Type of site
|Internet security, file and URL analyzer|
|Available in||Arabic, Bulgarian, Chinese, Chinese (Hong Kong), Chinese (Taiwan), Croatian, Czech, Danish, Dutch, English (US), English (GB), Estonian, Filipino, Finnish, French, German, Greek, Hebrew, Hindi, Hungarian, Indonesian, Italian, Japanese, Korean, Latvian, Lithuanian, Malay, Norwegian, Persian, Polish, Portuguese, Romanian, Russian, Serbian, Slovak, Slovenian, Spanish, Swedish, Thai, Turkish, Ukrainian, Vietnamese|
|Created by||Hispasec Sistemas|
|General manager||Bernardo Quintero|
|Key people||Bernardo Quintero, Emiliano Martínez, Víctor Manuel Álvarez, Karl Hiramoto, Julio Canto, Alejandro Bermúdez, Juan A. Infantes|
|Parent||Google LLC (2012–2018)|
VirusTotal is a website created by the Spanish security company Hispasec Sistemas. Launched in June 2004, it was acquired by Google in September 2012. The company's ownership switched in January 2018 to Chronicle, a subsidiary of Google.
VirusTotal aggregates many antivirus products and online scan engines called Contributors. In November, 2018, the Cyber National Mission Force, a unit subordinate to the U.S. Cyber Command became a Contributor. The aggregated data from these Contributors allows a user to check for viruses that the user's own antivirus software may have missed, or to verify against any false positives. Files up to 650 MB can be uploaded to the website, or sent via email (max. 32MB). Anti-virus software vendors can receive copies of files that were flagged by other scans but passed by their own engine, to help improve their software and, by extension, VirusTotal's own capability. Users can also scan suspect URLs and search through the VirusTotal dataset. VirusTotal uses the Cuckoo sandbox for dynamic analysis of malware. VirusTotal was selected by PC World as one of the best 100 products of 2007.
Products and services
VirusTotal's Windows Uploader was an application that integrates into the Explorer's (right-click) contextual menu, listed under Send To > Virus Total. The application also launches manually for submitting a URL or a program that is currently running in the OS.
VirusTotal stores the name and various hashes for each scanned file. Already scanned files can be identified by their known (e.g., VT default) SHA256 hash without uploading complete files. The SHA256 query URL has the form
https://www.virustotal.com/latest-scan/SHA256. File uploads are normally limited to 128 MB. In 2017 VirusTotal discontinued support of the Windows Uploader.
Uploader for Mac OS X and Linux
Same as the Windows app you upload the file (via the app's UI or context menu) then you will be given back a result. The Mac OS X app can be downloaded from their website. However, you need to compile and build the app for Linux using the same core (provided in their repository) used in the Mac OS X application. Already scanned files can be identified by their known (e.g., VT default) SHA256 hash without uploading complete files.
VirusTotal for Browsers
There are several browser extensions available, such as VT4Browsers for Mozilla Firefox, and Google Chrome and vtExplorer for Internet Explorer. They allow the user to download files directly with VirusTotal's web application prior to storing them in the computer, as well as scanning URLs.
VirusTotal for Mobile
The service also offers an Android App that employs the public API to search any installed application for VirusTotal's previously scanned ones and show its status. Any application not previously scanned can be submitted, but an API key must be provided and other restrictions to public API usage may apply (see #Public API).
VirusTotal provides as a free service a public API that allows for automation of some of its online features such as "upload and scan files, submit and scan URLs, access finished scan reports and make automatic comments on URLs and samples". Some restrictions apply for requests made through the public API, such as requiring an individual API key freely obtained by online signing up, low priority scan queue, limited number of requests per time frame, etc.
Antivirus engines used for detection for uploading files.
- AegisLab (AegisLab)
- Antiy Labs (Antiy-AVL)
- Aladdin (eSafe)
- AVAST Software (Avast Antivirus)
- AVG Technologies (AVG AntiVirus)
- BluePex (AVware)
- Baidu (Baidu-International)
- BitDefender GmbH (BitDefender)
- Bkav Corporation (Bkav)
- ByteHero Information Security Technology Team (ByteHero)
- Cat Computer Services (Quick Heal)
- CMC InfoSec (CMC Antivirus)
- Comodo (Comodo)
- Doctor Web Ltd. (Dr.Web)
- Emsisoft Ltd. (Emsisoft)
- Eset Software (ESET NOD32)
- FRISK Software (F-Prot)
- G Data CyberDefense (G Data)
- Hacksoft (The Hacker)
- Hauri (ViRobot)
- IKARUS Security Software (IKARUS)
- INCA Internet (nProtect)
- Invincea (Invincea, acquired by Sophos)
- Jiangmin (KV Antivirus)
- Kaspersky Lab (Kaspersky Anti-Virus)
- Malwarebytes Corporation (Malwarebytes' Anti-Malware)
- Microsoft (Malware Protection)
- MicroWorld (eScan)
- NANO Security (NANO Antivirus)
- Norman (Norman Antivirus)
- Panda Security (Panda Platinum)
- Palo Alto Networks (Palo Alto Networks Threat Intelligence Cloud)
- Qihoo 360
- Rising Antivirus (Rising)
- Sophos (SAV)
- Symantec Corporation (Symantec)
- ThreatTrack Security (VIPRE Antivirus)
- Trend Micro (TrendMicro, TrendMicro-HouseCall)
- VirusBlokAda (VBA32)
- Zillya! (Zillya)
- Zoner Software (Zoner Antivirus)
Website/domain scanning engines and datasets
Antivirus scanning engines used for URL scanning.
- ADMINUSLabs (ADMINUSLABS)
- AegisLab WebGuard (AegisLab)
- Alexa (Amazon)
- AlienVault (AlienVault)
- Antiy-AVL (Antiy Labs)
- AutoShun (RiskAnalytics)
- Avira Checkurl (Avira)
- Baidu (Baidu-International)
- CRDF (CRDF FRANCE)
- C-SIRT (Cyscon SIRT)
- CLEAN MX
- Comodo Site Inspector (Comodo Group)
- CyberCrime (Xylitol)
- Dr.Web Link Scanner (Dr.Web)
- Emsisoft (Emsi Software GmbH)
- FortiGuard Web Filtering (Fortinet)
- G Data
- Google Safe Browsing (Google)
- Kaspersky URL advisor (Kaspersky Lab)
- Malc0de Database (Malc0de)
- Malekal (Malekal's MalwareDB)
- Malwarebytes hpHosts (Malwarebytes)
- Malwared (Malwared.malwaremustdie.org)
- Malware Domain Blocklist (DNS-BH - Malware Domain Blocklist)
- Malware Domain List (Malware Domain List)
- MalwarePatrol (MalwarePatrol)
- Malwares.com (Saint Security)
- Palevo Tracker (Abuse.ch)
- ParetoLogic URL Clearing House (ParetoLogic)
- Phishtank (OpenDNS)
- Quttera (Quttera Ltd.)
- SCUMWARE (Scumware.org)
- SecureBrain (SecureBrain)
- SpyEye Tracker (Abuse.ch)
- StopBadware (StopBadware)
- Sucuri SiteCheck (Sucuri)
- ThreatHive (The Malwarelab)
- Trend Micro Site Safety Center (Trend Micro)
- urlQuery (urlQuery.net)
- VX Vault
- Websense ThreatSeeker (Websense)
- Wepawet (iseclab.org)
- Yandex Safe Browsing (Yandex)
- ZCloudsec (Zcloudsec)
- ZDB Zeus
- ZeuS Tracker (Abuse.ch)
File characterization tools & datasets
Utilities used to provide additional info on uploaded files.
- Androguard (Anthony Desnos)
- Cuckoo Sandbox (Claudio Guarnieri)
- ExifTool (Phil Harvey)
- Magic descriptor (Linux)
- NSRL information (NIST's National Software Reference Library)
- PDFiD (Didier Stevens)
- pefile (Ero Carrera)
- PEiD (Jibz)
- Sigcheck (Mark Russinovich)
- Snort (Sourcefire)
- ssdeep (Jesse Kornblum)
- Suricata (Open Information Security Foundation)
- Taggant packer information tool (ReversingLabs)
- TrID (Marco Pontello)
- UEFI Firmware parser (Teddy Reed)
- Wireshark (Wireshark Foundation)
- Zemana behaviour (Zemana)
- CarbonBlack (CarbonBlack)
Files uploaded to VirusTotal may be shared freely with anti-malware companies and will also be retained in a store. The VirusTotal About Page states under VirusTotal and confidentiality:
Files and URLs sent to VirusTotal will be shared with antivirus vendors and security companies so as to help them in improving their services and products. We do this because we believe it will eventually lead to a safer Internet and better end-user protection. By default any file/URL submitted to VirusTotal which is detected by at least one scanner is freely sent to all those scanners that do not detect the resource. Additionally, all files and URLs enter a private store that may be accessed by premium (mainly security/antimalware companies/organizations) VirusTotal users so as to improve their security products and services.
- Lardinois, Frederic (7 September 2012). "Google Acquires Online Virus, Malware and URL Scanner VirusTotal". TechCrunch. Retrieved 12 April 2013.
- VirusTotal Team (7 September 2012). "An update from VirusTotal". Blog.virustotal.com. Retrieved 3 June 2016.
- "Credits & Acknowledgements : About VirusTotal". VirusTotal. Retrieved 6 July 2014.
- "Example Report". Virustotal.com. 2 April 2014. Retrieved 3 June 2016.
- "Contributors". VirusTotal.
- "New CNMF initiative shares malware samples with cybersecurity industry > U.S. Cyber Command > News". www.cybercom.mil. Archived from the original on 30 September 2020. Retrieved 22 February 2022.
- "About VirusTotal". Virustotal.com. Archived from the original on 12 August 2010. Retrieved 3 June 2016.
- "Credits of VirusTotal". Virustotal.com. Retrieved 27 November 2021.
- Dahl, Eric (21 May 2007). "The 100 Best Products of 2007". PCWorld. IDG Consumer & SMB. Retrieved 3 June 2016.
- "VirusTotal Windows Desktop Application". VirusTotal. Retrieved 16 February 2014.
- "What is the maximum file size that can be submitted". FAQ. VirusTotal. Retrieved 20 January 2015.
- "Desktop Apps". VirusTotal. VirusTotal. Retrieved 24 December 2018.
- "VirusTotal". VirusTotal.
- "VTzilla: Mozilla Firefox Browser Extension". VirusTotal. Retrieved 23 March 2014.
- "VirusTotal for Android". VirusTotal. Retrieved 23 March 2014.
- "VirusTotal Public API v2.0". VirusTotal. Retrieved 23 March 2014.
- "Credits & Acknowledgements". Virustotal. Virustotal. Retrieved 3 June 2016.
- "VirusTotal". support.virustotal.com. Retrieved 24 October 2019.