SHA-256 Hash Verification

Purpose: Generate the industry-standard cryptographic fingerprint of a file — the gold standard for malware identification.

---

1. Quick Commands

Windows (Cmder / PowerShell)

# Using sha256sum (Cmder / Git Bash / WSL)
sha256sum.exe FileName.exe

# Using PowerShell native (default algorithm IS SHA256)
Get-FileHash FileName.exe

# Using certutil
certutil -hashfile FileName.exe SHA256

Linux / macOS

# Standard
sha256sum FileName.exe

# macOS
shasum -a 256 FileName.exe

# OpenSSL
openssl dgst -sha256 FileName.exe

---

2. What is SHA-256?

• SHA-256 (Secure Hash Algorithm 256-bit) is part of the SHA-2 family designed by the NSA
• Produces a 256-bit (64 hex character) hash
• Published by NIST in 2001
• No known collisions — cryptographically secure as of 2025
• Used in Bitcoin, SSL/TLS certificates, digital signatures, and malware identification

Example Output

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  empty_file.txt
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824  hello.txt
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08  malware_sample.exe

---

3. SHA-256 — The Authoritative Identifier

SHA-256 is the primary hash used across the entire threat intelligence ecosystem:

Platform / Tool	Primary Hash	Notes
VirusTotal	SHA-256	Primary lookup key, URL format uses SHA-256
MISP	SHA-256	Threat intelligence sharing standard
YARA	SHA-256	Hash matching in rules
MalwareBazaar	SHA-256	Primary identifier in API
ClamAV	SHA-256	Signature database
STIX/TAXII	SHA-256	Standard IOC indicator
Sigma rules	SHA-256	File hash detection

---

4. Complete Hashing Workflow for Malware Analysis

Step 1: Generate All Hashes

# Generate MD5, SHA-1, and SHA-256 in one go
echo "=== File Identification ==="
echo "Filename: $(basename malware.exe)"
echo "Size:     $(stat -c %s malware.exe) bytes"
echo "MD5:      $(md5sum malware.exe | awk '{print $1}')"
echo "SHA-1:    $(sha1sum malware.exe | awk '{print $1}')"
echo "SHA-256:  $(sha256sum malware.exe | awk '{print $1}')"
echo "File:     $(file malware.exe)"

Step 2: VirusTotal Lookup

# Direct URL format (open in browser)
# https://www.virustotal.com/gui/file/<SHA256_HASH>

# Using VT API (requires API key)
curl -s "https://www.virustotal.com/api/v3/files/<SHA256_HASH>" \
  -H "x-apikey: YOUR_API_KEY" | python3 -m json.tool

Step 3: Automated Multi-Platform Lookup

#!/usr/bin/env python3
"""Quick hash lookup across multiple platforms"""
import hashlib
import sys

def hash_file(filepath):
    """Generate all hashes for a file"""
    md5 = hashlib.md5()
    sha1 = hashlib.sha1()
    sha256 = hashlib.sha256()
    
    with open(filepath, 'rb') as f:
        while chunk := f.read(8192):
            md5.update(chunk)
            sha1.update(chunk)
            sha256.update(chunk)
    
    return {
        'md5': md5.hexdigest(),
        'sha1': sha1.hexdigest(),
        'sha256': sha256.hexdigest()
    }

if __name__ == '__main__':
    hashes = hash_file(sys.argv[1])
    print(f"MD5:    {hashes['md5']}")
    print(f"SHA-1:  {hashes['sha1']}")
    print(f"SHA-256:{hashes['sha256']}")
    print(f"\nVirusTotal: https://www.virustotal.com/gui/file/{hashes['sha256']}")
    print(f"MalwareBazaar: https://bazaar.abuse.ch/sample/{hashes['sha256']}/")
    print(f"Hybrid Analysis: https://www.hybrid-analysis.com/search?query={hashes['sha256']}")

---

5. Hash Databases & Threat Intelligence

Known-Good Hash Databases (Whitelisting)

Database	Description
NSRL (NIST)	National Software Reference Library — hashes of known legitimate software
HashSets.com	Community hash sets for known files
WinTriage	Windows system file hashes

Known-Bad Hash Databases (Blacklisting)

Database	URL	Description
MalwareBazaar	bazaar.abuse.ch	Community malware repo with SHA-256
MalShare	malshare.com	Free samples by hash
VirusShare	virusshare.com	Massive hash lists
ThreatFox	threatfox.abuse.ch	IOCs including hashes

---

6. OSINT Hash Pivoting

When you have a SHA-256 hash, pivot to discover the full attack chain:

SHA-256 Hash
    ├── VirusTotal "Relations" Tab
    │   ├── Contacted Domains → DNS history → related campaigns
    │   ├── Contacted IPs → geo-location → infrastructure mapping
    │   ├── Dropped Files → child payload hashes → next stages
    │   ├── Parent Files → dropper/loader that delivered this
    │   └── Execution Parents → process chain
    ├── MalwareBazaar
    │   ├── Family tags → malware family identification
    │   ├── Reporter → who submitted it
    │   └── Related samples → same campaign
    ├── ANY.RUN
    │   ├── Full behavioral report
    │   ├── Network traffic (PCAP)
    │   └── Process tree
    └── Hybrid Analysis
        ├── Sandbox report
        ├── Extracted strings
        └── MITRE ATT&CK mapping

---

7. Verifying File Integrity

Use Case: Verify a Download

# Download a tool and verify its hash
wget https://example.com/tool.tar.gz
wget https://example.com/tool.tar.gz.sha256

# Verify
sha256sum -c tool.tar.gz.sha256
# Expected output: tool.tar.gz: OK

Use Case: Verify Evidence Integrity (Forensics)

# At acquisition time
sha256sum disk_image.dd > evidence_hash.txt

# Before analysis
sha256sum -c evidence_hash.txt
# If OK → evidence is unmodified
# If FAILED → evidence was tampered with

---

8. Hash Comparison Table

Algorithm	Bits	Hex Chars	Collision Resistance	Speed	Use Case
MD5	128	32	Broken	Fastest	Quick lookups only
SHA-1	160	40	Broken (2017)	Fast	Legacy, avoid for security
SHA-256	256	64	Strong	Medium	Primary identifier (use this)
SHA-512	512	128	Strong	Slower	Maximum security needs
SSDEEP	Fuzzy	Variable	N/A (similarity)	Slow	Find similar (not identical) files
TLSH	Fuzzy	72	N/A (similarity)	Medium	Fuzzy matching malware variants

---

Pro Tips

Always use SHA-256 as your primary identifier — It’s the industry standard, all platforms accept it, and it’s cryptographically secure.

Generate hashes BEFORE opening the file — Opening in analysis tools might modify timestamps or trigger AV that quarantines the file.

Fuzzy hashes (SSDEEP/TLSH) complement exact hashes — Use ssdeep -b malware_*.exe to find variants of the same malware family even when the SHA-256 is different.

Automate hashing in your workflow — Create an alias: alias hashit='md5sum $1 && sha256sum $1 && ssdeep $1'