Hash Checker — How to Use and Interpret a Match
Use the OpenTrojan Hash Checker to fingerprint MD5/SHA-1/SHA-256 file hashes, check known threat-intelligence hashes, and understand what a match means.
Quick Answer
Hash Checker identifies the hash algorithm and checks the digest against known threat-intelligence hashes; a match is strong but not conclusive evidence and still warrants investigation.
Definition
Hash Checker detects MD5/SHA-1/SHA-256 digests and compares them against known threat-intelligence file hashes.
What it is
Hash Checker (/tools/hash/) recognizes the digest type (MD5 / SHA-1 / SHA-256) and checks it against known file-hashes in the intelligence store.
How to use
- Generate a hash of the file you suspect (
sha256sum file,Get-FileHash, orshasum). - Paste the digest into
/tools/hash/. - The tool returns the detected algorithm and any intelligence match.
Interpretation
- Type recognized — confirms the digest algorithm, so you know what you are comparing.
- Match found — the digest appears in known-malware knowledge; treat as a strong indicator that warrants investigation, not a verdict.
- No match — no known record here; an unfamiliar binary is not cleared.
Limitations
- Malware can be recompiled to change its hash; a matching hash is reliable, but a non-match is weak evidence.
- The checker matches known hashes; it does not sandbox or statically analyze the file.
Privacy
Only the digest is stored/handled, not the file. The digest is a non-reversible identifier and, for the local path, never leaves the browser; the intel check sends the digest to the API.
Next steps
- Read the output precisely → Interpret Hash Checker results.
- Fold it into a full trace → Investigate malware.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.