VirusTotal Uploader for OS X

VirusTotal Uploader is a popular utility in the tool-set of many malware fighters, it eases the task of submitting files to VirusTotal using Windows operating systems by just performing a right click on any file and selecting the pertinent option from the context menu.

Over the years the Windows Uploader evolved, being able to also quickly scan the image files of running processes, trigger scans of remote URL content before saving it to disk, etc. Even some community members produced similar utilities, many of which outperform our very own software, an example of this is Phrozensoft's VirusTotal uploader. That is the magic of building a community of passionate researchers, they will use your APIs in order to produce better tools that will benefit end-users world-wide.

Today we are proud to announce a new VirusTotal Uploader for OS X. It is available for download on our Desktop Applications page. Internally it uses our  public API to schedule uploads of files, with the exact same limitations that any public API user would experience.

Some of it's feature are:

• Drag and drop a file to the VirusTotal Uploader in order to scan it with over 50 antivirus solutions.
• Drag and drop a folder to the VirusTotal Uploader and schedule the analysis of its content.
• Drag and drop a Mac application  to the VirusTotal Uploader.
• Allow you to "Open With" in finder the VirusTotal Uploader to scan a file.

Hopefully this will lead to VirusTotal receiving more Mac applications, diving deeper into an increasingly targeted OS by attackers and allowing antivirus companies and researchers making use of VirusTotal's back-end to build stronger defenses against these threats.

It has been tested on OS X 10.8 and 10.9.  Any bug reports, feedback or feature requests are welcome. 

Read More

VirusTotal += Tencent URL scanner

Just recently my colleague Julio announced the introduction of Tencent as a new antivirus solution in VirusTotal's file scanner. Today we are excited to announce that Tencent has broadened its collaboration and is also sharing its malicious URL dataset in order to enhance our URL scanner.

This is a great addition as it will surely give us a better visibility into the threats targeting the eastern side of the globe. This is an example of showing Tencent's verdicts:
https://www.virustotal.com/en/url/e2387dd5a55e2af20db30d57a7869a3e86faf1e85aa065e3e4e76167e93782dc/analysis/

Welcome on board!

Read More

VirusTotal += Tencent

We welcome Tencent as a new file scanning engine at VirusTotal. In the words of the company:

"Tencent anti-virus engine is an independent R&D anti-virus engine, which contains three technology-leading methods to  detect malware.

1. TAV uses clustering to extract the micro-signature efficiently and make sure the detection of malware efficiency. TAV also has the powerful ability of processing infective virus.

2. QQsm is a new anti-virus engine which using machine learning methods to detect malware. There are massive confirmed malwares and safe file in out database and we use those to make the Mathematical model which has a great detection rate for new form malware. 

3. TCloud is a cloud-based anti-engine, which has efficient response capability."

Read More

VirusTotal += Zillya

We welcome Zillya as a new file scanning engine at VirusTotal.

Read More

VirusTotal += CRDF France URL scanner

Many of you may already know CRDF because of their contributions in VirusTotal Community, in their own words:

We observe malicious behavior to develop, understand, inform and fight against scourges. The laboratory actively fights against malware, spam and security risks.

Among other projects, CRDF has built its own threat center and they are very active VirusTotal uploaders. Today we are excited to announce that they have taken this collaboration one step further and started sharing their malicious domains dataset with VirusTotal in order to make it work as a URL scanner.

Here is an example of a URL being detected by CRDF:
https://www.virustotal.com/en/url/57f956398112e14e1c4bf90310d0ad5417535de1ac8d3b7ce9c504d7d65f4153/analysis/1391729258/

Welcome on board CRDF!

Read More

VirusTotal += AegisLab

We start february welcoming AegisLab as a new file scanning engine working at VirusTotal. AegisLab was already collaborating with us with WebGuard in the URL scanning system. A description from the company about the engine:

"AegisLab’s intelligent virus DNA algorithm extracts the special one-to-many mapping virus signatures. It achieved the much higher detection rate for latest Windows PE and Android APK variant virus. Their scan engine also uses the DNA fast match algorithm and is very suitable for limited resources environment. In native streaming mode, the engine is able to catch the most virus very efficiently from network packets."

Read More

VirusTotal += imphash

Recently Mandiant blogged about a feature they call imphash, in Mandiant's own words:

One unique way that Mandiant tracks specific threat groups' backdoors is to track portable executable (PE) imports. Imports are the functions that a piece of software (in this case, the backdoor) calls from other files (typically various DLLs that provide functionality to the Windows operating system). To track these imports, Mandiant creates a hash based on library/API names and their specific order within the executable. We refer to this convention as an "imphash" (for "import hash"). Because of the way a PE's import table is generated (and therefore how its imphash is calculated), we can use the imphash value to identify related malware samples. We can also use it to search for new, similar samples that the same threat group may have created and used.

We are excited to announce that VirusTotal reports for Portable Executables now show this hash in the additional information tab:

When considering an individual report, this property might not be very useful on its own, however, if you happen to have an API key with additional information privileges you will also find the hash embedded in the JSON response. This means you can massively feed your own local database setup with the imphash and implement your own similarity search feature for your malware collection.

VirusTotal Intelligence users can already perform searches through our dataset according to this new property.

Read More