VirusTotal

When examining a VirusTotal scan, multiple aspects should be taken into account to assess the credibility of a file based on the provided data. However, it is still unclear whether the file can be deemed safe with absolute certainty.

Nonetheless, it is still recommended by utilizing a dedicated offline computer or a virtual sandbox environment. By doing so, you can ensure an extremely high degree of safety during your pursuits.

 


 

Check the last scan date

  • Ensure that the last scan date is recent. If not, it's advisable to rerun the scan as new detections may be found, and old false positives may be removed.

Detections tab

  • Pay attention to this section. If most of the detections are generic (e.g., gen/susgen, W32.Trojan.Gen) or flagged as AI/ML (using single-word labels like "malicious," "suspicious," "unsafe"), and there are no specific detections, it typically indicates that the file appears to be malware-like but does not match any known malware. This is common for pirated software, as they employ similar techniques to malware, such as file packing, encryption, obfuscation, and file injection.

Details tab

  • Creation Time: While creation time can be faked, if it appears obviously fake (e.g., 2099), it should raise suspicion.
  • First Seen In The Wild and First Submission: If these dates precede the actual release date of a product (e.g., a game that was first seen three years ago but was released two weeks ago), it is likely old recycled malware, unless it's a generic library file. Files that are only a few hours to days old may not have many accurate detections, whereas files that are several weeks old should have more reliable detections. If you are dealing with a file that is approximately two years old and it has only the characteristics mentioned above, it is likely safe.
  • Names of submission: Look at the names under which the file has been submitted. If the names appear as hashes or generic names like sample1.exe, they can be ignored. However, if the file appears under five different names for five completely different products, it is likely malware.
  • Signatures: For pirated software, signatures may not be helpful as cracks or patched files may not have valid signatures. However, the presence of an invalid signature can still be suspicious.

Relations tab (Not always available)

  • Contacted IP addresses: This information can be useful if the results indicate overwhelmingly malicious activity. However, some antivirus programs tend to be overreactive and flag sites based on rumors or unverified information. Sometimes, a legitimate site like drive.google.com might be flagged as a phishing site by an overreactive antivirus. If the file is intended to be a keygen or patcher and it is making suspicious requests, that should raise concerns.
  • Execution Parents: These refer to installers or archives that contained, dropped, or downloaded the file being scanned. If you are scanning an installer that was not extracted from another file, you can ignore this information, as it typically pertains to fake installers that drop the real installer and perform malicious actions in the background.
  • Dropped Files: This section shows the files contained within the scanned file, which are extracted upon running or opening it. When scanning an archive file, the results of this section are usually more useful than those of the archive itself. If you have an archive file in a format that VirusTotal doesn't handle well (e.g., .rar), you can extract the files, create a .zip archive, and upload that instead. The same applies to password-protected archive files.

Behavior tab (More complex information)

  • Opening and reading files and keys is not particularly worrisome. Writing and deleting its own temporary files is also not a cause for concern. It is expected that an installer will write to multiple locations. However, if the file starts accessing locations it shouldn't, that is suspicious behavior.
  • Highlighted actions: This section rarely provides enlightening information. But, if you come across any particularly alarming actions like "all your files are belong to us," it is best to best on the side of caution and avoid using the file.

Community tab

  • The community tab is often messy, but occasionally there may be some useful information buried within.

 


 

🪶 ❮ Return to FAQ / 2

Edit
Pub: 15 Dec 2023 13:20 UTC
Edit: 21 Dec 2023 05:17 UTC
Views: 6429