Diffing Malware Samples To Find Changes

---
name: diffing-malware-samples-to-find-changes
description: 'Compares two related malware samples to surface what changed between variants using
  section-level hashing, import-set differences, and fuzzy similarity scoring. Activates for
  requests to diff two samples, compare malware variants, or measure similarity between two binaries
  for variant tracking.'
domain: cybersecurity
subdomain: reverse-engineering
tags:
  - reverse-engineering
  - bindiff
  - variant-analysis
  - similarity
  - triage
version: 1.0.0
author: analyst-ai-pack
license: Apache-2.0
mitre_attack:
  - T1587.001
  - T1027
  - T1588.001
d3fend:
  - D3-FA
  - D3-DA
references:
  - 'PE Format — https://learn.microsoft.com/windows/win32/debug/pe-format'
  - 'ssdeep fuzzy hashing (CTPH) — https://ssdeep-project.github.io/ssdeep/'
---

# Diffing Malware Samples to Find Changes

## When to Use

- You have two related samples (suspected variants of one family) and want a fast, structural diff
  before a full BinDiff.
- You need to quantify similarity and pinpoint changed sections/imports for variant tracking.

**Do not use** this as authoritative function-level diffing — that requires BinDiff/Diaphora on
disassembly. This skill does structural/statistical diffing and executes nothing.

## Prerequisites

- Two sample files (read inertly). Optional: `ssdeep`/`tlsh` for fuzzy scores (degrade gracefully).

## Workflow

### Step 1: Structural diff

```bash
python scripts/analyst.py diff a.bin b.bin
```

Compares file size, per-section SHA-256 and entropy, and the import name sets, reporting added/
removed/changed sections and imports.

### Step 2: Similarity score

Reports a byte-level similarity ratio and, if available, ssdeep/tlsh fuzzy-hash comparison scores.

### Step 3: Prioritize changed regions

Changed sections (same name, different hash) and new imports are the high-value targets for deeper
disassembly diffing.

### Step 4: Document

Record what changed and the similarity score to support variant/lineage tracking.

## Validation

- Section comparison keys on section name; identical sections report equal hashes.
- Import diff lists are accurate (added vs removed vs common).
- Fuzzy-hash scores are reported only when the library is available, else clearly omitted.

## Pitfalls

- Recompilation shifting addresses makes raw byte diff noisy — rely on section/import structure.
- Packers making both samples look similar (packed) while the payloads differ — unpack first.
- Treating a high byte-similarity as proof of same author without corroboration.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the differ.
- PE format and ssdeep references (linked in frontmatter).