Why does VirusTotal have two different reports for the same hash depending on FILE vs URL submission?

Question

Why would the same SHA256 Hash of a file have totally different VirusTotal results at the same time?

Submitting a file to VirusTotal via File upload results in numerous hits for malware.
Submitting the exact same file but via URL submission results in a totally safe and clean submission.

I understand that these files are accessed in different ways, so AV software might look at the file in a different context, but ultimately the endpoint is at risk regardless.

Answer 1

As i see, both are not files are not same. When you download file it may be added header or other vulnerable code.

Otherwise, Some virus are harmful when it is in online. When you download it, it become deactivate. Vice Versa also possible. Javascript virus are not activated when it is in local computer(Not all javascript based viruses).

Answer 2

I'd guess that this is simply a problem with how the results are presented. The URL analysis result has a link to the downloaded file result, so the user is probably expected to follow that manually to get the full picture.

The detection engines are different for both, so the URL analysis probably scans for different types of threats than the file analysis.

Answer 3

So, the File Upload and URL analysis are two different things as perceived by the AV & the sandbox engines.

• File Upload directly accesses the file and processes it by exposing it to the sandbox & AV engines which will detonate the file and thereby monitor it's activities. Aside, AV engines also look for few static attributes based on the signatures that they have and pronounce their verdict accordingly.

• However, URL analysis is much different as it does not download and process a file, but accesses the URL looking for any malicious actions that are initiated. URL analysis is designed to observe actions taken on a specific URL, and to determine malicious intent of the URL itself.