thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

File Hash

A fixed-length value computed from file content by a hash function, used to identify files and verify integrity.

Definition

Hashes such as MD5, SHA-1 and SHA-256 uniquely represent file content; any change produces a different hash. Analysts use hashes as IoCs, look them up in reputation services such as VirusTotal and verify evidence integrity. Fuzzy hashes such as ssdeep and TLSH find similar files.

Example

Get-FileHash suspicious.exe -Algorithm SHA256

Exam tip

Hashes are trivially changed by attackers, which is why they sit at the bottom of the Pyramid of Pain.

Related terms