I've recently started to convince relatives to upload anything they download to Virus Total, to help them be more safe when downloading stuff.

However, I have recently come across an installer for a game that is about 500MB large. Virus Total only supports uploads up to 128MB.

How can I ensure this file is safe to install?

  • 2
    To be pedantic, which is actually a good thing in security, you cannot "ensure" the file is safe. What you're trying to do it be "reasonably sure" it is safe ;-) – virullius Oct 10 '18 at 16:00
  • I understand there is no such thing as perfect security, but being able to check if 28 / 59 malware scanners identify a file as potential spyware is good enough for me. – MechMK1 Oct 10 '18 at 16:41
  • 4
    The answer below from @Daisetsu touches on it but I'll echo the sentiment in a comment: people usually don't just happen upon 500mb files, they are intentionally sought after and if it's sought after, it should be from a trusted [legitimate] source. AV is not great at detecting malice in extremely large files. TLDR: Consider the source as a barometer in your quest for reasonable assurance, or just detonate it on a separate machine first. – HashHazard Oct 12 '18 at 21:06

You may not be aware of this, but VirusTotal saves the files that you upload. Businesses that have a subscription to VirusTotal can download those files you uploaded, it's part of the terms of service. I wouldn't upload anything potentially sensitive that you don't want the entire world seeing.

While VirusTotal is indeed a useful service, I don't see it being beneficial to scan everything you encounter. Assuming you're running Windows, any of the big players in the AntiVirus game such as Windows Defender, should be sufficient most of the time.

Is there a reason you're worried about this game installer? Is it from a legitimate source, or is it something you grabbed off a P2P service? Things such as games which unpack giant executables aren't as likely to be caught by AntiVirus. There's a lot more space to hide something malicious that seems innocuous.

For something that size, I would recommend running in a sandbox. Cuckoo will analyze files and executables dynamically. Sandboxie doesn't analyze files, but rather provides isolation, so if a program is malicious they won't be able to touch the rest of the computer.

  • @daisestu, I wanted to get the tool you mentioned but "cuckoosandbox.org" is detected as "malicious" by Clean MX on Virustotal, therefore, I'm not sure it's safe: am I looking at the wrong url or the antivirus detected a 'false positive', in your opinion? – franz1 Mar 4 '20 at 18:42
  • 1
    @franz1 Cuckoo is just one of many sandboxes. I wouldn't personally be surprised that one antivirus engine didn't like the site, they often flag anti-malware as malware. It's an open source project that's been around for a while now. – Daisetsu Mar 4 '20 at 18:49

Large [legitimate] files, generally have a checksum provided by the manufacturer for a number of reasons:

  • Ensure the download completed successfully and in it's entirety
  • Ensure the download is from the manufacturer in it's intended (unmodified) form

I'd hunt for a checksum from the vendor and try to match the hashes up. Acceptable hashes are SHA256 and greater. MD5 and SHA1 have known collisions and as such will be deprecated soon.

As a second option, you can detonate on an isolated host before running on your intended system. Sandboxes can be effective for some malware, but more and more malware is keen to detect if it's being run in a sandbox and will not detonate under certain conditions.

  • 2
    You can also submit that hash to VirusTotal (the Search tab) and you will see the report on that file it it was submitted by another user. I think business users may be able to bypass the file size limit (although I don't have first hand knowledge of that) – Daisetsu Oct 12 '18 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.