embedded-sha256-integrity-hash
A hardcoded 64-character hexadecimal string appearing inside a binary's metadata (often the .NET #Strings stream or PE .rsrc section) that looks like a SHA-256 hash but whose purpose is not immediately obvious from static analysis. It does not match the hosting binary's own hash, nor any known companion sample in the local corpus.
Known Instances
| Sample | Hash String | Context |
|---|---|---|
3c9f96db |
238824D56AFD56162E5F061ECB898DD852A546A6D203EE032C6C40F4B4770AE9 |
#Strings stream of OkuZ.exe WinForms chart app; not self-hash, no local match ^[/intel/analyses/3c9f96db10be4b69eb71ed27ecea954f721347bee8a310fa25d9a0ee2a0c57dd.html] |
e04d46ff |
7d037a... (truncated) |
#Strings stream of FSC UI WinForms library; shared with sibling 9a40908c ^[/intel/analyses/e04d46ff3726afd45a2181347c64b088f9500d242eda127959a1462daa4db84e.html] |
9a40908c |
7d037a... (same) |
Same FSC UI library; identical hash string ^[/intel/analyses/9a40908c3212dd34fd907ff66893537537adce8f136379baf98269158948a2e9.html] |
4cce5506 |
Two strings (values differ from 0d3d6bb9) |
#Strings stream of checkers game daQK.exe; not self-hash, no local match ^[/intel/analyses/4cce5506593907c3db78282849ed41729ca7cf737e1d38cb82dc10e27d92ff16.html] |
0d3d6bb9 |
Two strings (different values from 4cce5506) |
#Strings stream of checkers game sibling daQK.exe; not self-hash, no local match ^[/intel/analyses/0d3d6bb9131e58c4dcf833781bb944eedd4bd53f5736bb1c33af11b3031fb4cd.html] |
Possible Purposes
- Companion-payload integrity check — the binary downloads or drops a second-stage file and verifies its hash against the embedded value.
- License / activation validation — the hash is a checksum of a license key or hardware fingerprint.
- Watermarking / attribution — inserted by the repackager to track which build or campaign the sample came from.
- Developer artefact — accidentally left over from debugging (e.g., a hash of the original source tree, a NuGet package, or a referenced DLL).
Detection
strings -n 64 sample.exe | grep -E '^[0-9A-Fa-f]{64}$'
This will surface any 64-character hex string that could be a SHA-256 hash. Cross-reference against:
- The sample's own SHA-256
- Known samples in the local corpus
- MalwareBazaar / VirusTotal lookup of the embedded hash
Cross-References
- unclassified-dotnet — most observed instances are in .NET Framework PE32 assemblies
- version-info-masquerade — often co-occurs with social-engineering repackaging