Python Malware Hash Checker

Project Overview

This independent cybersecurity portfolio project demonstrates how Python can validate file-hash formats and compare fictional hashes against a local threat-intelligence watchlist.

The project performs offline analysis only. It does not upload files, contact external malware services, or claim that an unknown hash is safe.

Skills Demonstrated

• Python
• Malware triage fundamentals
• MD5, SHA-1, and SHA-256 identification
• Hash-format validation
• Local IOC/watchlist matching
• JSON parsing
• Security automation
• Analyst reporting

Project Files

• malware_hash_checker.py — Main Python script
• sample_hashes.txt — Fictional/sample hashes for analysis
• threat_watchlist.json — Local demonstration watchlist
• hash_analysis_report.txt — Example generated report
• requirements.txt — Dependency notes

How It Works

The script:

1. Reads candidate file hashes.
2. Identifies MD5, SHA-1, or SHA-256 formatting.
3. Rejects malformed values for review.
4. Compares valid hashes with a local fictional watchlist.
5. Generates an analyst-friendly report.

Run

python3 malware_hash_checker.py

Cybersecurity Relevance

File hashes are commonly used as indicators during malware triage and incident investigations. Analysts can compare hashes with trusted intelligence sources to identify known files or indicators.

A hash that does not match a watchlist should be treated as unknown, not automatically safe.

Portfolio Note

This is an independent cybersecurity portfolio project for educational and professional demonstration. The local watchlist is fictional and the project does not perform live threat-intelligence lookups.

Future Improvements

• Approved reputation API integration
• SHA-512 support
• CSV/JSON report export
• Case tags and analyst notes
• Deduplication
• Integration with IOC-management workflows