soc · beginner
Interpret a safe simulated VirusTotal-style hash report without uploading or executing files.
Login required to start this lab and save your progress.
Section 1 · 1 tasks
MD5, SHA-1, and SHA-256 are identifiers derived from file bytes. Investigators use hashes to search known observations without transferring the file itself. MD5 and SHA-1 remain useful lookup keys, but SHA-256 is preferred for integrity-sensitive work.
Section 2 · 1 tasks
Obtain the hash safely, search it, review the detection ratio, inspect file type and size, compare known names, review available timestamps, and record indicators. Never download or execute an unknown sample merely to complete triage.
Section 3 · 1 tasks
A detection ratio reports how many engines flagged an item at a point in time. Vendors may disagree, signatures may lag, and false positives occur. A low or zero count is not proof of safety. File type, names, behavior, provenance, and environment context must also be considered.
Section 4 · 3 tasks
SHA-256: 1111111111111111111111111111111111111111111111111111111111111111
Detection: 4/70. Type: Windows PE executable. Known names: invoice_viewer.exe, viewer_update.exe. First submitted: 2026-04-12. Strings include updates.example.invalid and RunOnce. The file arrived unexpectedly by email. This is synthetic training data, not a real sample.
