virustotal

Security Stack

Definition

VirusTotal is a free online service that lets you upload files or submit URLs to see if they’re malicious. It works by scanning the submission with **dozens of antivirus engines, URL analyzers, and security tools** all at once, then showing you the results in a single report.

You can think of it as a giant “second opinion” hub for malware and phishing detection — instead of trusting just one security product, you get the verdict from many.

When you submit something, VirusTotal will:

* **Scan with multiple AV engines** (e.g., Microsoft Defender, Kaspersky, Bitdefender)
* **Check URL reputation** against phishing and malware blocklists
* **Analyze file metadata** (hashes, size, type, embedded resources)
* **Generate hashes** (MD5, SHA-1, SHA-256) so others can search for the same file
* **Correlate indicators** — showing related files, domains, or IP addresses from its database

Why it’s useful in investigations:

* **Quick triage** – See if a suspicious attachment or link is already known as malicious.
* **Pivoting** – Use a file’s SHA-256 hash to find other detections, related malware families, or campaigns.
* **Attribution clues** – Certain threat actors reuse infrastructure (domains, IPs) that show up in VirusTotal’s “Relations” tab.
* **Crowdsourced intelligence** – Submissions and detections feed into the global security community.

Real-world examples:

* Analysts investigating Emotet phishing campaigns often use VirusTotal to look up the attachment hash, revealing other samples with similar names and behaviors.
* Security researchers track ransomware by pivoting from a ransom note file hash to related malware samples in VirusTotal.
* Phishing investigations frequently use its URL scan results to confirm a fake login page is flagged across multiple sources.

Limitations:

* Submissions are shared publicly by default — you shouldn’t upload sensitive or proprietary files unless you have a private API/account.
* A “clean” result doesn’t guarantee safety — new or highly targeted malware may not yet be detected by any engine.

virustotal

Definition

Explore More Terms