Does Symantec have coverage for a specific hash

Products

• Endpoint Protection
• Endpoint Security
• Messaging Gateway

Issue/Introduction

How to determine whether or not Symantec has coverage for one or more file(s) hash(es).

Resolution

To verify coverage, hashes must be submitted to the self-service portal at https://symsubmit.symantec.com.  A support case does not need to be opened. Follow the steps below to verify coverage using the self-service portal.

1. Visit https://symsubmit.symantec.com.
2. Select the Not Detected by Symantec tab.
3. Change the Submission Type to Provide an MD5 or SHA-256 hash of a file.
4. Enter the hash in the File Hash field.
   

   Guidelines for file hash submissions:

   • The files associated with the hashes should be available publicly and may be a maximum size of 500 MB

   • The hashes provided should be in the MD5 or SHA-256 format only

   • The hashes provided should be of only a single file. Containers such as ZIP or RAR are not supported

   • We support maximum of 20 hashes per submission

5. Complete the Your Details section and click Submit.

 

FAQ

Q: Can I open a support case to verify hash coverage?
A: No.  Use the steps above to verify hash coverage.  Support cases opened asking only to verify hash coverage will instruct you to follow the submission process above and then be closed.  

Q: Are there any other methods to submit hashes to Symantec for review?
A: Contact your Symantec account manager about additional services available.

Q: How can I use my Symantec security product to block a hash?
A: Symantec Endpoint Protection and Symantec Endpoint Security can be used to block files by hash.  

Q: What if I have additional questions beyond coverage of a specific file?
A: If you have additional questions about a submission you can open a support case after the file has been submitted.  Please include the submission number and the additional questions when opening a support case.

Q: Are there any other methods to verify hash coverage?
A: VirusTotal has a hash submission page. https://www.virustotal.com/gui/home/search.  There is also an API to automate submissions https://developers.virustotal.com/v3.0/reference#overview.