Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Fetching latest commit…
Cannot retrieve the latest commit at this time.
|Failed to load latest commit information.|
// Match The Hash// Matches The Hash values to files on a machine. ~ What is Match The Hash? Python script that can help find malware on your machine. Sample data is created as: <name>,<size>,<MD5> That data is then used to search other machines. The search runs much faster if file size and hash values are included. Name is ignored, file size is matched first, then hashes and attempts to match the hash values. ~ Examples Search your whole hard drive with hash only. Match_The_Hash.py -md5 d378bffb70923139d6a4f546864aa61c It will go much faster if you include file size. Match_The_Hash.py -size 179712 -md5 d378bffb70923139d6a4f546864aa61c Name can be included but it is ignored in the search. -name malware1.exe -size 179712 -md5 d378bffb70923139d6a4f546864aa61c Create a large sample of data from all files in a folder. -hf = hash folder Match_The_Hash.py -hf <Path_to_folder> -o samples.csv Then use this folder as your input. -i Match_The_Hash.py -i samples.csv -o results.csv ~ Notes Compiled using pyinstaller. If no output file is assigned using -o, Output file Match_The_Hash.csv will be created at current working directory. Match_The_Hash.py = Works on Windows,Linux,Mac Match_The_Hash32.exe = 32bit Windows Match_The_Hash64.exe = 64bit Windows The example is notepad.exe to test if it's working on Windows 7 machine. Match_The_Hash.py -size 179712 -md5 d378bffb70923139d6a4f546864aa61c ~ Usage usage: Match_The_Hash.py [-h] [-name FILENAME] [-size FILESIZE] [-md5 MD5HASH] [-sha1 SHA1HASH] [-hf HASH_FOLDER] [-hhd] [-hhdsha1] [-p PATH] [-i INFILE] [-o OUTFILE] Matches The Hash values to files on a machine. optional arguments: -h, --help show this help message and exit -name FILENAME Name of single file to search -size FILESIZE Size of file to search. Faster than hash only search. -md5 MD5HASH MD5 hash value to search. -sha1 SHA1HASH SHA1 hash value to search. -hf HASH_FOLDER Hash contents of a folder. -hhd Hash contents of an entire hard drive: MD5. -hhdsha1 Hash contents of an entire hard drive: SHA1. -p PATH Path to start in, else search whole disk. -i INFILE CSV or text file in this format 'malwarename1.exe,size,MD5' or SHA1 hash value.' -o OUTFILE Output file. MatchTheHash goes much faster if file size is included. File sizes are matched first and then hash values. Examples: -size 179712 -md5 d378bffb70923139d6a4f546864aa61c -hf folder_path -o samples.csv (Hash folder that contains malware samples.) -i samples.csv -o results.csv (Sample data is input to search for matches.)