MD5 Hash Malware Lookup

Already have a file's MD5 hash? Paste it below to check it against the iMalware database of 1,045,564 known malware hashes. Don't have the hash? Just drop the file on the scanner and it will be computed for you.

MD5 hash Check hash

How the lookup works

The database is split into 4,096 buckets by the first three hexadecimal characters of each hash. When you check a hash, your browser downloads only the matching bucket (for example /md5/44d) and searches it locally. The server never sees the full hash you are checking.

How to get a file's MD5 hash

• Windows: certutil -hashfile "C:\path\file.exe" MD5 or, in PowerShell, Get-FileHash "C:\path\file.exe" -Algorithm MD5
• macOS: md5 /path/to/file
• Linux: md5sum /path/to/file

MD5, SHA-1 and SHA-256

All three are cryptographic hash functions that produce a fixed-length fingerprint of a file: MD5 is 32 hex characters, SHA-1 is 40 and SHA-256 is 64. MD5 is no longer considered secure for signatures because collisions can be engineered, but it remains widely used to identify known files in malware databases. iMalware's database is indexed by MD5; if you only have a SHA-256 hash, you can search it on VirusTotal without uploading anything.

Understanding the result

• Known malware hash: the exact file is a known malicious sample. Don't open it; delete or quarantine it.
• Not found: the file isn't in our list of known samples. That's a good sign but not a guarantee; new or modified malware has a different hash. See how to investigate an unknown file.

Frequently Asked Questions