bokamba / iocex / file hashes

$ iocex extract file-hashes

Extract file hashes from any text

Extract every file hash from a malware advisory or log in one pass — MD5, SHA-1, SHA-256 and SHA-512 are each recognized by length and validated as hex, then deduped with counts. Paste a messy report and get a clean, copy-ready list of hashes you can push straight into a blocklist, YARA rule, or MISP event.

Paste your own text → IOC Extractor

The sample text

This 6-line snippet is fed verbatim into the extractor to produce every result on this page. It deliberately includes a defanged indicator so you can see refang detection at work. 

Malware sample details from the advisory:
MD5   44d88612fea8a8f36de82e1278abb02f
SHA1  da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
The same dropper (SHA256 above) beacons to hxxp://payload-host[.]top/gate.php and was seen alongside CVE-2024-1709.

What was extracted

The extractor found 6 unique indicators across 6 occurrences, of which 1 was file hashes. 1 indicator was only found after refanging — proof that defanged inputs are caught.

6unique IOCs
6total occurrences
6types found
1from defanged

Detected types

Every indicator type present in the sample, with file hashes highlighted. In the live tool these chips filter the table; here they show the mix the engine pulled out.

Extracted indicators

Deduped, counted, and honestly flagged. Rows marked was defanged appeared neutralized in the source and were recovered by the refang stage; private, benign and heuristic badges are kept, never silently dropped.

type value count line flags copy
MD544d88612fea8a8f36de82e1278abb02f12
SHA-1da39a3ee5e6b4b0d3255bfef95601890afd8070913
SHA-256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b85514
SHA-512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c…15
CVECVE-2024-170916
URLhttp://payload-host.top/gate.php16was defanged

What was detected, in context

The refanged sample with every detected indicator underlined in its type color — the same preview the live tool paints as you type.

Malware sample details from the advisory: MD5 44d88612fea8a8f36de82e1278abb02f SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e The same dropper (SHA256 above) beacons to http://payload-host.top/gate.php and was seen alongside CVE-2024-1709.

FAQ

Which hash types does it detect?
MD5 (32 hex chars), SHA-1 (40), SHA-256 (64) and SHA-512 (128). Each candidate is validated as hexadecimal and classified by length, so a 64-char hex string is labelled SHA-256, a 32-char one MD5, and so on.
Does it deduplicate hashes that appear more than once?
Yes. Identical hashes are collapsed to a single row with an occurrence count and the first line each appeared on, so a hash cited five times across a report shows once with count 5.
Can I export the hashes for a blocklist or MISP?
Use the type filter to narrow to hashes and copy them with one click. With Bokamba Pro you can also export the extracted indicators as CSV, JSON, a STIX 2.1 bundle, or a MISP freetext import — all generated in your browser.

Extract other indicator types

See the full IOC types & defang-styles reference, or open the extractor and paste your own text.

Try it on your own text

Paste a report, advisory, or log, review the deduped indicators, filter to SHA-256, and copy them with one click. Free, no account, nothing uploaded — extraction runs entirely in your browser.

Open this sample in the IOC Extractor →