VirusTotal has introduced a new feature for portable executable (PE) files. Its called imphash and it stands for import hash.
The imphash feature has been utilized by IT security firm Mandiant for tracking the backdoors of specific threat groups. The hashes are created based on library/API names and their specific order within a PE file.
The imphash value can be used to identify malware samples that are related to one another. It can…
Comments are closed.
