www.hakanpo.com/p/pro313.html
    魔鬼天使性欲粉:http://www.hakanpo.com/p/pro309.html
    SEX DROPS:http://www.hakanpo.com/p/pro322.html
    小情人:http://www.hakanpo.com/p/pro322.html
    中絶薬:http://www.hakanpo.com/CL06/42.html
    避妊薬:http://www.hakanpo.com/p/pro117.html
    天天素:http://www.hakanpo.com/p/pro58.html
    超級脂肪燃焼弾:http://www.hakanpo.com/p/pro52.html
    韓国痩身一号:http://www.hakanpo.com/p/pro20.html
    韓国痩身1号:http://www.hakanpo.com/p/pro20.html
    痩身一号:http://www.hakanpo.com/p/pro20.html

    ReplyDelete