I think this has happened to most of us.
You come across some sort of file and you sort of trust it, but you want to just be
sure.
So you maybe do a virus scan using Windows Defender, or whatever antivirus you have.
But you're still like, "Hmm, I really want to be sure."
And that's what this video is going to be about, a website that I've talked about before,
VirusTotal, that is basically the ultimate virus scanner because it scans any file you
upload, or your URL, with like 70+ antiviruses is at once and shows you all the results.
So it's a really great way to either detect false negatives or false positives.
If you hadn't heard of it before, it is well known, it's actually owned by Google.
You might not have realized that, even those who do know about it.
And like I said, the concept is dead simple on the surface, you just upload it, you see
the results, you can decide for yourself.
But there's also quite a few other features that we can look at today.
On the main page, you can see there's three different tabs.
So there's one for files, that's where you upload an actual file, and it doesn't have
to be an EXE file, it could be a document file, which I'll look at an example in a second
where it is a malicious word doc file.
You can also put in a URL, so a website, maybe it's a link that you think is suspicious or
you're just not really sure what the deal is with this domain, you can put that in,
see if anything flags it.
And also you can just search for an existing "hash" it's called.
This is a little bit more advanced, but basically there's a thing called hashing where you put
a file through an algorithm and then it generates a unique identifier on that file.
And every time you put that same file through that algorithm, it should generate the same
hash or identifier.
So this basically makes it so if a file has already been scanned by VirusTotal, it doesn't
have to scan it again, it'll just look up the results for that same hash.
And if you happen to have the hash of a file, you can also just put that in without having
to upload it.
Now, one thing to note before we get into this is, you probably don't want to upload
anything to VirusTotal that you want to be confidential.
Because basically they store all the files, that get uploaded and then premium customers,
who are mostly like institutions and corporations, actually have access to all the samples that
get uploaded.
So if it's some random file off the Internet, you probably don't care.
But if it's some kind of tax document potentially, maybe you don't want to put that up there.
Anyway so let's take a closer look at using the site.
So in this example, I found the hash of a malicious Word document.
I don't have the file itself but like I said, I have the hash, so I can look up the results
for it
even though I don't have the file.
And you can see this one has 46 out of 62 positive results, detected this as malicious.
Now note that it doesn't always scan with all 70+ antiviruses for some reason.
At the bottom, there's a bunch that say that it was unable to analyze the file for whatever
reason.
Maybe they don't support document files or something, or maybe I don't know, when it
was running that particular scan, it messed up, who knows?
And also below the scan results, you can also see a community score, which I'll take a look
at later.
So in this detection tab, this is kind of like the main one that most people would be
interested in,
you can see the actual result each scanner returned.
And some have different names for each particular malicious virus or type of virus.
A lot of these for example say "Trojan.Valyria" or Acronis just says "Suspicious", maybe it
doesn't know it's 100% a virus but probably is.
And also Google, for example, just says "detected".
Now, sometimes these names can be helpful.
For example, if you are uploading a file and there's only like one result and it just says
suspicious file, then it's like okay, that probably is a false positive if you otherwise
have no other reason to mistrust the file.
But if you know, there's a whole bunch of different results that say it's suspicious
then yeah, probably is suspicious.
So you do kind of have to use a little bit of common sense.
And you'll also see that there are some false negatives, so these all say that it's fine.
Now, one thing to note is if you hover over the little info icon next to these, it does
mention that the scanner used by VirusTotal may not be the exact same scan system that's
used by off the shelf commercial software,
if you were to install it yourself.
This might be another way it's configured, maybe it was specially configured for VirusTotal
to be either more or less sensitive for whatever reason.
So just kind of be aware, it might not necessarily be the same exact result if you scan it with
the software.
If we look at the details tab, there's a whole bunch of detailed information and most of
it very technical.
For example, there's a few different types of hashes, so these are all hashes, but with
different algorithms for example.
You can also see when it was first submitted for example, this one was submitted years
ago, so it can kind of give you an idea of how long this thing has been around.
It'll also tell you the names of the file that this was uploaded as.
So in this example, you can actually see, it's kind of funny, that a couple of these
say like "DHL Information", which makes it pretty obvious that this was probably used
in some kind of email phishing scam and the person was trying to pretend that this file
was a DHL delivery document of some kind and got people to open it,
and then it was actually a virus.
There's also a bunch of other information that I'm not going to get into on this page,
but you can look at it if you want.
This next Relation's tab is actually pretty interesting.
This basically shows you how the program relates to various other domains and files.
So for example, if when the file gets run, maybe what website addresses or IP addresses
does it contact?
And you can probably see here that a lot of the URLs go to an EXE file.
So clearly, if you were to run this Word document, that was... probably had some kind of macro
in it, it would go and download an EXE file which probably have the rest of the virus.
And it'll even scan those URLs that it does contact, and show you the results for those
too.
Also, it'll show a scan of the top level domain of those URLs.
So maybe the entire website domain is used for malicious purposes, or maybe it's a hosting
site, so the main domain is not malicious, but people can host malicious things on it,
so that specific URL is the only thing that's malicious.
Also, it'll show bundled files,
so these are files that were inside the main file that was uploaded.
For example, did you know that Word document files are actually zip files?
Yes, they are, I made a whole video about this recently.
So there were a couple of files that were actually inside this Word document file.
It'll also show you dropped files, which I believe are files that were fetched in some
way, or maybe they were also packaged somehow in the file in another way.
There's also the Behavior tab, which actually shows you pretty much exactly what the file
does, though it is pretty technical.
So it'll actually show your reports by various sandbox softwares which from my understanding,
run the program in some kind of isolated way, and just kind of monitors how it behaves,
what it does, and then might use some rules based on that.
So I think this is a little bit different than the other virus scans.
At the bottom, you can see a section called process and service actions.
And this actually shows you exactly what kind of like file commands it ran.
So you can see here it opens up PowerShell and runs a big long command, which appears
to basically just download that EXE file we saw in the links above.
So this is kind of interesting, it shows you exactly what commands it even runs.
If we go to the Community tab, we can see details on votes that people left.
So if you create an account, you can actually vote on whether this is a safe or malicious
file.
So this might be good if it's a false positive, you might see a bunch of comments from people
saying, "Oh, this is just whatever program.
Yeah, it's a false positive or whatever".
And I don't believe it only looks at the comments, because that could be gamed a little bit.
You know, some virus maker could upload the file and vote it up and just say, "oh yeah,
it's safe, false positive", but I think there's a little bit more secret sauce going in there.
But it still is definitely going to be useful in your overall decision on whether or not
to trust it.
Now, if you do create an account, you'll notice in the detection tab, and other places, there's
additional information and features.
So this will show you a bunch of sets of rules that are crowdsourced.
So basically just behaviors that people have come up with that show,
"Okay, this is an IOC", I believe that's called, "Indicator of Compromise".
Just kind of little behavioral characteristics that identify this as being a malicious file
for example.
And it'll show you all the ones that triggered that.
Also if you're logged in you can see a whole graph, so it seems like this is a visual version
of the other tabs we looked at before in terms of the relationships.
So you get a little bit more interesting stuff you can look at if you have an account.
Now there's actually a couple of useful tools that use VirusTotal.
So one is called VirusTotal uploader.
And how this works is you install it on Windows, and then you can simply right click any file
on Windows and do Send To VirusTotal and it'll automatically upload the file to VirusTotal
without having to go to the site, drag the file or anything like that.
Now one thing to note is this VirusTotal uploader isn't maintained anymore, so it's not going
to be updated at all, but it does still work, as far as I just last tested it, so it's still
worth using I think, it's still the easiest way to do it.
There's also a chrome browser extension called VT4Browsers, and this basically lets you do
a whole bunch of different stuff, to make it easier.
So you can have it by default,
it auto scans all downloads, although it excludes like documents and stuff.
I actually turn this off because I don't really need it scanning every single download I do.
If I'm suspicious of a file, I'm just going to upload it myself.
I personally will probably just use this extension for checking URLs.
So if you right click a URL or a link, it'll show you the option to scan selected link,
and then that will actually take you to the results for that domain or whatever.
And then that's an easy way to check links so you don't have to again, copy it, go to
the VirusTotal site, it's all in one click.
You also have a few other options, you can scan the current page or some other stuff
that I'm not going to get into.
That's probably the most common use you're going to use for that.
So yeah, not too much more to say about it, just wanted to make a pretty simple video.
If you hadn't heard of this tool before, or maybe you didn't know so many details about
it, now you do.
If you guys enjoyed this video, be sure to subscribe, also click the bell to enable all
notifications.
These days, YouTube might not show you videos even if you do subscribe, so be sure to do
that.
If you like the video,
also give it a thumbs up and let me know down in the comments what you think.
Maybe there's a major feature that I missed or something, let me know down there.
If you want to keep watching, the next video I'd recommend is that one I mentioned before,
how Word document files and plenty of other file types, are actually just zip files in
disguise.
You can see all those right there, I'll put the link you can click on.
So thanks so much for watching guys and we'll see in the next video.