The MD$5$ checksums of Windows and Ubuntu versions of Oracle VirtualBox have been analyzed to ensure file integrity. Output of the analysis is below:$2$ad$82$b$25$d$85$fca$75$b$78$f$34$df$3223$bbfe $*$VirtualBox$-7\mathrm{.}0\mathrm{.}6-155176-$Win.exee$23$d$54$cf$3577$de$56$a$303$a$6707$d$1$c$294*$virtualbox$-7\mathrm{.}0\_7\mathrm{.}0\mathrm{.}6-155176$~Ubuntu~jammy $\_$amd$64.$debThe returned digests have the same length but different values. Why is this happening when both files are completely different? The Windows installer is significantly larger than the Ubuntu one. The digest size of the Windows file should be much greater than the Ubuntu file. This indicates some inconsistencies with one of the files. Hash algorithms have a fixed digest size but unique values. This is expected behavior. Both Windows and Ubuntu digest values should match as it comes from the same vendor. One of the files has been tampered with. The output indicates a collision attack, and the files should not be used