Searching with VirusTotal

VirusTotal stores the reports for all scans requested by its users. This allows users to query and render them without having to submit the items (URLs and files) for scanning. The search feature can retrieve file reports, URL reports, VT Community users and VirusTotal Community comments.

Contents

Audience
Getting started
Searching for file scan reports
Searching for URL scan reports
Searching for VirusTotal Community users
Searching through VirusTotal Community comments

Audience

This document is intended for any VirusTotal user that wants to search through VirusTotal's dataset of past scans. No particular technical knowledge is required to understand the document.

Getting started

In order to get started you just have to refer to VirusTotal's search form and follow the instructions detailed in the next sections.

Searching for file scan reports

In order to search for the last VirusTotal report on a given file just enter its hash. Currently the allowed hashes are MD5, SHA1 and SHA256.

Some users might also be interested in searching for particular file scan reports (e.g. identified by a scan_id returned by the Public API), this can also be done, you just have to insert the scan identifier (sha256-timestamp_epoch). This will return the file scan for a given point in time rather than its last analysis.

Searching for URL scan reports

URL searches are simple, you just have to type in the given URL, the web application will normalize it and compare it with the items in VirusTotal's dataset. Specifying the URL will return the latest report on it.

Some users might also be interested in searching for particular URL scan reports (e.g. identified by a scan_id returned by the Public API), this can also be done, you just have to insert the scan identif

ier with the string "u:" prepended (u:sha256-timestamp_epoch). This will return the URL scan for a given point in time rather than its last analysis.

Searching for VirusTotal Community users

Do you want to know whether a friend has a VT Community account? Simply type in his nick preceeded by the symbol "@", e.g. @VirusTotalTeam. Of course, in order to perform such a search you must first know his VirusTotal Community nick, the search feature will lead you to his VirusTotal Community profile page.

Searching through VirusTotal Community comments

The comments in VirusTotal Community may often help in disinfecting your PC or may proof themselves useful when analysing a particular malware sample, comment tags enable users to search through the VirusTotal Community reviews. Just type in a tag, e.g. "#zbot".

Source: https://www.virustotal.com