--- id: "permhash" kind: "datatype" status: "draft" is_pii: false categories: ["software"] langs: ["common"] quality: 68 url: "https://registry.apicrafter.io/datatype/permhash" --- # Permhash (permissions hash) (`permhash`) > **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions. Hash of the permissions that an Android app (APK or its AndroidManifest.xml) or a Chromium browser extension (CRX or its manifest.json) declares, published by Mandiant in 2022. The declared permissions are joined into one string and hashed with SHA-256, so the value is written as 64 lowercase hexadecimal digits. Like imphash for Windows executables, it groups samples built from the same code base: apps or extensions with identical permission lists share a permhash. VirusTotal reports it as the permhash attribute of a file and can search by it. The value alone looks like any other SHA-256 hash. - Parent datatype: `sha256hash` - Personal data (PII): no - Categories: Software development (software) - Countries: global - Languages: Common to most languages (common) - Classification: identifier ## Detection Regular expression (Python `re`): ``` ^[0-9a-f]{64}$ ``` ## Examples - `a2172d455b6bfb4fa9ef4593e5477226ed73a7f2354902b62f1e8f796009888a` — Permhash of an Android APK (package ru.oneme.app) in its VirusTotal report - `a2172d455b6bfb4fa9ef4593e5477226ed73a7f2354902b62f1e8f796009888` (invalid example) — 63 hexadecimal digits, one short ## Sources - doc: - other: - other: ## Quality Score 68/100. Missing: second example, mapping (Wikidata, Schema.org, ...), translation, detector coverage. JSON: · Edit: