hard20 pts · first answer countsincident-responsemalware-analysisthreat-intel

Same imphash, different files

Twenty samples from different incidents have different SHA-256 hashes and file names, but the same imphash. What is the most reasonable conclusion?

A.They are exact copies of the same file and can be deduplicatedB.They were probably built from the same code or builder; treat as one familyC.Imphash collisions are random, so the match means nothingD.They must have been compiled on the same physical computer

Discussion 0

Join free to post in the discussion.

Same imphash, different files

Discussion 0

Related questions