File Hash Investigation.
/hash-investigation
A file hash lookup tells you whether a sample is known-bad, what malware family it belongs to, and how it behaves. This free, open-source skill runs inside your AI coding agent and characterises any MD5, SHA1 or SHA256 hash by querying threat-intel sources and consolidating the result. It is built for SOC analysts and CTI practitioners triaging files flagged by EDR, sandboxes or email gateways.
What it does.
It checks the hash against VirusTotal and OTX, and can trigger a deeper malware-analysis review for novel samples. The detection signals and community context are consolidated into one summary so you can judge the file at a glance.
When to use it.
Use it during SOC triage when EDR or a sandbox surfaces a hash and you need to know whether it is a known threat. It also helps CTI analysts confirm a sample's family and pull the related indicators they need to expand an investigation.
What you get back.
You get the detection ratio across engines, the likely malware family, behavioural tags, and pivot candidates such as communicating IPs and dropped files that point you to the next step.
How it fits your workflow.
Run it from Claude Code, Cursor, Codex or Windsurf with a single command. The free VirusTotal and OTX tiers are enough to start, and the skill degrades gracefully when a key is missing.
Frequently Asked Questions.
Ready to do more with less?
Request a demo or start your free trial today. Get instant access to AI-powered threat intelligence tailored to your organisation.