fibratus icon indicating copy to clipboard operation
fibratus copied to clipboard

Compute PE imphash

Open rabbitstack opened this issue 4 years ago • 0 comments

Since we're gathering imported symbols via PE parsing, we could compute the import hash, most commonly referred to imphash.

We could simply adapt the pefile-go imphash logic to an existing code in fibratus by creating a new pkg/pe/imphash.go source file.

It would be valuable to provide a config flag by which users could control the imphash calculation. Capture file marshaling logic needs adjustments in order to support the new Imphash field in PE metadata. Similarly, we should register a new filter field to allow building filter expressions such as pe.imphash = '2c26ec4a570a502ed3e8484295581989'.

rabbitstack avatar Dec 31 '21 16:12 rabbitstack