Malware Analysis with VirusTotal

Important Elements

Detection score
- represents a crowdsourced security verdict from various vendors displayed as a ratio
- The higher the number, the higher the confidence threat
Threat labels and categories
- vendor-specific classifications of threats that help confirm their attribution across vendors
Detection rules
- technical signatures used by AV engines to identify threats
- e.g., YARA rules, Heuristic patterns, and behavioral triggers
Properties
- core metadata for the file
  - includes the file type, size, and compilation timestamp
Contained domains and IPs
- covers the malware’s network infrastructure
Contained files
- details any files embedded or dropped during the malware’s execution

Section	Key Question	Red Flags	Analyst Considerations
Detection Score and Threat Labels	How many vendors detect this file as malicious?	- Five or more solid vendors flag it - Conflicting classifications (e.g., “Trojan” vs “PUA”) - No consensus among the top 3 vendors	- New malware often has low initial detection - Recheck after 24h for updated results - Look at the classification of the malware family name or capability name
Upload Time	When was the file first submitted?	- Uploaded seven days ago with more than 10 detections - Sudden detection spike after days/weeks	- Vendors need 48-72 hours for full analysis - Historical detection growth indicates malware ageing
Signatures	Is the file properly signed?	- Invalid/missing certificate - Certificate issued to an unrelated entity	- Even valid certs can be stolen/abused - Check cert chain expiration dates
Properties	Are there anomalies in the file data?	- Compile timestamp at odd hours (e.g., 3 AM) - High entropy (>7.5) in non-media files	- Some legitimate packers (UPX) increase entropy - Compare with known-good versions
Relations	What infrastructure does the malware connect to?	- Known-bad IPs in VirusTotal’s graph - DGA-like domains (e.g., xk8f92.xyz)	- Legitimate CDNs may host malware - Check IPs in Shodan for open ports
Behavioral	What post-execution actions occur?	- Modifies critical registry keys - Attempts process injection	- Some admin tools modify registries legitimately - Correlate with endpoint logs