2.1 Generating Cryptographic Hash Using Tools

On a Linux system, file hashes can be generated using the md5sum, sha256sum, and sha1sum utilities:

$ md5sum log.exe6e4e030fbd2ee786e1b6b758d5897316  log.exe$ sha256sum log.exe01636faaae739655bf88b39d21834b7dac923386d2b52efb4142cb278061f97f  log.exe$ sha1sum log.exe625644bacf83a889038e4a283d29204edc0e9b65  log.exe

For Windows, various tools for generating file hashes can be found online. HashMyFiles (http://www.nirsoft.net/utils/hash_my_files.html) is one such tool that generates hash values for single or multiple files, and it also highlights identical hashes with same colors. In the following screenshot, it can be seen that log.exe and bunny.exe are the same samples based on their hash values: ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.