Malware Threats · Module 07
VirusTotal
Scan files and URLs against dozens of antivirus engines at once.
Safe to try on your own machine. Spin up your Kali Linux lab and practice away — on any system you own or have permission to test. That’s exactly how the pros learn.
Definition
VirusTotal is an online threat intelligence and malware analysis platform that analyzes files, URLs, domains and IP addresses using many security engines.
Help identify potentially malicious files, suspicious URLs, and network indicators.
Malware analysis, threat intelligence, incident response, and suspicious-file investigation.
Key features
Checks files against multiple antivirus and security engines.
Examines URLs for malicious or suspicious activity.
Provides reputation and threat-intelligence information.
Searches existing reports by file hash (e.g. SHA-256).
Community comments and analysis where available.
Important commands & actions
Search a file hashRetrieve an existing report for a file hash.
Submit a fileRequest analysis of a file (subject to limits and policy).
Search a URLRetrieve available information about a URL.
Search a domain / IPInvestigate domain or IP threat intelligence.
VirusTotal APIAutomate supported lookups and analysis.
Practical examples
- Open the VirusTotal website.
- Choose the file-analysis option.
- Submit a non-confidential sample you are authorized to analyze.
- Review the detection results.
Purpose Helps identify whether engines flag the file as potentially malicious.
- Calculate the SHA-256 hash of a file on your system.
- Search that hash on VirusTotal.
- Review any existing report.
Purpose Retrieves intelligence without uploading the file itself.
- Open VirusTotal.
- Search for the IP address.
- Examine reputation, detections and related indicators.
Purpose Supports initial investigation of a suspicious IP.
Important points
- Multiple engines: Results are aggregated from many engines and sources.
- False positives / negatives: A detection is not proof of malice; no detections is not proof of safety.
- Hash lookup: Searching a hash can retrieve a report without submitting the file.
- Confidentiality: Never upload passwords, private documents or sensitive company files.
- Limitations: Results depend on available data and the time of submission.
Common use cases
Examine suspicious files and their detection reports.
Investigate potentially malicious links.
Support investigations using hashes and other IoCs.
Help analysts triage suspicious files, URLs and indicators.
This tool is taught in Module 07
Read the full written notes, with diagrams, defense and detection.