Skip to main content

What hash reputation can and cannot tell you

Start with the file​

Before any lookup, write down what you actually have: where the file came from, when you received it, and its SHA-256 hash.

Identify the file type from its content, not its name. An extension is a claim. The first bytes are evidence.

shasum -a 256 sample.bin
file sample.bin
Why the hash changes between near-identical files

A cryptographic hash identifies exact bytes. Change one byte and the hash changes completely, so two files that behave the same can look unrelated in a lookup.

SHA-256 is the common key across reputation sources. Older reports may only list MD5 or SHA-1. Record those when you need to match them.

Read the lookup result​

A match tells you that a source has seen these exact bytes and labelled them. It says nothing about a file that differs by a single byte.

A missing result means the source has no record of these bytes. It does not mean the file is safe.

caution

“No results” is not “clean”. New, targeted or rebuilt files are often unknown everywhere.

Sources can disagree. Record each label with its source and the date you looked, instead of merging them into one opinion.

Keep evidence and interpretation separate​

Evidence is what a tool returned. Interpretation is what you think it means.

Keep them in different parts of the note, so a later reader can judge the evidence again without your conclusion in the way.

evidence:
  sha256: <hash>
  source: <reputation service>
  looked_up: 2026-09-22
  result: no match
interpretation:
  - Unknown to this source on this date.
  - Not evidence of safety.
confidence: low (no context on origin yet)
note

Write confidence in words and give one reason. A later reader needs the reason more than the rating.

Choose the next check​

Pick one check that could change your interpretation, then run it.

  • Unknown origin: ask where the file came from before deeper analysis.
  • Windows executable: read its imports and strings.
  • Script or document: read it as text first.

Running the file belongs in an isolated lab, never on a work machine.

Next step: File triage checklist, or follow the Triage an unfamiliar file runbook.

Sample content for layout review, not published research.