drop two or more binaries · compute structural and syntactic similarity · detect code reuse between malware samples · identify variant families · shared developer indicators · function-level similarity without execution · runs locally
binaries
drop binaries
2–10 files · n-gram · imports · strings · basic blocks
drop 2–10 PE · ELF · Mach-O binaries