Hash Identification: answer key

Every question with its answer and the reasoning. Work the drill first, or the key only tells you what, not how.

1. Hashing the string "admin" with one of this tool's supported algorithms produced this digest: 21232f29 7a57a5a7 43894a0e 4a801fc3 That's 32 hex characters (128 bits). Which algorithm produced it? (e.g. "MD5", "SHA-256")

   Answer: MD5

   MD5 always produces a 128-bit digest (32 hex characters), regardless of input length. Every algorithm in the reference table has one fixed output length, which is the first thing to check when you don't know a hash's source.

   Read more: Try it in the Hash Calculator

2. Hashing the string "password123" with one of this tool's supported algorithms produced this digest: cbfdac60 08f9cab4 083784cb d1874f76 618d2a97 That's 40 hex characters (160 bits). Which algorithm produced it? (e.g. "MD5", "SHA-256")

   Answer: SHA-1

   SHA-1 always produces a 160-bit digest (40 hex characters), regardless of input length. Every algorithm in the reference table has one fixed output length, which is the first thing to check when you don't know a hash's source.

   Read more: Try it in the Hash Calculator

3. Hashing the string "root" with one of this tool's supported algorithms produced this digest: 4813494d 137e1631 bba301d5 acab6e7b b7aa74ce 1185d456 565ef51d 737677b2 That's 64 hex characters (256 bits). Which algorithm produced it? (e.g. "MD5", "SHA-256")

   Answer: SHA-256

   SHA-256 always produces a 256-bit digest (64 hex characters), regardless of input length. Every algorithm in the reference table has one fixed output length, which is the first thing to check when you don't know a hash's source.

   Read more: Try it in the Hash Calculator

4. Hashing the string "svc_backup" with one of this tool's supported algorithms produced this digest: 2eb894fa b92f51d6 aa26a2ce d87121f2 f6a1ec24 3763d924 3ab8776c f91c1440 e062a7a0 baa7bf8a d2c30e27 cc470c0e That's 96 hex characters (384 bits). Which algorithm produced it? (e.g. "MD5", "SHA-256")

   Answer: SHA-384

   SHA-384 always produces a 384-bit digest (96 hex characters), regardless of input length. Every algorithm in the reference table has one fixed output length, which is the first thing to check when you don't know a hash's source.

   Read more: Try it in the Hash Calculator

5. Hashing the string "administrator" with one of this tool's supported algorithms produced this digest: cf835de3 d4ea0136 7c45e412 e7a9393a 85a4e40a f149ed8c 3ed6c37c 05b67b27 813d7ff8 072c1035 cedd1941 5adf1712 8d63186f 05f0d656 002b0ca1 c34f44a0 That's 128 hex characters (512 bits). Which algorithm produced it? (e.g. "MD5", "SHA-256")

   Answer: SHA-512

   SHA-512 always produces a 512-bit digest (128 hex characters), regardless of input length. Every algorithm in the reference table has one fixed output length, which is the first thing to check when you don't know a hash's source.

   Read more: Try it in the Hash Calculator

6. An analyst finds this bare hex string pasted into a ticket, with no other context: 21232f29 7a57a5a7 43894a0e 4a801fc3 It's 32 hex characters. True or false: its format alone is enough to say with confidence that it's an MD5 digest and nothing else.

   Answer: False

   False. Windows NTLM password hashes are also 128-bit/32 hex chars. Identical format to MD5, genuinely indistinguishable without knowing where the value came from (e.g. a SAM/NTDS dump vs. a file hash). The Identify panel marks both MD5 and NTLM as medium confidence here, not a single certain answer. The string's origin (a file hash vs. a SAM/NTDS dump) is what actually disambiguates them, not the hex itself.

   Read more: Try it in the Hash Calculator

7. The same Identify panel is given this 40-hex-character string: cbfdac60 08f9cab4 083784cb d1874f76 618d2a97 What confidence level (High/Medium/Low) does it assign to SHA-1 as the source?

   Answer: High

   High. 160-bit: overwhelmingly the most common source of a 40-hex-char digest. (RIPEMD-160 shares the exact same 160-bit/40-hex format, but is rare enough in DFIR contexts to only rate low confidence.)

   Read more: Try it in the Hash Calculator

8. This string turns up in a leaked database dump: $2b$12$KIXQeYQ9Z5W8n1JlY0m0uOe3z7Q4rXk9pC2mN6sT1vB5dF7gH8jK9 What hashing scheme is this? (Short answer: name the format, e.g. "sha256", "crc32", "bcrypt".)

   Answer: bcrypt

   Modular crypt format ($2a$/$2b$/$2y$). A salted, adaptive password hash, not a raw digest. Recognizing the $2b$ prefix is faster and more reliable than reasoning about hex length here, since bcrypt output is not raw hex at all.

   Read more: Try it in the Hash Calculator

9. This string turns up in a copied /etc/shadow line: $6$rounds=656000$abcXYZ123saltHere$Qk9z5W8n1JlY0m0uOe3z7Q4rXk9pC2mN6sT1vB5dF7gH8jK0m0uOe3z7Q4rXk9pC2mN6sT1vB5dF7gH8jK. What format is this? (short answer, e.g. "bcrypt", "md5crypt", "sha512crypt")

   Answer: sha512crypt

   Modular crypt format ($6$) used in Linux/BSD shadow password files. $5$ is the SHA-256 equivalent of this format; $1$ is the older, weaker MD5 crypt.

   Read more: Try it in the Hash Calculator

10. Per the algorithm reference table, how many bits does a SHA-384 digest produce? (numeric answer)

    Answer: 384

    SHA-384 always produces a 384-bit digest (96 hex characters), regardless of input length. Fixed output length per algorithm is exactly what makes length-based identification possible in the first place.

    Read more: Try it in the Hash Calculator

11. A batch of five digests just came off a triage script with no labels attached. Sort each one into the algorithm that produced it, using nothing but digest length.

    Answer: 4813494d137e1631bba301d5acab6e7bb7aa74ce1185d456565ef51d737677b2 → SHA-256 · 21232f297a57a5a743894a0e4a801fc3 → MD5 · cf835de3d4ea01367c45e412e7a9393a85a4e40af149ed8c3ed6c37c05b67b27813d7ff8072c1035cedd19415adf17128d63186f05f0d656002b0ca1c34f44a0 → SHA-512 · cbfdac6008f9cab4083784cbd1874f76618d2a97 → SHA-1 · 2eb894fab92f51d6aa26a2ced87121f2f6a1ec243763d9243ab8776cf91c1440e062a7a0baa7bf8ad2c30e27cc470c0e → SHA-384

    Every algorithm in the reference table has one fixed output length (MD5 is always 32 hex chars, SHA-1 is always 40 hex chars, SHA-256 is always 64 hex chars, SHA-384 is always 96 hex chars, SHA-512 is always 128 hex chars), so length alone is enough to sort a whole batch at once, the same way you'd triage a real dump of unlabeled hashes.

    Read more: Try it in the Hash Calculator

12. Same idea, different sort: these five strings are labeled only by how confidently the Hash Calculator's Identify panel can name their source. Sort each into its real confidence tier.

    Answer: 21232f297a57a5a743894a0e4a801fc3 → Medium confidence · cbfdac6008f9cab4083784cbd1874f76618d2a97 → High confidence · $2b$12$KIXQeYQ9Z5W8n1JlY0m0uOe3z7Q4rXk9pC2mN6sT1vB5dF7gH8jK9 → High confidence · $6$rounds=656000$abcXYZ123saltHere$Qk9z5W8n1JlY0m0uOe3z7Q4rXk9pC2mN6sT1vB5dF7gH8jK0m0uOe3z7Q4rXk9pC2mN6sT1vB5dF7gH8jK. → High confidence · 2eb894fa → Low confidence

    High confidence means the format is either distinctive (a $2b$/$6$ prefix) or overwhelmingly the most common source at that length (a bare 40-hex digest is almost always SHA-1). Medium means a genuine tie: Windows NTLM password hashes are also 128-bit/32 hex chars. Identical format to MD5, genuinely indistinguishable without knowing where the value came from (e.g. a SAM/NTDS dump vs. a file hash). And Low means the string is too short or generic to mean much on its own: 32-bit: consistent with a CRC32 checksum, but 8 hex characters is short enough to also just be a truncated ID or unrelated string.

    Read more: Try it in the Hash Calculator

13. The exact same 32-character hex string, 21232f297a57a5a743894a0e4a801fc3, turns up in four different places during an investigation. Sort each occurrence by what it most likely is, given where it was found.

    Answer: An antivirus engine's file-hash lookup flags a sample by this value: 21232f297a57a5a743894a0e4a801fc3 → MD5 · Pulled from a dumped NTDS.dit database, sitting in the same row as a username: 21232f297a57a5a743894a0e4a801fc3 → NTLM · Recovered from the LM-hash column of a legacy, pre-2000-era Windows SAM dump: 21232f297a57a5a743894a0e4a801fc3 → LM hash (legacy) · Pasted into a ticket with no other context at all: 21232f297a57a5a743894a0e4a801fc3 → Ambiguous, needs more context

    Format alone can't tell these apart. 128-bit: the most common source of a bare 32-hex-char digest. Windows NTLM password hashes are also 128-bit/32 hex chars. Identical format to MD5, genuinely indistinguishable without knowing where the value came from (e.g. a SAM/NTDS dump vs. a file hash). Legacy Windows LAN Manager hash. Same length/format, now rare outside old dumps. A file-hash-lookup context points to MD5 (the overwhelmingly common use of a bare 32-hex digest); a dumped NTDS.dit database means the value is a Windows password hash, i.e. NTLM (or, if it's specifically from the legacy LM-hash column of a pre-2000-era SAM dump, the older LM format); with no context at all, the honest answer is that it's ambiguous, which is exactly the tie identifyHash() itself reports.

    Read more: Try it in the Hash Calculator

Back to the drill