1

I recently downloaded a very popular open-source application. Usually, I compile open-source applications myself after reading the source code. But my compiler box was busy with many tasks, so I decided to download the pre-compiled executable and just run it on a temporary system. Although that system gets reformatted every day, and doesn't have any network connections, I still wanted to scan the executable for malware.

The executable is distributed by the developer as a zipped executable. I uploaded the zipped executable to VirusTotal, and I was surprised to see that VirusTotal had no cached results for the hash of the executable of this popular application. I then performed the same action for the extracted executable. Same result.

Does that mean that no one - including the developer - even bothered to scan the executable on VirusTotal? Or can one scan files on VirusTotal without the results being cached?

Improve this question

1 Answer 1

Reset to default
1

In my experience, VirusTotal keeps track of the file hashes. For every upload it does a lookup to check if a file has already been scanned before. I checked their policies, but couldn't find how exactly hashing and lookups work and if there is any ageing process.

Submissions to virus total are not normally automated for general software and developers aren't obliged to submit their built executables to VirusTotal. One can argue, it's not the responsibility of developers to notify the AV vendors about a new version of their software. If you ever submitted your own software there, the process can be upsetting, especially when several AVs misclassify your own software as malware and their page to submit a false positive report does not actually work or no one cares on their end to fix a false positive.

Another example, not all files in the Windows\System32 are scanned, I've just submitted an executable from the Windows folder and it hasn't been scanned before. I've also submitted a dll, that was scanned a year ago.

It just means no human or application has uploaded that particular file before, and that's ok.

Improve this answer
3
  • Thanks. I agree that it's no one's obligation to submit files to VirusTotal. But I do think it's a good idea for us developers to submit all our public-facing downloads there. The reason is twofold: (1) To catch the possibility that we have malware on our own systems. Many developers don't consider this as a possibility and some wind up unintentionally distributing malware this way. (2) To pre-emptively deal with concerned users understandably filing issue reports that our software contains malware.
    – End Antisemitic Hate
    Commented Mar 10, 2021 at 20:37
  • Yeah, I agree it's probably a good idea to do that. It's just pain, in my experience, to deal with false positives.
    – oleksii
    Commented Mar 10, 2021 at 21:04
  • Yes, false positives are a big PITA. Fortunately, they are less common than in earlier years (but are still a big time-waster). One nice thing about VirusTotal is that you can see the results of all the scanning engines they use; usually (but not always) the more esoteric scanning engines are the ones with the most false positives. I find it faster to verify that a "hit" is really a false-positive and then notify the scanning companies instead of responding to thousands of people stating that a certain download has malware. I always hope the scanning companies don't just take my word for it.
    – End Antisemitic Hate
    Commented Mar 10, 2021 at 21:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .