Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Typical False Positive Hashes
# This GIST has been transformed into a Git repository and does not receive updates anymore
#
# Please visit the github repo to get a current list
# https://github.com/Neo23x0/ti-falsepositives/
# Hashes that are often included in IOC lists but are false positives
HASH_WHITELIST = [
# Empty file
'd41d8cd98f00b204e9800998ecf8427e',
'da39a3ee5e6b4b0d3255bfef95601890afd80709',
'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
# One byte line break file (Unix) 0x0a
'68b329da9893e34099c7d8ad5cb9c940',
'adc83b19e793491b1c6ea0fd8b46cd9f32e592fc',
'01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b',
# One byte line break file (Windows) 0x0d0a
'81051bcc2cf1bedf378224b0a93e2877',
'ba8ab5a0280b953aa97435ff8946cbcbb2755a27',
'7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6',
# One byte file with 0x00
'93b885adfe0da089cdf634904fd59f71',
'5ba93c9db0cff93f52b521d7420e43f6eda2784f',
'6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d',
# 1024 bytes 0x00
'0f343b0931126a20f133d67c2b018a3b',
'60cacbf3d72e1e7834203da608037b1bf83b40e8',
'5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef',
# 2048 bytes 0x00
'c99a74c555371a433d121f551d6c6398',
'605db3fdbaff4ba13729371ad0c4fbab3889378e',
'e5a00aa9991ac8a5ee3109844d84a55583bd20572ad3ffcd42792f3c36b183ad',
# File filled with 99 zeros (probably caused by AV)
'fa8715078d45101200a6e2bf7321aa04',
'd991c16949bd5e85e768385440e18d493ce3aa46',
'4b298058e1d5fd3f2fa20ead21773912a5dc38da3c0da0bbc7de1adfb6011f1c',
# File filled with 4096 zeros (probably caused by AV)
'620f0b67a91f7f74151bc5be745b7110',
'1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d',
'ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7',
# 1x1 pixel JPEG
'c5e389341a0b19b6f045823abffc9814',
'c82cee5f957ad01068f487eecd430a1389e0d922',
'995c770caeb45f7f0c1bc3affc60f11d8c40e16027df2cf711f95824f3534b6f',
# 1x1 tracking pixel GIF
'325472601571f31e1bf00674c368d335',
'2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a',
'b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b',
# Empty Word document
'e617348b8947f28e2a280dd93c75a6ad',
'125da188e26bd119ce8cad7eeb1fc2dfa147ad47',
'06f7826c2862d184a49e3672c0aa6097b11e7771a4bf613ec37941236c1a8e20',
# File that contains the word 'administrator'
'200ceb26807d6bf99fd6f4f0d1ca54d4',
'b3aca92c793ee0e9b1a9b0a5f5fc044e05140df3',
'4194d1706ed1f408d5e02d672777019f4d5385c766a8c6ca8acba3167d36a7b9',
# File that contains the word 'foo\x0a'
'd3b07384d113edec49eaa6238ad5ff00',
'f1d2d2f924e986ac86fdf7b36c94bcdf32beec15',
'b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c',
# File that contains the word 'yes'
'a6105c0a611b41b08f1209506350279e',
'fb360f9c09ac8c5edb2f18be5de4e80ea4c430d0',
'8a798890fe93817163b10b5f7bd2ca4d25d84c52739a645a889c173eee7d9d3d',
# File that contains 2\x0d\x0a
'10400c6faf166902b52fb97042f1e0eb',
'f1d2d2f924e986ac86fdf7b36c94bcdf32beec15',
'df4e26a04a444901b95afef44e4a96cfae34690fff2ad2c66389c70079cdff2b',
# File that contains 44 43 48 01 18 40 80 25 03 00 06 00 DCH..@.%.... (unknown)
'4b6c7f3146f86136507497232d2f04a0',
'deabe082bc0f0f503292e537b2675c7c93dca40f',
'4a15a6777284035dfd8df4ecf496b4f0557a9cc4ffaaf5887659031e843865e1',
# WinPCap 4.1.3
'a11a2f0cfe6d0b4c50945989db6360cd',
'e2516fcd1573e70334c8f50bee5241cdfdf48a00',
'fc4623b113a1f603c0d9ad5f83130bd6de1c62b973be9892305132389c8588de',
# disallowedcertstl.cab
'16e8e953c65d610c3bfc595240f3f5b7',
'231a802e6ff1fae42f2b12561fff2767d473210b',
'048846ed8ed185a26394adeb3f63274d1029bbd59cffa8e73a4ef8b19456de1d',
# Powerpoint 2010
'e24133dd836d99182a6227dcf6613d08',
'72c2dbbb1fe642073002b30987fcd68921a6b140',
'4dde54cfc600dbd9a610645d197a632e064115ffaa3a1b595c3a23036e501678',
# Special CAB file
'41f958d2d3e9ed4504b6a8863fd72b49',
'f6d380b256b0e66ef347adc78195fd0f228b3e33',
'c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8',
# MS Notepad
'd378bffb70923139d6a4f546864aa61c',
'f00aa51c2ed8b2f656318fdc01ee1cf5441011a4',
'c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102',
# MSVCR71.DLL
'86f1895ae8c5e8b17d99ece768a70732',
'd5502a1d00787d68f548ddeebbde1eca5e2b38ca',
'8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe',
# RecordedTV.library-ms
'b6f9aa44c5f0565b5deb761b1926e9b6',
'183d0929423da2aa83441ee625de92b213f33948',
'07c4c7ae2c4c7cb3ccd2ba9cd70a94382395ca8e2b0312c1631d09d790b6db33',
]
@krmaxwell

This comment has been minimized.

Copy link

krmaxwell commented Jul 3, 2018

Thanks for doing this! Line 69 needs a , at the end, FYI.

@Neo23x0

This comment has been minimized.

Copy link
Owner Author

Neo23x0 commented Jul 6, 2018

Thanks!

@chrisdoman

This comment has been minimized.

Copy link

chrisdoman commented Nov 8, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.