Volatility plugin for comparing the impfuzzy and imphash.
This plugin can be used to scan malware in memory image.
Imphash see FireEye Blog
More details are described in the following documents:
https://www.jpcert.or.jp/magazine/acreport-impfuzzy_volatility.html (Japanese)
http://blog.jpcert.or.jp/2016/12/a-new-tool-to-d-d6bc.html (English)
This plugin requires the following modules:
Use -h to see help message.
- impfuzzy - compare or print the impfuzzy
- imphashlist - print the imphash
- imphashsearch - search the imphash
$ python vol.py -f [image] --profile=[profile] impfuzzy -p [PID] -a
$ python vol.py -f [image] --profile=[profile] impfuzzy -e [PE File or Folder]
$ python vol.py -f [image] --profile=[profile] impfuzzy -i [Hash List File]
$ python vol.py -f [image] --profile=[profile] imphashlist -p [PID]
$ python vol.py -f [image] --profile=[profile] imphashsearch -i [Hash List]