Cyberstudy
Supplementary — not from your PDF Beginner ~20 min

Check a file's reputation by its hash

Hash a legitimate installer and look the hash up in a public reputation service. This is how analysts check an indicator of compromise without handling a suspicious file.

Environment

Your own computer and a browser (e.g. virustotal.com, using the Search tab).

Before you start

  • Read TTPs and IoCs (p.342), Malicious Activity Indicators (p.344) and Threat Feeds (p.234).

You will

  • Use a hash as an indicator
  • Read a reputation report
  • Know why hash matching has limits

Steps

  1. 1

    Take a legitimate installer you downloaded earlier and compute its SHA-256 (Get-FileHash or sha256sum).

  2. 2

    In the reputation service, open Search (not Upload) and paste the hash.

  3. 3

    Read the report: detection count, first-seen date, file names, signature or publisher information.

  4. 4

    Change one byte in a copy of a small test file and compare the hashes, so you can see how easily a hash-based indicator can be dodged.

  5. 5

    Write two sentences on why analysts combine hashes with behavioural indicators and TTPs.

Check your understanding

  • ?Is a file hash an IoC or a TTP?
  • ?Why can a brand-new malicious file have zero detections?
  • ?Why search rather than upload when a file might contain confidential data?