ImpHash
Definition
Mandiant's hash of the ordered list of imported functions in a PE file's import table. Survives recompilation that does not change imports; clusters malware families across builds. Implemented in pefile (Python) and Mandiant's original tool.
- Origin
- Developed by Mandiant
- Input
- Ordered list of imports in the PE import table
- Use
- Clusters malware family variants across builds
- Tool support
- pefile (Python)
Common questions
Why can recompiling malware sometimes evade ImpHash matching?+
If the recompilation changes which functions are imported or their order in the import table, the hash changes even though the underlying malicious logic is unchanged, so analysts pair ImpHash with other similarity measures.
How does ImpHash differ from a standard file hash like MD5?+
A file hash changes with any byte-level difference, including a single recompile, while ImpHash focuses only on the import table, so it survives many code and packing changes and can link samples an MD5 comparison would miss.
Related terms
- Entropy (Shannon)
- Per-byte information density of a file or section. Plain code sits around 5.5; packed or encrypted sections exceed 7.0. A PE with...
- IoC (Indicator of Compromise)
- Observable artefact linked to malicious activity. File hashes (MD5, SHA-256, ImpHash, ssdeep, TLSH), IPs, domains, URLs, registry keys, mutex names, named pipes,...
- PE (Portable Executable) Header
- The Windows executable file format. Starts with an MZ DOS stub, points to a PE signature, then a COFF file header, an...
- Volatility 3
- Open-source memory forensics framework, Python 3 rewrite of Volatility 2. Symbol-based (PDB symbols on Windows) instead of profile-based, supports modern Windows 10/11...
- YARA
- Pattern-matching language for malware classification. Rules combine string and byte-pattern conditions with metadata. Used by VirusTotal, every major sandbox, and most threat-intel...