TLSH: fuzzy hashing for malware clustering
July 25, 2026
A cryptographic hash is designed so that flipping one bit scrambles the entire digest. That’s perfect for integrity and useless for similarity - change a byte in a sample and its SHA-256 tells you nothing about how close the two files are. Fuzzy hashing inverts that property: similar inputs produce similar digests, so you can measure distance between files. TLSH (Trend Micro Locality Sensitive Hash) is the one I reach for at corpus scale.
The idea
TLSH slides a window across the file, populates a table of buckets based on byte triplets, and derives a compact digest from the statistical distribution of those buckets - plus a header capturing overall properties like length and quartile ratios. Two files built from mostly the same bytes populate the buckets similarly, so their digests land close together.
Comparison isn’t equality; it’s a distance score. Zero means effectively identical; the number climbs as files diverge. You pick a threshold and cluster everything within it:
offsetscan cluster ./samples --recurse --threshold 40
# lower threshold = tighter, fewer clusters
# ClusterId shared = near-duplicates; null = a singleton
Why it matters for triage
Exact-hash dedup collapses only byte-identical files. A repacked or recompiled variant has a fresh SHA-256 and slips the net - but TLSH still parks it next to its siblings. Across a few thousand samples that turns an undifferentiated pile into a handful of families, and a new arrival can be scored against known clusters instead of analyzed cold.
A few honest limits. TLSH needs a minimum amount of data and variance - very small or very uniform files won’t produce a usable digest. Threshold choice is a judgment call: too loose and unrelated families merge, too tight and genuine variants split. And like imphash, similarity is a lead, not attribution - pair it with import hashing and the build-toolchain fingerprint so agreement across independent axes carries the weight, not any single score. It shines exactly where single-file inspection can’t answer the question: which of these thousands are the same thing wearing different clothes?