ssdeep

Overview

ssdeep generates “fuzzy hashes” — unlike cryptographic hashes (MD5, SHA1), a small change to a file only slightly changes its ssdeep signature. This makes it possible to measure similarity between two files on a 0-100 scale, which is invaluable when triaging malware variants, spotting modified documents, or clustering samples that share large code blocks.

Common Usage

Generate a fuzzy hash for a single file

ssdeep malware_sample.exe

Hash a whole directory recursively

ssdeep -r /samples/ > hashes.txt

Compare a file against a set of known hashes

ssdeep -m hashes.txt suspicious.exe

Compare two signature files directly

ssdeep -d hashes1.txt hashes2.txt

Compute hashes then match against themselves (find similar pairs in a set)

ssdeep -rb /samples/ | ssdeep -m /dev/stdin

Malware Triage Workflow

Baseline a known-clean binary set

ssdeep -r /opt/clean-baseline/ > clean.sig

Hash the sample under investigation

ssdeep unknown_binary > unknown.sig

Check for matches against the clean baseline (near-100% match = likely benign/repacked)

ssdeep -m clean.sig unknown_binary

Cluster a malware zoo — output pairs with similarity score

ssdeep -rc /malware-zoo/ > zoo.sig

Tips

• Similarity scores above ~70 usually indicate a meaningful relationship (shared packer, same family, minor patch).
• Works best on files of similar size and type — comparing a 4KB script against a 40MB binary is meaningless.
• The libfuzzy library ssdeep is built on is also bound into Python (ssdeep pip package) and YARA (ssdeep() module) for automated pipelines.

ssdeep [-m file] [-k file] [-dpertlsbcvV] [-h|-h1|-h2] [-c mode] [FILES...]

  -m file   Match FILES against known hashes in file
  -k file   Same as -m but uses SHA256 hash format
  -d        Compare each pair of files in a signature file to each other
  -p        Pretty matching mode; all matches are shown
  -e        Display elapsed time
  -r        Recursive mode
  -t val    Only show matches above given threshold (0-100)
  -l        Print relative paths for filenames
  -s        Silent mode; only show error messages
  -b        Only display basename of files
  -c        CSV output
  -v        Verbose mode; repeat for more verbosity
  -V        Display version number and exit
  -h        Help

Vue d’ensemble

ssdeep génère des “hashes flous” : contrairement aux hashes cryptographiques (MD5, SHA1), un petit changement dans un fichier ne modifie que légèrement sa signature ssdeep. Cela permet de mesurer la similarité entre deux fichiers sur une échelle de 0 à 100, ce qui est précieux pour trier des variantes de malware, repérer des documents modifiés, ou regrouper des échantillons partageant de larges blocs de code.

Utilisation courante

# Générer un hash flou pour un seul fichier
ssdeep malware_sample.exe

# Hasher un répertoire entier récursivement
ssdeep -r /samples/ > hashes.txt

# Comparer un fichier à un ensemble de hashes connus
ssdeep -m hashes.txt suspicious.exe

# Comparer deux fichiers de signatures directement
ssdeep -d hashes1.txt hashes2.txt

# Calculer les hashes puis les comparer entre eux (trouver des paires similaires dans un ensemble)
ssdeep -rb /samples/ | ssdeep -m /dev/stdin

Workflow de triage de malware

# Établir une base de référence sur un ensemble de binaires sains connus
ssdeep -r /opt/clean-baseline/ > clean.sig

# Hasher l'échantillon en cours d'investigation
ssdeep unknown_binary > unknown.sig

# Vérifier les correspondances avec la base saine (correspondance proche de 100% = probablement bénin/repacké)
ssdeep -m clean.sig unknown_binary

# Regrouper un zoo de malwares : sortir les paires avec leur score de similarité
ssdeep -rc /malware-zoo/ > zoo.sig

Conseils

• Des scores de similarité au-dessus de ~70 indiquent généralement une relation significative (packer partagé, même famille, patch mineur)
• Fonctionne mieux sur des fichiers de taille et de type similaires : comparer un script de 4 Ko à un binaire de 40 Mo n’a aucun sens
• La bibliothèque libfuzzy sur laquelle ssdeep est construit est aussi liée à Python (package pip ssdeep) et YARA (module ssdeep()) pour des pipelines automatisés

ssdeep [-m file] [-k file] [-dpertlsbcvV] [-h|-h1|-h2] [-c mode] [FILES...]

  -m file   Match FILES against known hashes in file
  -k file   Same as -m but uses SHA256 hash format
  -d        Compare each pair of files in a signature file to each other
  -p        Pretty matching mode; all matches are shown
  -e        Display elapsed time
  -r        Recursive mode
  -t val    Only show matches above given threshold (0-100)
  -l        Print relative paths for filenames
  -s        Silent mode; only show error messages
  -b        Only display basename of files
  -c        CSV output
  -v        Verbose mode; repeat for more verbosity
  -V        Display version number and exit
  -h        Help