================================================================================
  FILE HASH DATABASE — CTF Blue Team Lesson 03
  Malware Detection & Classification
================================================================================
  SAFETY NOTE: This file contains simulated data for training purposes only.
  No actual malware hashes are included. All hashes are fabricated.
================================================================================

FORMAT: Filename | MD5 | SHA256 | Size | Type | Status

--- ENTRY 01 ---
Filename:   calc.exe
MD5:        b1a7b1f50c1e0c5e7f3d9a2e4b6c8d0f
SHA256:     a3f7c9d1e5b2840f6a1c3e5d7b9f0a2c4e6d8b0a1c3f5e7d9b2a4c6e8f0d1a3
Size:       27,648 bytes
Type:       PE32 executable (GUI) Intel 80386, for MS Windows
Status:     KNOWN GOOD — Microsoft Windows Calculator (signed, valid certificate)

--- ENTRY 02 ---
Filename:   notepad.exe
MD5:        c4e6a8f0b2d4c6e8a0f2d4b6a8c0e2f4
SHA256:     d5e7f9a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7
Size:       193,536 bytes
Type:       PE32+ executable (GUI) x86-64, for MS Windows
Status:     KNOWN GOOD — Microsoft Notepad (signed, valid certificate)

--- ENTRY 03 ---
Filename:   svchost_update.exe
MD5:        e8f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0
SHA256:     f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3
Size:       483,328 bytes
Type:       PE32 executable (GUI) Intel 80386, for MS Windows
Status:     UNKNOWN — Not found in VirusTotal. Name mimics legitimate Windows service.
            NOTE: Legitimate svchost.exe never has "_update" suffix. Suspicious naming.

--- ENTRY 04 ---
Filename:   chrome_helper.dll
MD5:        a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1
SHA256:     b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5
Size:       716,800 bytes
Type:       PE32+ executable (DLL) x86-64, for MS Windows
Status:     UNKNOWN — Not signed. Not in known-good Chrome DLL inventory.
            NOTE: Legitimate Chrome helpers are signed by Google LLC. This is not.

--- ENTRY 05 ---
Filename:   msedge.exe
MD5:        f4a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4
SHA256:     c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3b5c7d9
Size:       3,465,216 bytes
Type:       PE32+ executable (GUI) x86-64, for MS Windows
Status:     KNOWN GOOD — Microsoft Edge browser (signed, valid certificate)

--- ENTRY 06 ---
Filename:   WindowsUpdate_KB5041234.exe
MD5:        d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2
SHA256:     e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1
Size:       2,097,152 bytes
Type:       PE32 executable (GUI) Intel 80386, for MS Windows
Status:     UNKNOWN — KB number not found in Microsoft Update Catalog.
            NOTE: Fake KB number. Likely social engineering disguised as Windows update.

--- ENTRY 07 ---
Filename:   python3.11.exe
MD5:        b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4e6
SHA256:     a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3
Size:       98,304 bytes
Type:       PE32+ executable (console) x86-64, for MS Windows
Status:     KNOWN GOOD — Python Software Foundation (signed, valid certificate)

--- ENTRY 08 ---
Filename:   system_diagnostics.scr
MD5:        c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0
SHA256:     d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5
Size:       532,480 bytes
Type:       PE32 executable (GUI) Intel 80386, for MS Windows (.scr screensaver)
Status:     SUSPICIOUS — Screensaver files (.scr) are executables. Common malware
            delivery vector. Entropy: 7.3 (HIGH — likely packed or encrypted).
            Not found in any threat intelligence database.

--- ENTRY 09 ---
Filename:   adobe_reader_patch.exe
MD5:        e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4
SHA256:     f7a9b1c3d5e7f9a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9
Size:       1,245,184 bytes
Type:       PE32 executable (GUI) Intel 80386, for MS Windows
Status:     SUSPICIOUS — Not signed by Adobe Inc. Compilation timestamp: 2026-04-01.
            Import table includes: VirtualAllocEx, WriteProcessMemory,
            CreateRemoteThread (process injection APIs). High confidence malicious.

--- ENTRY 10 ---
Filename:   7z.exe
MD5:        a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8
SHA256:     b1c3d5e7f9a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3
Size:       576,512 bytes
Type:       PE32+ executable (console) x86-64, for MS Windows
Status:     KNOWN GOOD — 7-Zip File Manager (signed by Igor Pavlov)

================================================================================
  ANALYSIS SUMMARY
================================================================================
  Known Good:   5 files (calc.exe, notepad.exe, msedge.exe, python3.11.exe, 7z.exe)
  Unknown:      3 files (svchost_update.exe, chrome_helper.dll, WindowsUpdate_KB5041234.exe)
  Suspicious:   2 files (system_diagnostics.scr, adobe_reader_patch.exe)

  CHALLENGE: Which "unknown" files are most likely malicious? What static
  indicators support your classification? Which would you prioritize for
  sandbox detonation?
================================================================================