Malware Hash Checker

Hash lookup answers one narrow question

It asks whether this exact file, byte for byte, has been seen and classified before. That is genuinely useful and strictly limited. Change a single byte and the hash changes completely, so a trivially modified variant of known malware returns no result at all. This is why hash-based detection is a first pass rather than a verdict, and why attackers repack payloads for each campaign.

A clean result means unknown, not safe

The distinction matters more than any other point here. A hash absent from every database means nobody has submitted or classified this file, which is exactly what you would expect for freshly compiled malware and for a targeted attack aimed at one organisation. Reading "no detections" as "safe" inverts the meaning of the result.

Detections are not unanimous, and should not be

Multi-engine services show results from dozens of scanners, and disagreement is normal. One or two detections out of seventy, particularly with generic names containing "Heuristic", "Suspicious" or "Gen", frequently indicate a false positive — packed installers, self-extracting archives and code-signing tools trigger these constantly. Ten or more detections with specific family names is a strong signal. The pattern of names carries more information than the count.

Which hash to submit

SHA-256 is the current standard and what threat intelligence indexes on. MD5 and SHA-1 are still widely published in indicator lists for historical reasons, and remain adequate for lookup even though they are broken for security purposes — an attacker constructing a collision to evade a lookup is a scenario that does not arise in practice.

Submitting files has consequences

Uploading a file to a public multi-scanner service makes it available to security researchers and, on many platforms, to paying subscribers. Confidential documents, internal binaries and anything containing credentials should not be submitted. Hash lookup carries none of that exposure, because the hash reveals nothing about content — which is a good reason to check the hash first and only submit the file if you must.

Where it fits in an investigation

Hash checking is fast triage. It quickly confirms known-bad files and quickly eliminates well-known good ones. Anything returning unknown needs behavioural analysis, sandbox execution or expert review — and the files that matter most in a real incident are usually the ones that return nothing.