Skip to main content
Threat Intelligence

File Hash Reputation MD5, SHA1 and SHA256 lookup.

Try it now
Examples

MD5, SHA-1 or SHA-256. Examples use the EICAR test file. No file upload.

Output

How this check works · illustration

Look up a file hash before it stalls an investigation: known-malware verdict, related infrastructure and the sources behind it.

Check Hash FreeAPI Documentation
curl -d "email=you@example.com" https://ismalicious.com/api/keys/instant

50 free requests/month · instant API key · no signup form

32 hex characters
MD5
40 hex characters
SHA1
64 hex characters
SHA256
Active sources
725
Capabilities

Signals for your investigation, with their context.

Hash verdicts

Known-malware classification with its confidence, not just a raw match.

Related infrastructure

Pivot from a hash to related domains, URLs and IPs, when known.

Bulk enrichment

Mix hashes with IPs, domains and URLs in one batch call.

Incident context

Source evidence and threat categories, ready to attach to a case.

API-first

REST endpoints, SDKs and an OpenAPI spec for existing pipelines.

No file upload

Only the fingerprint leaves your environment, never the sample.

Applications

Use cases to evaluate first.

  1. EDR alerts

    Enrich endpoint alert hashes before escalating to Tier 2.

  2. SIEM and SOAR playbooks

    Batch-check hashes with domains, IPs and URLs during triage.

  3. Malware investigation

    Prioritize samples by known reputation, then pivot to infrastructure.

  4. Trust and safety

    Screen submitted file fingerprints without uploading user content.

FAQ

Frequently asked questions.

Which file hash formats are supported?

MD5 (32 hex characters), SHA1 (40) and SHA256 (64).

Is this a file upload sandbox?

No. isMalicious looks up hash reputation and related threat data. It never uploads or executes files.

How should SOC teams use hash reputation?

As an enrichment step for EDR, SIEM and incident alerts. Pair the hash verdict with the related IP, domain, URL and CVE context before acting.

Can I check hashes through the API?

Yes, one at a time or in bulk, alongside IPs, domains and URLs.
Explore

Related tools and pages.

Malware file hash database

Every malware sample with enough intelligence for a report: family, file type, signatures and the reports that cite it.

Malware Hash Data

Hash feed and data product

Bulk Check

Batch IOC enrichment

API Reference

Threat intelligence API

Suspicious email attachment: check the file before you open it

Leave it closed, confirm with the sender another way, and check its hash if you want a second opinion.

I clicked a phishing link: what to do now

Close the page, then deal with what you typed, downloaded or allowed after the click.
Research

Related articles from the research blog.

Blog post

File Hash Reputation Lookups: Accelerating Incident Response With IOC Enrichment

A practitioner's guide to file hash reputation lookups—how they work, which data sources power them, how to build automated IOC enrichment pipelines, and how to integrate hash intelligence into SOC, SOAR, and incident response workflows.

Read more

Blog post

Hash Reputation at Scale: Building Detection Rules That Survive Real Networks

Move beyond one-off hash blocks: design reputation pipelines, reduce false positives, and integrate file intelligence with IP and domain context for production-ready detection engineering.

Read more

Blog post

File Hash Check: Is This SHA-256 Malware?

How to check MD5, SHA-1, and SHA-256 hashes against threat intelligence, and how SOC teams use hash reputation to cut false positives.

Read more

Test it with your own indicators.

The free plan includes 50 lookups a month. Check the sources and limits, then connect the API.

Create free accountContact Sales

No credit card required · Free API key