VB.net MD5 checksums to Hex

Question

I have a database of 700,000 MD5 virus signatures in the following format:

83968:961ed981485cea5ab3936496966ba0d6:Worm.Gaobot-318
86016:4bed8673ab3d695c52c233306ed3f733:Worm.Gaobot-319

Is there a way to convert the Md5 checksums to valid Hex signatures?
If so, how would (using VB.net) I convert the md5 checksum to hex, remove that first 83968: thing and leave the name in the same format?

So the end product would look like:

{valid hex signature} :Worm.Gaobot-318

Answer 1

I understand what you are saying. You've got a large collection of MD5s of viruses from the clam database. But later you came to know that MD5s are not good signatures but hex signatures are good. And now you want to convert the MD5s into hex.Its not possible. You can compute the MD5 of a given string, but you cannot get back the string from a given MD5.

Happy coding!

Answer 2

Your "valid hex signature" isn't an MD5 hash - it's too long. MD5 produces 16 bytes, so 32 hex characters... your Eicar example is 80 characters (40 bytes).

You haven't specified what algorithm is used to come up with that "valid hex signature" in the first place, but assuming there's no redundancy there, you simply don't have enough information to produce it. It's like asking how to produce the synopsis of a play when you only know the first word of each speech.

Answer 3

It looks like your MD5 values are already represented in a hexadecimal format. So you are good to go in that regard. The only thing left is to split the string on the ":" character. Assuming this is your format:

83968:961ed981485cea5ab3936496966ba0d6:Worm.Gaobot-318

Here is some C# psuedo code....

string fullStr = "83968:961ed981485cea5ab3936496966ba0d6:Worm.Gaobot-318 ";
string arr[] = fullStr.Split(":");
for(int i=0; i<arr.length; i++)
{
    Console.WriteLine(arr[i]);
}

Answer 4

$string fullStr = "83968:961ed981485cea5ab3936496966ba0d6:Worm.Gaobot-318 ";
$string name = fullStr.Split(":")[2];
$string md5 = fullStr.Split(":")[1];

This will give you the name and the md5 without the "83968" or ":"