Searching with VirusTotal

VirusTotal stores the reports for all scans requested by its users. This allows users to query and render them without having to submit the items (URLs and files) for scanning. The search feature can retrieve file reports, URL reports, VT Community users and VirusTotal Community comments.

Contents

Audience
Getting started
Searching for file scan reports
Searching for URL scan reports
Searching for VirusTotal Community users
Searching through VirusTotal Community comments

Audience

This document is intended for any VirusTotal user that wants to search through VirusTotal's dataset of past scans. No particular technical knowledge is required to understand the document.

Getting started

In order to get started you just have to refer to VirusTotal's search form and follow the instructions detailed in the next sections.

Searching for file scan reports

In order to search for the last VirusTotal report on a given file just enter its hash. Currently the allowed hashes are MD5, SHA1 and SHA256.

Some users might also be interested in searching for particular file scan reports (e.g. identified by a scan_id returned by the Public API), this can also be done, you just have to insert the scan identifier (sha256-timestamp_epoch). This will return the file scan for a given point in time rather than its last analysis.

Searching for URL scan reports

URL searches are simple, you just have to type in the given URL, the web application will normalize it and compare it with the items in VirusTotal's dataset. Specifying the URL will return the latest report on it.

Some users might also be interested in searching for particular URL scan reports (e.g. identified by a scan_id returned by the Public API), this can also be done, you just have to insert the scan identif

How to use VirusTotal Community

Fighting malware requires close collaboration. The overwhelming malware production rate, the growing problem of false positives and the everlasting threat of false negatives cannot be counteracted without the determined engagement of all actors involved in end-user system security.

Keeping this in mind, we have created VirusTotal Community, a space where the antivirus industry and malware reserchers can meet end-users in an effort to make the Internet a safer place. VirusTotal Community allows you to rate and place comments on files and web sites. Comments can be of any nature: disinfection instructions, in-the-wild locations, reverse engineering reports, etc.

Signing up to VT Community also entitles you to a VirusTotal public API key which enables you to write simple scripts to automate VirusTotal scans and file/URL report searches.

Contents

Audience
Getting started
Build your profile
Network of trust
Interact with other users
Review files and URLs
Address your comments
Tag your comments
Vote other's comments
Flag files and URLs as malicious or harmless
Visit your profile regularly
Retrieve your API key
Build VirusTotal Community reputation

Audience

This document is intended for anyone that wants to make use of VirusTotal Community. In other words, it is intended for any user that is willing to provide further information on files and URLs, or that wants to retrieve an API key to automate the interaction with VirusTotal.

No particular technical knowledge is required to understand the document.

Getting started

Becoming part of VirusTotal Community is very simple, click on the Join our community link at the top right hand corner of any VirusTotal page and a small registration form will open up.

You will need to provide at least a username that will identify you in the community, a valid email address and a password. Once you have completed the registration form, an email with an activation link will be sent to your email address. After following the activation link you will be able to sign in and start interacting with other users.

Build your profile

The goal of the registration process is simplicity. In order to build your profile further c

Battle of the 6 Online Malware File Scanners

Recently I discovered two more website which offers FREE online virus scan service that checks uploaded files for malware using multiple antivirus engines. It is VirusChief and FilterBit. Previously I’ve already mentioned 4 such similar sites which isVirusTotal, Jotti’s Malware Scanner, VirSCAN, Virus.org Malware Scanner.

Since I already have 6 on the list, I thought it’d be great to make a comparison between these 6 websites to see which offers the best features. I will compare the number of antivirus engines used to scan an uploaded file, time taken to upload and scan, extra file upload methods, file information, upload progress meter and report page. I will also test the accuracy of the antivirus engines by scanning it with a detected vers