Clustering groups samples using fuzzy-hash similarity (ssdeep, TLSH, or sdhash).

Static analysis comes from Malcat: strings + per-function disassembly. Disassembly is normalized by abstracting registers/immediates/memory to placeholders (optional full normalization).

Dynamic analysis comes from CAPEv2: signatures, behavior summary, dropped files and apicalls.

Progressive compare works inside each cluster: results are merged pairwise, keeping the core shared artefacts across the whole cluster:

• Strings: set intersection + document-frequency counter.
• Functions: Longest Common Substring (LCS) on normalized ASM lines (kept if LCS ≥ threshold), with "identical" flag when exact match.
• Behavior summary: Work in progress...
• Signatures & API calls: merged using Jaccard overlap + Hellinger distance on counts.

Use the left buttons to switch dataset; some datasets offer names/categories views.