Import Hash

Definitions

1. A hash derived from the imported functions and libraries of a binary, commonly used to cluster related Windows malware samples even when the exact file hash changes. Import hashes help analysts spot shared tooling, packing differences, and family relationships.

   In plain English: A fingerprint based on which functions a program imports, used to compare malware samples.

   Example: "The binaries had different SHA-256 values, but the same import hash linked them to the earlier campaign."

Related Terms

• Buffer Overflow
• Gaussian Mixture Model
• K-Means
• Dynamic Analysis
• Emulation Detection
• File Analysis
• Memory Analysis
• Payload Analysis