Fingerprinting a Sample: Hashes

• MD5 / SHA-256: exact-content fingerprint. One bit changes → totally different hash. Use SHA-256 for sharing.
• ssdeep (fuzzy / CTPH): similarity hashing. Two variants of the same malware score as similar even if not identical.
• imphash: hash of the PE Import Address Table (ordered import names). Samples built from the same source / toolchain often share it.
• TLSH, authentihash, section hashes: other pivots.