agentsclimarketplace
Sign in

Diffing malware samples to find changes

Skill meltedinhex/analyst-ai-pack/skills/diffing-malware-samples-to-find-changes

Compares two related malware samples to surface what changed between variants using section-level hashing, import-set differences, and fuzzy similarity scoring. Activates for requests to diff two samples, compare malware variants, or measure similarity between two binaries for variant tracking.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill diffing-malware-samples-to-find-changes

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, 415 tokens by cl100k_base, as published. Nobody here has run it

Diffing Malware Samples to Find Changes

When to Use

  • You have two related samples (suspected variants of one family) and want a fast, structural diff before a full BinDiff.
  • You need to quantify similarity and pinpoint changed sections/imports for variant tracking.

Do not use this as authoritative function-level diffing — that requires BinDiff/Diaphora on disassembly. This skill does structural/statistical diffing and executes nothing.

Prerequisites

  • Two sample files (read inertly). Optional: ssdeep/tlsh for fuzzy scores (degrade gracefully).

Workflow

Step 1: Structural diff

python scripts/analyst.py diff a.bin b.bin

Compares file size, per-section SHA-256 and entropy, and the import name sets, reporting added/ removed/changed sections and imports.

Step 2: Similarity score

Reports a byte-level similarity ratio and, if available, ssdeep/tlsh fuzzy-hash comparison scores.

Step 3: Prioritize changed regions

Changed sections (same name, different hash) and new imports are the high-value targets for deeper disassembly diffing.

Step 4: Document

Record what changed and the similarity score to support variant/lineage tracking.

Validation

  • Section comparison keys on section name; identical sections report equal hashes.
  • Import diff lists are accurate (added vs removed vs common).
  • Fuzzy-hash scores are reported only when the library is available, else clearly omitted.

Pitfalls

  • Recompilation shifting addresses makes raw byte diff noisy — rely on section/import structure.
  • Packers making both samples look similar (packed) while the payloads differ — unpack first.
  • Treating a high byte-similarity as proof of same author without corroboration.

References

What ships with it: 3 files

5.2 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.