Which of the following techniques is used to compute the hash value for a given binary code to uniquely identify malware or periodically verify changes made to the binary code during analysis?

File fingerprinting is the process of generating a unique digital signature for a file using a cryptographic hash function (e.g., MD5, SHA-1, SHA-256). This resulting hash value, or "fingerprint," serves as a unique identifier for the malware binary. Threat intelligence platforms and analysts use this fingerprint to quickly identify known malware samples without analyzing the full file. It is also used to verify the integrity of the binary; any modification, however small, will result in a different hash value, immediately indicating that the file has been altered during analysis.

B. Strings search: This technique extracts readable text sequences from a binary to find clues about its functionality, such as URLs or file paths, not to compute a unique identifying hash.
C. Local and online malware scanning: This is the process of using antivirus engines to check a file against a database of known threats. While scanners use file fingerprints for lookups, scanning is not the technique of creating the fingerprint.
D. Malware disassembly: This is the process of converting binary machine code into human-readable assembly language to analyze the malware's logic and control flow, not to generate a unique hash identifier.

1. Bailey, M., & Zurutuza, U. (2015). CS 412: Introduction to Computer Security - Lecture 11: Malware. University of Illinois Urbana-Champaign. In the lecture slides on Static Analysis, the use of cryptographic hashes (MD5, SHA1) is explicitly mentioned as a primary method for malware identification. (See slide titled "Static Analysis: Hashes").

2. Vidas, T. (2017). INSC 790/CYBR 498: Malware Reverse Engineering - Lecture 2: Static Analysis. University of South Carolina. The course material details that file fingerprinting via hashing (MD5, SHA-1, SHA-256) is a fundamental first step in static analysis to uniquely identify a sample and check for its existence in databases like VirusTotal. (See section on "File Identification").

3. Sikorski, M., & Honig, A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press. As referenced in the syllabus for Columbia University's COMS E6998 "Advanced Topics in Malware Analysis," Chapter 5 discusses basic static analysis techniques, detailing the use of cryptographic hashing to create unique fingerprints for malware identification (pp. 95-97).