VirusTotal - Free service to analyze new samples

Thanks for your sharing this information but i use one link but i did not able to use it ..

What link in this topic were you not able to use?

Last year, in post #22, czarboom asked an interesting question that I didn't see an answer to, and I have a related question.  It was about all of the PC magazines and their rankings of AV products.  I, personally, don't trust PCMag and some of the others because I've noticed a bias issue, so are there any reliable resources out there that are easy to understand and neutral?  I tried a couple of times to look at (back when there were only about 3) the labs that test and rate AV programs, but I was never able to get to the results.  Also, I realize that some of these labs do tests under controlled conditions that do not actually show how AVs perform under realistic conditions....?  Thanks!

There are several labs which test the effectiveness of major anti-virus programs to include AV-Comparatives.org, Virus Bulletin Comparative Tests, AV-Test.org, NSS Labs Consumer Anti-Malware Products Group Test Report, MRG-Effitas, etc....PCMag is not one of them.

• AV Comparatives Independent Tests of Anti-Virus Software <- click the "Comparatives" link on the left, then click Main Tests.
• False Alarm Testing by AV Comparatives
• CRDF Threat Center: Statistics on daily detection rate for antiviral products
• Virus Bulletin Comparative Tests - August 2013 Tests
• AV-Test.org
• NSS Labs Consumer Anti-Malware Products Group Test Report <- click on the link to "Read the full report now"
• NSS Labs Corporate Endpoint Protection Products Group Test:
• Anti-Malware Test Lab

These kinds of comparative testing results will vary depending on a variety of factors to include but not limited to who conducted the testing, what they were testing for (type of threats, attack vectors, exploits), what versions of anti-virus software was tested, what type of scanning engine was used, and the ability to clean or repair. There are no universally predefined set of standards or criteria for testing which means each test will yield different results. As such, you need to look for detailed information about how the tests were conducted, the procedures used, and data results.

Further, if you're dealing with zero-day malware it's unlikely the anti-virus testing is going to detect anything. It takes time for new malware to be reported, samples collected, analyzed, and tested by anti-virus researchers before they can add a new threat to database definitions.

Excellent information, of course.  So, I guess what you're saying in a round-about sort of way is that there is no magic website to look to to get clear information.  No metasite looks at the data from all those companies you listed and then produces a report, either.

 

Is that correct?

No...I am saying the test results will vary depending on a variety of factors so you cannot make specific conclusions based on what one site alone says.

With that said, this is moving off the original topic which is specifically about VirusTotal's service to analyze new malware samples. If you would like to discuss comparative test results, please start a new topic.

List of Other Online File analyzers:

• Jotti's virusscan
• VirSCAN
• Metascan Online
• Comodo

Excellent information, of course.  So, I guess what you're saying in a round-about sort of way is that there is no magic website to look to to get clear information.  No metasite looks at the data from all those companies you listed and then produces a report, either.

 

Is that correct?

Also sites like CERT and SANS or the NIST or http://csrc.nist.gov/ (security focus site) are the offical "un" sites for tech and IT in the united states.  Good resources but they are a pain to search without some understanding of the language they use.  Meaning RFCs and IETFs and EDUs, but if you can do it, you can find some really good guides and tools.

Yes, CERT, SANS, NIST and similar sites are excellent security resources but that is a topic for a separate discussion.

correct but the SANS S.T.O.R.M center has great active virus info, but you are correct in virus finding. 

A good site for unknown and known malware is

https://anubis.iseclab.org/?action=home

its a site for collection of windows and android APKs and unknowns. 

I've been using Superantispyware for a while now, is Virus Total a replacement?

No its not. Did you read the first post of this topic which includes the following statement?

Virustotal is a service developed by Hispasec Sistemas, independent IT Security laboratory, that makes use of several command line versions of antivirus engines, updated regulary with official signature files published by their respective developers.

About VirusTotal
VirusTotal FAQs

Alright,

So after two quick searches on BleepingComputer, I noticed that the websites mentionned in the thread title weren't introduced on here so far, and being a big user of both of these, I decided to post in the "main" thread for these kind of websites to introduce them.

Malwr.com and Hybrid-Analysis.com are what we call "online analysis" website. They are websites on which you can upload a website and obtain various information on it such as Antivirus detection, network communications, dropped files, etc. Basically, these websites are like VirusTotal and Anubis (and also like a lot of other websites that does the same thing as these two).

Malwr.com

Malwr.com is a non-commercial and independant online file analysis website created and operated by Claudio nex Guarnieri and Alessandro jekil Tanasi, which are Security Developpers/Hackers. Malwr.com mainly runs on a malware anslysis tool that they created, called Cuckoo Sandbox. Hence you would see Malwr.com as the web version of that tool. They also include VirusTotal's website in their service. Malwr.com allows you to research analysis of files based on their MD5 signatures, and also by signing up on the website to have access to more features. Despite this, the whole service is free to use for everyone, and login in the website isn't required. Here's more information about the website, taken directly from their "About Us" webpage.

About what is it
What is Malwr?
Malwr is a free malware analysis service and community launched in January 2011. You can submit files to it and receive the results of a complete dynamic analysis back.

Mission

Existing online analysis services are all based on closed and commercial technologies, often with intents to leverage people's data to own profit and with no real transparency on how the data is being used. We are researchers ourselves and felt the need of an alternative solution.

Our mission is to provide a powerful, free, independent and non-commercial service to the security community, independent or academic researchers with no other goal than facilitating everyone's daily work and give a contribution to the community.

Independent

Malwr is operated by volunteer security professionals with the exclusive intent to help the community. It's not associated or influenced by any commercial or government organization of any sort.

Non-Commercial

We do not profit on your data. The files you submit, the information you provide and any other use you make of the website is not commercialized in any way. We create and use open source technology. We're not advertising any commercial product, we are not collecting data to enrich any existing product.

Privacy

Unless you specify otherwise, the files you submit are not shared outside. While we believe in the value of sharing within our community and the larger public, we do strongly believe in respecting your privacy and the confidentiality of the data you handle.

We really invite you to read our Terms of Service for "detailed" "policies".

Contacts
For inquiries you can contact us at the following email address:


You can also find us on FreeNode IRC on channel #malwr.

People
Malwr was created and is operated by Claudio nex Guarnieri and Alessandro jekil Tanasi.

The behavioral analysis graph was created by Andy Nordbo.

Malwr is powered by The Shadowserver Foundation.

Technology
Malwr is mainly based on an open source malware analysis tool we also created and develop called Cuckoo Sandbox.

Malwr also uses the following services, tools and libraries:

VirusTotal
Support
Malwr is an independent and non-commercial project. We spent a gazillion amount of hours building it and operating it and we have some costs in maintaining it. You will find Flattr buttons, similar to the one below, across the website: flattr is an amazing service that allows you to make micropayments in support of authors that produced content you find valuable.

Source: https://malwr.com/about/

Hybrid-Analysis.com

Hybrid-Analysis.com is another file analysis service from the company Payload-Security. You can submit pretty much any kind of file on their website to get a full behavior analysis of it. The website is powered by their main product, VxStream Sandbox and StaticStream, which is an hybrid analysis engine. They also include VirusTotal as part of their service and also offer the option to analyse .zip archive which password is "infected", or without one. The website also offers a "Search" feature, to search files via their MD5 and SHA256 signatures. The website is still new (less than 2 months old), but already completed over 1,500 file analysis.

Here's what they say about the website:

Welcome to the free malware analysis service powered by Payload-Security.com. Using this service you can submit Windows files or PDF/Office documents for behavior analysis. All accepted files will be analyzed using our innovative Hybrid Analysis technology. It is possible to submit encrypted zip archives with the password 'infected', without password or directly. Please contact us if you want to use our interface automatically or for suggestions.

Source: https://www.hybrid-analysis.com/

Hopefully, these websites will be of use to people that wants to check if certain files are infected or not. However, keep in mind that if you don't know how to analyse the results returned by these services, you won't be able to use them at their full potential.