Learning Malware Analysis

7.3 Classifying Malware Using Section Hash

Similar to import hashing, section hashing can also help in identifying related samples. When an executable is loaded in pestudio, it calculates the MD5 of each section (.text, .data, .rdata, and so on.). To view the section hashes, click on sections as shown here:

In Python, pefile module can be used to determine the sections hashes as shown here:

>>> import pefile>>> pe = pefile.PE("5340.exe")>>> for section in pe.sections:...     print "%s\t%s" % (section.Name, section.get_hash_md5())... .text b1b56e7a97ec95ed093fd6cfdd594f6c.rdata a7dc36d3f527ff2e1ff7bec3241abf51.data 8ec812e17cccb062515746a7336c654a ...