malwareCoreRuns in the API, always on

Hash It Out

  • intro
  • 50 pts
  • First blood: still open

Your team keeps a short list of file hashes that were seen during an incident: five SHA-256 indicators, each a fingerprint of one file. A hash is a fixed-length value computed from a file's contents, so two identical files always share one, and changing a single byte changes it completely.

A specimen has been handed to you with no name attached. Read its SHA-256 on the viewer's Overview tab (or compute it yourself from the download), then compare it against the indicator list in the answer box. Exactly one line matches. Compare every character: matching the first few is not enough to call two digests the same.

Everything here is an inert teaching specimen made by us in our own format: it contains no working code, and every host and address in it is fictional. You are practising a comparison, not opening anything.

Submit the indicator from the list that matches the specimen. Think afterwards about why a hash match is strong evidence of identity but a mismatch proves little: any small edit produces a different value.

  • malware-analysis
  • hashing
  • ioc

Hints

Hints do not affect your points. Each one stays revealed.

Hint 1
Hint 2
Hint 3
Jump to workbench
Loading the play area...