← All detection heuristics · HWP
info
HWP_SEMANTIC_FINGERPRINT
What it means
Stable digest of decompressed HWP logical stream names and content.
Why it fires
OLE sector allocation and slack can change the outer file hash without changing the document. This fingerprint clusters files whose logical HWP streams are identical.
Other HWP heuristics
HWP_EMBEDDED_PE HWP_PE_MSHTA_REMOTE_EXEC HWP_OLE_PACKAGE_EXECUTABLE HWP_OLE_CLICK_TO_EXEC_LURE HWP_PS_EXEC HWP_PS_CVX_EXEC HWP_PS_SYSTEM HWP_SHELL_CMD HWP_POSTSCRIPT HWP_PS_HEXCODE HWP_JAVASCRIPT HWP_PS_FILE HWP_URL HWP_PS_FILTER HWP_SCRIPTS_STREAM HWP_BINDATA HWP_COMPRESSED HWP_STREAM_RAW_FALLBACK