# File Hash Reputation (lab)

> Six binaries pulled from the estate come with cached multi-engine reputation reports. Sorted by detection count the list is exactly backwards, and your job is to read the verdicts instead of counting…

Canonical: https://codelivly.com/labs/hash-reputation

| | |
|---|---|
| Type | Investigation |
| Difficulty | Beginner |
| Points | 200 |
| Session length | 30 min |
| Completions | 13 |

Six binaries pulled from the estate come with cached multi-engine reputation reports. Sorted by detection count the list is exactly backwards, and your job is to read the verdicts instead of counting them.

## Objective

You learn that a multi-engine detection count is not a threat score: it mostly reflects how long the industry has had a sample and what kind of tool it is. You practise separating a family conviction from a dual-use label from a generic heuristic, and telling "0 detections" apart from "no record at all".

## Tasks

1. Build the table before forming an opinion
2. Read the verdict names, not the counts
3. Settle the high-count files against policy
4. Find the real malware and pin the host
5. Separate the two zeros and finish with MITRE

## Related

- [All labs](https://codelivly.com/practice?type=lab)