As defined in app/code/core/Mage/Authorizenet/Model/Directpost.php, this exception is thrown if any portion of the below evaluates as false:
if (!$this->getConfigData('trans_md5') || !$this->getConfigData('login') ||
Mage::helper('authorizenet')->__('Response hash validation failed. Transaction declined.')
So, it's one of three things:
isValidHash returns false because there is an issue with either the generated hash (e.g. your API Login/Key are wrong, generate a new one and re-enter) or the amount of the transaction somehow differs between Authorize and your system.
The latter is less likely, but because
Mage_Authorizenet_Model_Directpost_Response uses the transaction amount as part of the hash, it's a potential factor here.