TLSH Fuzzy Hash & Malware Comparator

Calculate Trend Micro Locality Sensitive Hashes (TLSH) and compute distance scores to detect polymorphic malware family variants and binary similarities.

How to Use TLSH Fuzzy Hash & Malware Comparator

  1. Input Two TLSH Fuzzy Hashes: Provide Trend Micro Locality Sensitive Hash strings for comparison.
  2. Compute Statistical Distance Score: Calculates the distance difference between byte distributions and quartiles.
  3. Interpret Similarity Confidence: Scores < 30 indicate high confidence of variant similarity; scores > 100 indicate distinct software.

Frequently Asked Questions

How does TLSH differ from traditional cryptographic hashes?

In SHA-256, changing a single bit changes the entire hash randomly (avalanche effect). In TLSH, minor code changes produce very similar hashes, making it ideal for tracking mutated malware variants.