Learning Malware Analysis

3.1 Scanning the Suspect Binary with VirusTotal

VirusTotal (http://www.virustotal.com) is a popular web-based malware scanning service. It allows you to upload a file, which is then scanned with various anti-virus scanners, and the scan results are presented in real time on the web page. In addition to uploading files for scanning, the VirusTotal web interface provides you the ability to search their database using hash, URL, domain, or IP address. VirusTotal offers another useful feature called VirusTotal Graph, built on top of the VirusTotal dataset. Using VirusTotal Graph, you can visualize the relationship between the file that you submit and its associated indicators such as domains, IP addresses, and URLs. It also allows you to pivot ...