-3
$\begingroup$

I scanned a file in this site :

https://www.virustotal.com/#/file/70902a0e2e5608b5ce980f0a28d23b6943287b3955e2fddb12e6c805c7be906b/detection

and got this :

SHA-256 70902a0e2e5608b5ce980f0a28d23b6943287b3955e2fddb12e6c805c7be906b

can the above sha-256 be cracked to plain text ?

Improve this question
$\endgroup$
0
2
$\begingroup$

Can the above sha-256 be cracked to plain text ?

In general no. With overwhelming odds, gadzillions different files have any particular hash value, including this one; and we have no method to find any (much less the original) out of thin air.

However, if the plain text is guessable (including if the "file" is public, contains only a common word, or is less than 10 bytes), yes; because we can check a guess by hashing and comparing to the hash, and if there's a match, then as far as we know that must be how that hash was computed in the first place.

Illustration: here, querying Virus Total tells that the file was named abc1.exe when scanned on 2018-01-17 22:47:34 UTC. According to this it was also named Thermite.exe when scanned on 2018-06-28 17:32:22 (that's few hours ago), and purports to be a WinPE32 executable compiled in 2010 under Visual Studio 2010 by a user "Kitty", with some reference to www.inkscape.org; but really has telltale signs that it might be hostile code. It seems entirely possible that this file is archived somewhere, and can be found.

Improve this answer
$\endgroup$
1
  • $\begingroup$ I think abc1.exe is packed and therefore it became Thermite.exe . Fgrieu , can you give me your email address ? because soon I will not be able to ask questions and therefore I can contact you through your email address to ask for help . $\endgroup$ – silver Jun 28 '18 at 17:29
2
$\begingroup$

No.

It's not possible to get the value back of a hash, because hashes are a one-way function.

For more details: https://stackoverflow.com/questions/330207/how-come-md5-hash-values-are-not-reversible.

Improve this answer
$\endgroup$
2
  • $\begingroup$ yes it is possible as fgrieu wrote but only if the plaintext or the word is guessable then we can crack it : here is a sha256 : 2CF24DBA5FB0A30E26E83B2AC5B9E29E1B161E5C1FA7425E73043362938B9824 and it is cracked look here : md5decrypt.net/en/Sha256/#answer $\endgroup$ – silver Jun 28 '18 at 16:35
  • $\begingroup$ Yes that's true, but keep in mind that there's an infinite amount of strings that can return this hash. $\endgroup$ – AleksanderRas Jun 29 '18 at 9:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.