Permhash (permissions hash)
ID permhash
This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).
Hash of the permissions that an Android app (APK or its AndroidManifest.xml) or a Chromium browser extension (CRX or its manifest.json) declares, published by Mandiant in 2022. The declared permissions are joined into one string and hashed with SHA-256, so the value is written as 64 lowercase hexadecimal digits. Like imphash for Windows executables, it groups samples built from the same code base: apps or extensions with identical permission lists share a permhash. VirusTotal reports it as the permhash attribute of a file and can search by it. The value alone looks like any other SHA-256 hash.
- Parent datatype
- SHA-256 hash
sha256hash - Categories
- Software development
- Countries
- Global (not tied to a country)
- Languages
- Common to most languages
- Quality
- 68/100 · missing: second example, mapping (Wikidata, Schema.org, ...), translation, detector coverage
- Metacrafter rules
- no detection rule yet
- Supported by tools
- no tool record lists this type yet
Regular expression
^[0-9a-f]{64}$Python re syntax.
Examples
| Value | Description |
|---|---|
| a2172d455b6bfb4fa9ef4593e5477226ed73a7f2354902b62f1e8f796009888a | Permhash of an Android APK (package ru.oneme.app) in its VirusTotal report |
| a2172d455b6bfb4fa9ef4593e5477226ed73a7f2354902b62f1e8f796009888 invalid | 63 hexadecimal digits, one short |
Sources
- doc: https://github.com/google/permhash
- other: https://cloud.google.com/blog/topics/threat-intelligence/permhash-no-curls-necessary/
- other: https://virustotal.readme.io/reference/files
Use this record
- Page URL:
https://registry.apicrafter.io/datatype/permhash - JSON: API v1 · legacy shape (used by metacrafter) · Markdown (for LLMs)
- Improve it: edit
data/datatypes/any/software/permhash.yamlon GitHub