← retour aux outils back to tools

# ssdeep

Calcule et compare des hashes flous (context-triggered piecewise) pour identifier des fichiers similaires ou apparentés, largement utilisé pour le triage de malwares. Computes and compares context-triggered piecewise (fuzzy) hashes to identify similar or related files, widely used in malware triage.

↗ https://ssdeep-project.github.io/ssdeep/

## Overview

ssdeep generates “fuzzy hashes” — unlike cryptographic hashes (MD5, SHA1), a small change to a file only slightly changes its ssdeep signature. This makes it possible to measure similarity between two files on a 0-100 scale, which is invaluable when triaging malware variants, spotting modified documents, or clustering samples that share large code blocks.

## Common Usage

Generate a fuzzy hash for a single file

    ssdeep malware_sample.exe

Hash a whole directory recursively

    ssdeep -r /samples/ > hashes.txt

Compare a file against a set of known hashes

    ssdeep -m hashes.txt suspicious.exe

Compare two signature files directly

    ssdeep -d hashes1.txt hashes2.txt

Compute hashes then match against themselves (find similar pairs in a set)

    ssdeep -rb /samples/ | ssdeep -m /dev/stdin

## Malware Triage Workflow

Baseline a known-clean binary set

    ssdeep -r /opt/clean-baseline/ > clean.sig

Hash the sample under investigation

    ssdeep unknown_binary > unknown.sig

Check for matches against the clean baseline (near-100% match = likely benign/repacked)

    ssdeep -m clean.sig unknown_binary

Cluster a malware zoo — output pairs with similarity score

    ssdeep -rc /malware-zoo/ > zoo.sig

## Tips

- Similarity scores above ~70 usually indicate a meaningful relationship (shared packer, same family, minor patch).
- Works best on files of similar size and type — comparing a 4KB script against a 40MB binary is meaningless.
- The `libfuzzy` library ssdeep is built on is also bound into Python (`ssdeep` pip package) and YARA (`ssdeep()` module) for automated pipelines.

Help / Man page

    ssdeep [-m file] [-k file] [-dpertlsbcvV] [-h|-h1|-h2] [-c mode] [FILES...]

      -m file   Match FILES against known hashes in file
      -k file   Same as -m but uses SHA256 hash format
      -d        Compare each pair of files in a signature file to each other
      -p        Pretty matching mode; all matches are shown
      -e        Display elapsed time
      -r        Recursive mode
      -t val    Only show matches above given threshold (0-100)
      -l        Print relative paths for filenames
      -s        Silent mode; only show error messages
      -b        Only display basename of files
      -c        CSV output
      -v        Verbose mode; repeat for more verbosity
      -V        Display version number and exit
      -h        Help

## Vue d’ensemble

ssdeep génère des “hashes flous” : contrairement aux hashes cryptographiques (MD5, SHA1), un petit changement dans un fichier ne modifie que légèrement sa signature ssdeep. Cela permet de mesurer la similarité entre deux fichiers sur une échelle de 0 à 100, ce qui est précieux pour trier des variantes de malware, repérer des documents modifiés, ou regrouper des échantillons partageant de larges blocs de code.

## Utilisation courante

    # Générer un hash flou pour un seul fichier
    ssdeep malware_sample.exe

    # Hasher un répertoire entier récursivement
    ssdeep -r /samples/ > hashes.txt

    # Comparer un fichier à un ensemble de hashes connus
    ssdeep -m hashes.txt suspicious.exe

    # Comparer deux fichiers de signatures directement
    ssdeep -d hashes1.txt hashes2.txt

    # Calculer les hashes puis les comparer entre eux (trouver des paires similaires dans un ensemble)
    ssdeep -rb /samples/ | ssdeep -m /dev/stdin

## Workflow de triage de malware

    # Établir une base de référence sur un ensemble de binaires sains connus
    ssdeep -r /opt/clean-baseline/ > clean.sig

    # Hasher l'échantillon en cours d'investigation
    ssdeep unknown_binary > unknown.sig

    # Vérifier les correspondances avec la base saine (correspondance proche de 100% = probablement bénin/repacké)
    ssdeep -m clean.sig unknown_binary

    # Regrouper un zoo de malwares : sortir les paires avec leur score de similarité
    ssdeep -rc /malware-zoo/ > zoo.sig

## Conseils

- Des scores de similarité au-dessus de ~70 indiquent généralement une relation significative (packer partagé, même famille, patch mineur)
- Fonctionne mieux sur des fichiers de taille et de type similaires : comparer un script de 4 Ko à un binaire de 40 Mo n’a aucun sens
- La bibliothèque `libfuzzy` sur laquelle ssdeep est construit est aussi liée à Python (package pip `ssdeep`) et YARA (module `ssdeep()`) pour des pipelines automatisés

Aide / Page de manuel

    ssdeep [-m file] [-k file] [-dpertlsbcvV] [-h|-h1|-h2] [-c mode] [FILES...]

      -m file   Match FILES against known hashes in file
      -k file   Same as -m but uses SHA256 hash format
      -d        Compare each pair of files in a signature file to each other
      -p        Pretty matching mode; all matches are shown
      -e        Display elapsed time
      -r        Recursive mode
      -t val    Only show matches above given threshold (0-100)
      -l        Print relative paths for filenames
      -s        Silent mode; only show error messages
      -b        Only display basename of files
      -c        CSV output
      -v        Verbose mode; repeat for more verbosity
      -V        Display version number and exit
      -h        Help