Learning Malware Analysis

2.1 Generating Cryptographic Hash Using Tools

On a Linux system, file hashes can be generated using the md5sum, sha256sum, and sha1sum utilities:

$ md5sum log.exe6e4e030fbd2ee786e1b6b758d5897316  log.exe$ sha256sum log.exe01636faaae739655bf88b39d21834b7dac923386d2b52efb4142cb278061f97f  log.exe$ sha1sum log.exe625644bacf83a889038e4a283d29204edc0e9b65  log.exe

For Windows, various tools for generating file hashes can be found online. HashMyFiles (http://www.nirsoft.net/utils/hash_my_files.html) is one such tool that generates hash values for single or multiple files, and it also highlights identical hashes with same colors. In the following screenshot, it can be seen that log.exe and bunny.exe are the same samples based on their hash values: ...