[Autogenerated] The next topic consists of working with fall hashes,
hash values are a unique string to represent the contents of a fall.
Essentially a hash function is used to generate a unique fixed
length strength based on content of variable length.
Since the hash function is applied to the contents of the file,
the output value is not affected by the file name or extension.
We can use hash values to compare if two falls are identical because it's
much easier to compare two strings rather than two large falls foul hash
signatures have been around for a very long time.
And the important aspect is that they have very strong support within
security tools in order to understand how this can be used.
Let's consider the following workflow.
We'll start off with the unknown and suspicious file Then
we apply hash function such as MD five or someone to get a
unique string representation.
And here comes the interesting part.
If the hash value is identical to one of a fall,
which we have previously classified as malicious,
then we can infer that our suspicious file is malicious in practice.
We use file hashes with existing security tools that enable us
to run checks against falls that have already been scanned on
endpoints or across the network.
Additionally,
we can also use hash values in combination with threat intelligence and
follow reputation services via their APIs to enhance,
follow classification and in some cases this is done automatically in
the background by the security tools themselves.
It's also very important to understand that leveraging only file
hashes for detection has some limitations.
Modern malware can and will subvert this technique
mostly because any small change,
even changing one bite without impacting the functionality will lead
to another value when applying the hash function.
However,
there are still opportunities to take advantage of milder authors can reuse
specific components between campaigns and there are scenarios where
legitimate binaries are part of an infection chain.
We should be able to identify these to prevent losing
time on analyzing legitimate binaries.
Moving on to more advanced concepts, fuzzy hashing is an evolutionary step.
Instead of applying the hash function to the entire content,
this is divided into blocks and each block is hashed individually.
This essentially increases the tolerance to file changes.
If content in one block has changed the others will remain the same.
And this enables similarity comparison between falls.
Another technique where hash functions are used is imported
caching This consists of applying a hash function to the
contents of the import address table.
This takes into account that different malware
variants will leverage the same system, imports