How is the behash value calculated?

[cccs-kevin]

Hi VT!

We love the behash value found here: https://developers.virustotal.com/reference/file-behaviour-summary

However, we would like to use this value across multiple dynamic analysis / file behaviour feeds, some that are not from VT, in order to relate similar runs.

Would you be able to clarify how to calculate that behash value such that we would be able to reproduce it given a set of input values? Or is the calculation somewhere in a repository somewhere that I could be directed to?

Thanks,

Kevin

[mgmacias95]

Hello Kevin,

As I said in the other issue, the implementation of the behash is confidential.

Regards,
Marta