@prefix skos: <http://www.w3.org/2004/02/skos/core#> .
@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
@prefix foaf: <http://xmlns.com/foaf/0.1/> .
@prefix mcr: <https://registry.apicrafter.io/vocab#> .
@prefix dt: <https://registry.apicrafter.io/datatype/> .
@prefix cat: <https://registry.apicrafter.io/category/> .
@prefix country: <https://registry.apicrafter.io/country/> .
@prefix tool: <https://registry.apicrafter.io/tool/> .

dt:permhash a skos:Concept ;
    skos:inScheme <https://registry.apicrafter.io/> ;
    skos:notation "permhash" ;
    skos:prefLabel "Permhash (permissions hash)"@en ;
    skos:definition "Hash of the permissions that an Android app (APK or its AndroidManifest.xml) or a Chromium browser extension (CRX or its manifest.json) declares, published by Mandiant in 2022. The declared permissions are joined into one string and hashed with SHA-256, so the value is written as 64 lowercase hexadecimal digits. Like imphash for Windows executables, it groups samples built from the same code base: apps or extensions with identical permission lists share a permhash. VirusTotal reports it as the permhash attribute of a file and can search by it. The value alone looks like any other SHA-256 hash."@en ;
    skos:broader dt:sha256hash ;
    skos:example "a2172d455b6bfb4fa9ef4593e5477226ed73a7f2354902b62f1e8f796009888a" ;
    mcr:status "draft" ;
    mcr:isPII false ;
    mcr:classification "identifier" ;
    mcr:regexp "^[0-9a-f]{64}$" ;
    rdfs:seeAlso <https://github.com/google/permhash> ;
    rdfs:seeAlso <https://cloud.google.com/blog/topics/threat-intelligence/permhash-no-curls-necessary/> ;
    rdfs:seeAlso <https://virustotal.readme.io/reference/files> .