Hash Lookup

What Is Hash Lookup

Hash lookup searches databases of known file hashes to identify whether a file is recognized as legitimate software, known malware, or previously analyzed by security researchers. By computing a cryptographic hash (MD5, SHA-1, or SHA-256) of a file and querying hash databases, security analysts can instantly classify files without executing them or performing time-consuming manual analysis.

Hash-based file identification is a cornerstone of malware analysis, incident response, and threat intelligence. Services like VirusTotal, NIST NSRL (National Software Reference Library), and CIRCL hashlookup maintain databases of billions of known file hashes. A single hash query can tell you whether a suspicious file is a known malware sample, a legitimate Windows system file, or a common open-source library.

How Hash Lookup Works

Cryptographic hash functions produce a fixed-length fingerprint of any input data. Even a one-bit change in the file produces a completely different hash, making hashes reliable file identifiers:

Hash database types:

• Known-good (allowlist): NIST NSRL catalogs hashes of legitimate software from OS vendors, application developers, and package managers
• Known-bad (blocklist): Malware hash databases from antivirus vendors, threat intelligence feeds, and community submissions
• Multi-scanner results: VirusTotal aggregates detection results from 70+ antivirus engines for each hash

Limitations: Hash lookup only identifies exact matches. Polymorphic malware that changes its code with each copy, packed executables, and minor file modifications all produce different hashes. Fuzzy hashing (ssdeep, TLSH) addresses this by detecting similar—not identical—files.

Common Use Cases

• Malware triage: Quickly determine if a suspicious file is known malware before investing in dynamic analysis
• Incident response: Check file hashes found on compromised systems against threat intelligence databases
• Allowlist management: Verify that files in your application allowlist match known-good software hashes
• Forensic analysis: Identify unknown files on disk images by comparing their hashes to known software databases
• Threat hunting: Search for specific malware hashes across endpoint telemetry to detect unreported infections

Best Practices

1. Always compute SHA-256 — It is the current standard; MD5 and SHA-1 have known collision vulnerabilities
2. Query multiple databases — No single database is comprehensive; check VirusTotal, NSRL, and threat feeds
3. Don't rely solely on hash matching — Zero-day malware and polymorphic threats won't appear in any hash database
4. Use fuzzy hashing for similarity — Tools like ssdeep and TLSH identify files that are similar but not identical to known samples
5. Maintain an internal hash inventory — Track hashes of approved software in your environment for rapid allowlist checks