scan.now
Premium Scan a site

File hash reputation

Scan.now computed the file's SHA-256 (plus MD5 and SHA-1 for comparison with older feeds) and compared it with the hash lists it holds; this entry explains what a match or a miss means.

Do this: Nothing to do; this is the file's history on Scan.now. The same file has been scanned here before; the history is context, not a verdict.
PassThe file's hash is not in any known-malicious list we hold.
InfoThe file's hash matched a known-malicious entry.

The fix, in one snippet

Example to adapt Check it anywhere else too 
sha256sum file.bin   # paste the hash into any reputation service

Illustrative values. Change the paths, hostnames and options to match your own site before using it.

The sections below explain what is tested, why it matters and the alternatives.

What we test

The hashes are computed in memory as the upload streams in; the file itself is never stored. The SHA-256 is compared against the lists Scan.now holds locally: known-malicious hashes drawn from public feeds such as abuse.ch MalwareBazaar and from earlier scan verdicts. A malicious match is reported as known malware signature; otherwise this entry shows the hashes so you can look them up yourself. Scan.now does not submit your file to VirusTotal or any third party. Limits: a hash matches only a bit-identical file, so recompiling, padding or repacking a sample produces a new hash that no list has seen; "unknown" is the normal result for most files and says nothing about safety.

Why it matters

A hash is the universal identifier for a sample across antivirus vendors, incident responders and sandboxes. A match with a known-bad hash is definitive because the bytes are identical to something analysts have examined. The reverse is equally useful: a vendor publishes the SHA-256 of an installer, and a matching hash proves your download was not altered in transit or on a mirror. The 2024 xz-utils backdoor was confirmed partly by comparing release tarball hashes with the repository, and supply-chain compromises such as 3CX in 2023 were traced by hash once the malicious builds were identified.

How to fix it

Compare with the vendor's published value:

$ shasum -a 256 installer.dmg          # macOS / Linux
PS> Get-FileHash .\installer.exe -Algorithm SHA256   # Windows
C:\> certutil -hashfile installer.exe SHA256

Search the hash on MalwareBazaar or VirusTotal; searching a hash does not upload the file. If nothing is found and the file came from an untrusted source, fall back on the structural findings and open it in a sandbox. Guides: file hashes explained, is this file safe? and scanning downloads before opening.

Where this fits

File hash reputation is check 20 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.

Fix this one first

Above it in the same category sits EICAR antivirus test file (info), where the file contains the EICAR test string, a harmless sequence that every antivirus engine is required to detect. An attacker who has that does not need this, so it is the better use of the same hour.

Prompt for an AI Hand this check to an assistant Sign in to copy it
The first few lines 
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.

Finding: File hash reputation (info severity)
Scanner check id: file-hash-lookup
17 more lines, including the evidence and the exact fix

The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.

Sign in with Google

Signing in is free and takes one click. We store your email address and nothing else.

References

  1. NIST FIPS 180-4: Secure Hash Standard
  2. abuse.ch MalwareBazaar
  3. VirusTotal documentation
  4. Microsoft: Get-FileHash

Related guides

8 min read · Updated Sep 08, 2026 File Hashes Explained: MD5, SHA-1, SHA-256 and How They Identify Malware

A hash is a fixed-length fingerprint of a file's bytes. How hashing works, why MD5 and SHA-1 are no longer trusted for security, how...

Read the guide 8 min read · Updated Sep 16, 2026 Is This File Safe? A Step-by-Step Way to Judge a File Before Opening It

You have a file and you are not sure. This guide gives an order of checks: Where it came from, its real type, its hash, a scan, and the...

Read the guide 8 min read · Updated Sep 17, 2026 How to Scan Downloads Before Opening Them (and What Your Browser Already Does)

Browsers, operating systems and online scanners each check downloads differently. What happens between clicking a link and opening the...

Read the guide