Introduction to VirusTotal - Check any File or URL against many antivirus engines

What is VirusTotal?

VirusTotal is a free website owned by Google that scans files and URLs against antivirus engines. Upload anything suspicious and it tells you which security tools flag it as malicious.

Security analysts use it constantly. It's the fastest way to determine if a file is malware. You can upload a PDF from an email, an executable you downloaded, or paste a URL someone sent you.

Scan a File

1. Go to VirusTotal
2. Click the "Choose file" button

VirusTotal uploads the file, runs it through 60+ engines, and shows the results.

Example: Clean file result

Detection score: 0/62
No security vendors flagged this file as malicious

Example: Malicious file result

Detection score: 58/62
Malware.Win32.Generic
Trojan.Win32.Agent
Worm.Win32.AutoRun
...

58 out of 62 engines flagged it. That's malware. No question.

What the Results Mean

Not every flag means "dangerous." Sometimes antivirus engines disagree. A score of 0/72 means everyone says clean. A score of 58/62 means everyone says malicious. In between, you need to investigate.

Rules of thumb:

• 0-3 detections — almost certainly clean. Some engines flag unknown files as "suspicious" to be safe.
• 4-10 detections — ambiguous. Could be a false positive. Check the detection names — do they say "generic," "heuristic," or "suspicious"? These are guesses. If they say "Trojan," "Backdoor," or specific malware family names, be more concerned.
• 10+ detections — almost certainly malicious. Multiple independent engines agreeing is a strong signal.
• 50+ detections — it's malware. No legitimate file gets flagged by 50 antivirus engines.

Search by Hash

If you have a file's SHA-256 hash — like the ones you generated — you can search VirusTotal without uploading the file:

shasum -a 256 suspicious-file.pdf

Copy the hash and paste it into VirusTotal's search bar. If anyone has uploaded that exact file before, you'll see the scan results instantly. This is how analysts share threat intelligence — hashes, not files.

The "Details" Tab — What the File Is

After scanning, click the "Details" tab. You'll see:

• File name and size
• File type (PDF, executable, script)
• MD5, SHA-1, SHA-256 hashes — the file's fingerprints
• Creation time — when the file was made
• First and last submission dates — when it was first uploaded to VirusTotal

The hashes are the most useful part. If you need to block a file on your network or search for it elsewhere, the SHA-256 is the unique identifier.

The "Community" Tab — What Analysts Say

VirusTotal has a community of security researchers who leave comments and vote on files. The "Community" tab shows:

• User votes: "malicious" or "harmless"
• Comments from analysts explaining what the file does
• Links to detailed write-ups and blog posts about the malware

If a file is interesting, someone has probably written about it.

Limitations — What VirusTotal Can't Do

• It won't catch zero-day malware. If the malware is brand new and no antivirus engine has seen it before, all 72 engines might say "clean." That's why detection scores aren't proof of safety.
• It doesn't tell you what to do. It gives you information. The interpretation is up to you.
• Uploaded files become public. Anything you upload may be shared with the security community. Never upload sensitive documents, internal files, or anything containing personal data.