HashDB also includes a basic algorithm search that will attempt to identify the hash algorithm based on a hash value. For example, if one of the hashes identified is SleepВ from the kernel32В module, HashDB can then pull all the hashed exports from kernel32. This is a quick way to pull hashes in bulk.

If a hash is part of a module a prompt will ask if you want to import all the hashes from that module. The right-click also provides a quick way to set the XOR value if needed. Once the plugin settings have been configured you can right-click on any constant in the IDA disassembly window and look up the constant as a hash.

The enum name is configurable from the settings in the event that there is a conflict with an existing enum. This enum can then be used to convert hash constants in IDA to their corresponding enum name. When a new hash is identified by HashDB the hash and its associated string are added to an enumВ in IDA. If you are using your own internal server this URL can be changed to point to your server. The default API URL for the HashDB Lookup Service is. There is also an option to enable XOR with each hash value as this is a common technique used by malware authors to further obfuscate hashes. The settings window can be launched from the plugins menu Edit->Plugins->HashDB.Д¬lick Refresh AlgorithmsВ to pull a list of supported hash algorithms from the HashDB API, then select the algorithm used in the malware you are analyzing. HashDB can be used to look up strings that have been hashed in malware by right-clicking on the hash constant in the IDA disassembly view and launching the HashDB LookupВ client.Д«efore the plugin can be used to look up hashes the HashDB settings must be configured. Pull requests are mostly automated and as long as our automated tests pass the new algorithm will be usable on HashDB within minutes. The hash algorithm database is open source and new algorithms can be added onВ GitHub here. This plugin connects to the OALABSВ HashDB Lookup Service. Hashdb-Ida is tool for Malware string hash lookup plugin for IDA Pro.

Ida pro plugin