pyimpfuzzy 0.5

Python modules for impfuzzy

pyimpfuzzy

Python module for comparing the impfuzzy
pyimpfuzzy is python module which calculate and compare the impfuzzy(import fuzzy hashing)

More details are described in the following documents:
https://www.jpcert.or.jp/magazine/acreport-impfuzzy.html (Japanese)
http://blog.jpcert.or.jp/2016/05/classifying-mal-a988.html (English)

Requirements

pyimpfuzzy requires the following modules:

• pefile 1.2.10-139 or later
• ssdeep http://ssdeep.sourceforge.net

Installation

$ pip install pyimpfuzzy

or

$ sudo python setup.py install

Usage

• get_impfuzzy - return the impfuzzy hash for a given file
• get_impfuzzy_data - return the impfuzzy hash for a buffer
• hash_compare - return the match between 2 hashes

Example Usage

import pyimpfuzzy
import sys

hash1 = pyimpfuzzy.get_impfuzzy(sys.argv[1])
hash2 = pyimpfuzzy.get_impfuzzy(sys.argv[2])
print("ImpFuzzy1: %s" % hash1)
print("ImpFuzzy2: %s" % hash2)
print("Compare: %i" % pyimpfuzzy.hash_compare(hash1, hash2))