in toutoumomoma_nofips.go [15:41]
func (f *File) importHash() (hash []byte, imports []string, err error) {
// Algorithm from https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html
// - Resolving ordinals to function names when they appear (done by the debug/pe library)
// - Converting both DLL names and function names to all lowercase
// - Removing the file extensions from imported module names
// - Building and storing the lowercased string in an ordered list
// - Generating the MD5 hash of the ordered list
//
// The algorithm is generalised to non-Windows platforms as described in
// the doc comment.
imports, err = f.Imports()
if err != nil {
return nil, nil, err
}
h := md5.New()
if len(imports) == 0 {
return h.Sum(nil), nil, nil
}
for i, imp := range imports {
if i != 0 {
_, _ = h.Write([]byte{','})
}
fmt.Fprint(h, imp)
}
return h.Sum(nil), imports, nil
}