certutil -hashfile

certutil -hashfile is the built-in, works-everywhere way to hash a file on Windows — no PowerShell required, which makes it the reliable choice on ancient hosts and in constrained cmd.exe contexts:

certutil -hashfile C:\path\to\file.exe SHA256

Supported algorithms: MD2, MD4, MD5, SHA1, SHA256, SHA384, SHA512. Omit the algorithm and it defaults to SHA1 — a footgun when you’re comparing against modern SHA256 IOC lists, so always pass the algorithm explicitly. The PowerShell native equivalent is Get-FileHash (default SHA256).

Uses: verifying payloads survived transit, matching binaries against known-good or IOC hash lists, integrity checks on evidence. Remember that hashing is content-addressed — any byte of mutation changes the identity, which is why hash-only detection is weak and why attackers re-pack until the hash changes.

Related

• get-filehash — the PowerShell counterpart
• clipboard-file-transfer — certutil -decode / -decodehex as a file-transfer trick
• windows-reconnaissance-commands — neighboring built-in tooling

Sources

• Microsoft Learn — certutil