A forum for reverse engineering, OS internals and malware analysis 

md5 malware file

All off-topic discussion goes here.

md5 malware file

 #26583  by syu
 Sun Aug 23, 2015 2:50 pm
hello ,

i am new in malware analysis for my research study project .. i have done some analysis about malware but how do not understand abaout md5 how to read and compare .

let say

file A : 933535bc91dcb769622440783c3b1f63
file B : 9bedcb891fb23e9ea9fa08e1c61a6a5b

based on these two file (md5) it showed that file A and file B have the same number 91 (in md5 string) so based on manually could i identify it is the same file but have been modified ?

tq

Re: md5 malware file

 #26584  by EP_X0FF
 Sun Aug 23, 2015 4:03 pm
syu wrote:based on these two file (md5) it showed that file A and file B have the same number 91 (in md5 string) so based on manually could i identify it is the same file but have been modified ?
No.

Re: md5 malware file

 #26588  by syu
 Mon Aug 24, 2015 1:50 am
tq ..

but can you or anyone give me some simple example to detect the same file based on md5 ?

Re: md5 malware file

 #26595  by Vrtule
 Mon Aug 24, 2015 2:53 pm
Hello,

MD5 is a cryptographic hash function which means (beside other things) that even a small change in its input (file content) produces a great change in its output (the hash). So, when the files are the same (have the same content) their MD5 hashes are exactly the same. When the files differ (even in a single bit), their hashes are different (except the case of a MD5 colision).

In theory, a similarity in two hashes (meaning they contain the smae substring for example) should not tell you anything about similarity of their inputs.

I am not sure how good is MD5 today but AFAIK it is considered broken or nearly broken for most use cases.

Re: md5 malware file

 #26598  by syu
 Tue Aug 25, 2015 3:13 am
tq to all of you . now i know what md5 is about ...

tq so much .. very helpful ...
 Return to “General Discussion”