File hash is different from original

The “Hash” returned by IPFS is not a hash, but a CID.

You can see the original sha256 hash using this tool https://cid.ipfs.io/

BUT, the files are chunked (by default in 256k blocks) and also, by default, wrapped in a wrapper thing called a UnixFS node. You can see how your file was chunked-wrapped at https://explore.ipld.io/

For things <1MB you can increase the chunking size when you add (so that you get a single chunk), and you can enable --raw-leaves, so that the resulting single chunk is not wrapped. In that case, you will get a CID which embeds a sha256 hash, which corresponds to that returned by the sha256 tool.

1MB is a network contraint. Peers refuse to transfer things bigger than that (it may be 2MB, I can’t remember), so you can use bigger chunks but peers will not be able to download them.