Two samples share the same imphash. Can you conclude they belong to the same malware family?
Short answer
No, not conclusively. An imphash hashes the ordered list of a PE file's imported libraries and functions, so a match means identical import tables and suggests a similar build. But shared builders, packers or tiny tools with few imports can collide, and attackers can alter it. Treat it as a pivot and clustering hint, then confirm with other evidence.
Imphash is popular for clustering PE samples, and the interview trap is treating a match as attribution.
What an imphash is
Mandiant describes creating "a hash based on library/API names and their specific order within the executable." Names are lowercased, ordinals resolved, file extensions of module names removed, and the ordered list is hashed with MD5. The function is available in the pefile library as get_imphash().
Why it works
The linker builds the import address table in an order that depends on the source and build, so, in Mandiant's words, files with the same imphash "have the same IAT, which implies that the files were compiled from the same source code, and in the same manner." It is useful for pivoting to related samples and for tracking backdoors over time.
Why it is not proof
The same write-up cautions that matching files are "not guaranteed to originate from the same threat group," for example when a common builder is shared. For packed samples or simple utilities with few imports, the value "may not be unique enough to be useful for attribution." Attackers can also change source or link order, or modify the hash.
Why the distractors are tempting
"Same source, same group" over-reads the source's wording. "Byte-identical" confuses it with a file hash.
What interviewers want
"A strong clustering hint, never standalone evidence — corroborate with code, infrastructure and behaviour."
Likely follow-ups
- How is an imphash calculated, and what normalisation does it apply?
- How can an attacker change a sample's imphash without changing behaviour?
- What other similarity signals would you combine with it, such as YARA rules or fuzzy hashes?