What is a major limitation of using cryptographic file hashes to detect malware?

### Why this is right A hash is a fixed-length fingerprint, and the material notes that collisions are possible: two different files can have the same hash, although this is rare. It is useful for identification, but it is not a complete behavioural analysis. ### The concept A hash condenses file contents into a value. Matching hashes can help recognize the same known sample, but a changed file will generally have a different fingerprint, and a hash by itself does not explain what a program does. ### The other options - **B. A hash executes the file to reveal its behaviour.**: Dynamic analysis executes a file; calculating a hash does not. - **C. A hash always proves that a file is safe.**: A hash identifies data but does not establish that it is benign. - **D. A hash changes the file into a disassembled program.**: A disassembler inspects instructions; hashing produces a fingerprint. ### Terms - **Hash**: A fixed-length fingerprint calculated from data. - **Collision**: A case where different data produces the same hash value. - **Dynamic analysis**: Running a program and monitoring its effects. ### Remember A hash helps identify a file; it does not tell you everything the file does.