From PCAP to Fingerprint: Structural Malware Detection with Arkime + Holloman3

Traditional malware detection relies on cryptographic hashes — MD5, SHA1, SHA256. Change a single byte and the hash becomes unrecognizable. Malware authors know this. They re-pack, re-compile, or add junk bytes to evade signature-based detection. What if you could fingerprint the structure of a file instead of its exact bytes? That’s what holloman3 does. It’s a perceptual hash — files with similar binary structure produce similar fingerprints. A single-byte change produces a 1-bit difference in the fingerprint. This post walks through the complete workflow: extracting HTTP bodies from a PCAP, fingerprinting them with holloman3, and configuring Arkime to alert on the result. The PCAP We’re working with a 219 MB PCAP captured on a loopback interface recording malware distribution traffic. The file contains 199,307 packets across 102 TCP flows — all HTTP sessions serving executable payloads. One of the files delivered in this session has a VirusTotal report worth examining: 49/72 engines…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town