Free tool Runs in your browser
Analyse a file without handing it over.
Drop a file and read it the way an analyst would: its hashes, what the bytes really are, and, for a Windows program, its imphash, imported capabilities and section entropy. It spots packed code, Office macros, archive contents, files glued on the back of an image, and names disguised to run as something else. All in your browser.
The file is read and hashed on this machine. Uploading a suspicious file to a scanning service publishes it, and if it contains your company's data that is a second incident. Hashing it does not.
Drop and analyse
The file
Drop a file here, or several at once, up to 256 MB in total.
Checksums published next to a download are how you tell an official build from a tampered mirror. This compares all four at once, so it does not matter which one they published.
What it reads
Drop a file and it checks all of this, here in your browser.
- Cryptographic hashesMD5, SHA-1, SHA-256 and SHA-512, to look a file up or verify a download against a published value.
- What it really isThe format read from the bytes rather than the extension, across dozens of types from executables to archives to images.
- Windows programsBitness, whether it is an EXE, a DLL or a driver, how it runs, the compile time, and the section table with each section's entropy and permissions.
- imphashThe fingerprint of a program's import table, which ties a sample to its family even when the file itself is changed, with a search link.
- What the imports allowProcess injection, dynamic loading, downloading, persistence, anti-analysis, keylogging and crypto, grouped so the combination tells a story.
- Entropy and packingA reading across the whole file that shows compressed or encrypted regions, and a flag when the code itself looks packed.
- Office macrosA macro project hidden inside a document, read from the archive directory without opening or running anything.
- Archive contentsWhat is inside a zip, including executable entries, password-protected ones, and paths that try to escape the extraction folder.
- Embedded indicatorsURLs, hosts and addresses pulled out of the file's own readable strings and passed through the indicator reader.
- Name and polyglot tricksReordering characters and double extensions in the name, and a second file glued on after this one logically ends.
None of this uploads the file. Every check runs on this page, and what you drop is gone when you close the tab.
What a hash is good for
A name is not evidence. A hash is.
Uploading is a decision
Sending a file to a public scanner makes it available to everyone with an account there, including the person who sent it to you. If the file holds your data, or the fact you have it is sensitive, hash it here and search the hash instead.
The first bytes do not lie
Extensions are a suggestion. A file whose name ends in .pdf but whose first two bytes are MZ is a Windows executable, and that mismatch is the oldest trick in phishing.
A folder at a time
Drop several files together and you get a table: what each one really is, its SHA-256, and which of them are the same file under different names. That last question is the one a mailbox full of attachments usually raises.
Verifying a download
Compare what you downloaded with the hash the publisher put next to it. A match tells you the bytes are the ones they meant to ship. It says nothing about whether they meant well.
MD5 is broken, and still useful
Nobody should trust MD5 to prove two files are the same, because collisions can be built to order. As a lookup key in threat intelligence it is everywhere, so it is here too.
New to this? Read the phishing triage walkthrough, which uses this tool and the others in order.
Found something you did not expect?
A file that is not what it claims usually arrived somehow. Working out how, and what else came with it, is incident response.