What happens when the download link is scanned by virustotal

If I give a download link to virustotal, how will it scan it? Does it only search the link in the database? I don't think virustotal will download and scan the file, it is illogical, for example, I gave virustotal the download link of a 30 GB file and it showed the result in 5 seconds.

Malware samples uploaded to VirusTotal, Jotti's Virus Scan, and a few other similar sites is distributed to each anti-virus vendor that chooses to participate in the service but that participation list changes from time to time. This is the current list of the companies that take part in VirusTotal with their anti-virus engines.
 
How VirusTotal Works - VirusTotal Documentation Hub
 

File Searches

VirusTotal Intelligence allows you to search through our dataset in order to identify files that match certain criteria (hash, antivirus detections, metadata, submission file names, file format structural properties, file size, etc.). We could say that it is pretty much like the "Google" of malware.

About VirusTotal

VirusTotal, a subsidiary of Google, is a free online service that analyzes files and URLs enabling the identification of viruses, worms, trojans and other kinds of malicious content detected by antivirus engines and website scanners. At the same time, it may be used as a means to detect false positives, i.e. innocuous resources detected as malicious by one or more scanners...VirusTotal.....a tool that checks suspicious samples with several antivirus solutions and helps antivirus labs by forwarding them the malware they fail to detect.....Very often antivirus solutions and URL scanners will produce false positives...VirusTotal simply acts as an information aggregator and cannot and will not be held responsible for these false positives. VirusTotal will not whitelist any files or URLs and will not remove any detections resulting from the normal operation of the products it makes use off. False positives should be dealt with the developer/company that offers the product generating the erroneous detection.

• VirusTotal's antivirus engines are commandline versions, so depending on the product, they will not behave exactly the same as the desktop versions: for instance, desktop solutions may use techniques based on behavioural analysis and count with personal firewalls that may decrease entry points and mitigate propagation, etc.
• In VirusTotal desktop-oriented solutions coexist with perimeter-oriented solutions; heuristics in this latter group may be more aggressive and paranoid, since the impact of false positives is less visible in the perimeter. It is simply not fair to compare both groups.
• Some of the solutions included in VirusTotal are parametrized (in coherence with the developer company's desire) with a different heuristic/aggressiveness level than the official end-user default configuration.

 
If an anti-virus vendor that you use is also on the VIrusTotal list and the scan results appear to show discrepancies with your own scan results, these could be the result of different database definitions. One may be more current than the other. Further, VirusTotal uses command-line versions of anti-virus programs that require no installation so they can run multiple anti-virus solutions on one Windows machine and detection methods as well as behavior can differ. Each vendor decides which version of their product will be used by VirusTotal and how it has to be configured...and that configuration can be different from yours as explained below.

• AV product on VirusTotal detects a file and its equivalent commercial version does not
• URL scanner verdict differ from its corresponding antivirus solution

For more information, please read Didier Stevens' interview with Julio Canto from VirusTotal.

 

Malware samples uploaded to VirusTotal, Jotti's Virus Scan, and a few other similar sites is distributed to each anti-virus vendor that chooses to participate in the service but that participation list changes from time to time. This is the current list of the companies that take part in VirusTotal with their anti-virus engines.

Thank you, I didn't know this

But I don't understand how it downloads a 20 GB file, scans it and sends the result in 5 seconds ( It does all these steps in 5 seconds )

You said that antivirus companies do this

It makes sense only in one situation: the server of the file I want to download has the antivirus of one of the companies that provide service to Virustotal, and it has already checked that file and Total Virus only gets the result from that server?

But I don't understand how it downloads a 20 GB file, scans it and sends the result in 5 seconds ( It does all these steps in 5 seconds )

Hello @FNActivity

Your take on what happens is slightly flawed. You upload the file to VT, not download. Once. uploaded, VT calculates the file's hash. Then…

When a file is uploaded, its hash is calculated and compared to those files already analyzed. If already scanned, the previous results are placed in a reply to you. Even if the file was analyzed years ago, those results are placed in the reply. Hence, a rapid response from VT.

If no matching hash is on file, then a new analysis must take place. VT will likely request a confirmation upload. Then that analysis will take much longer than five seconds.

If a file was scanned a long time ago, you may elect to request a reanalysis. That reanalysis will again take much longer than five seconds.

Does the above improve your depth of understanding now? Cheers.

Edited by 1PW, 23 February 2024 - 11:46 AM.

 

 

Malware samples uploaded to VirusTotal, Jotti's Virus Scan, and a few other similar sites is distributed to each anti-virus vendor that chooses to participate in the service but that participation list changes from time to time. This is the current list of the companies that take part in VirusTotal with their anti-virus engines.

Thank you, I didn't know this

But I don't understand how it downloads a 20 GB file, scans it and sends the result in 5 seconds ( It does all these steps in 5 seconds )

You said that antivirus companies do this

It makes sense only in one situation: the server of the file I want to download has the antivirus of one of the companies that provide service to Virustotal, and it has already checked that file and Total Virus only gets the result from that server?

 

VT does not scan download links. To scan a file YOU must download the file to your computer and upload it to VT.

VT has a size limit of 650 mb for upload if I remember correctly.

Virus Total can not assist with a 20GB file.
 

Edited by Porthos, 23 February 2024 - 01:04 PM.

Should I upload files larger than 650MBs?

Files larger than 650MBs tend to be bundles of some sort, (compressed files, ISO images, etc.) in these cases it makes sense to upload the inner individual files instead for several reasons...

... the server of the file I want to download has the antivirus of one of the companies that provide service to Virustotal, and it has already checked that file and Total Virus only gets the result from that server?

Your server antivirus is not the same. As I said above, VirusTotal uses command-line versions of anti-virus programs....and detection methods / behavior can differ.

AV product on VirusTotal detects a file and its equivalent commercial version does not

VirusTotal antivirus solutions sometimes are not exactly the same as the public commercial versions. Very often, antivirus companies parametrize their engines specifically for VirusTotal (stronger heuristics, cloud interaction, inclusion of beta signatures, etc.). Therefore, sometimes the antivirus solution in VirusTotal will not behave exactly the same as the equivalent public commercial version of the given product.

@Porthos

@1PW

Thank you , your answers made me understand the issue

Edited by FNActivity, 23 February 2024 - 03:00 PM.

You're welcome on behalf of the Bleeping Computer community.