Closed N0fix closed 10 months ago
I'm a bit torn in this case: I see the rationale in staying consistent with imphash
, even more in the case that yara is also using md5
.
Ideally all these methods would be using sha256
, but one can't update imphash
without causing major issues, I'd say it's not worth the pain.
Hence I'm leaning towards merging and using md5
and hoping not many people have started relying on the sha256
results.
PR #354 added exphash using the
sha256
function instead ofmd5
, which creates two issues:This PR proposes using
md5
instead ofsha256
for exphash to maintain consistency.Note: I believe this confusion stems from a discrepancy between the original blog post about exphash, which mentions the usage of
sha256
, and its integration into public community projects.