Serious Discussion Services to check file security online

[CyberDevil]

Hey, guys. I like to check any new files in different services. Typically people only download an unknown file on VirusTotal, but different platforms may have different engine settings and signature relevance, and different platforms share information with antivirus companies, which can increase the speed of spreading data about a new dangerous sample to all people.

So, a list of services I use (for convenience, sorted in order of decreasing file size that can be uploaded for scanning):

1. Internxt – Free Online File Virus Scanner
File size up to 1 GB.
I don't know what engine they are using.

2. VirusTotal
File size up to 256 MB.
The most famous and popular file scanner with multiple engines from Google.

3. Kaspersky Threat Intelligence Portal
File size up to 256 MB.
Online file scanning by the Kaspersky engine, dynamic analysis (additional data is available for subscription only), new threats are immediately added to the database for all.

4. https://virustest.gov.ru/
File size up to 256 MB.
In Russian language only, state service, works sometimes unstable. Uses Kaspersky, Dr. Web, AVSoft for static and dynamic analysis.

5. Jotti's malware scan
File size up to 250 MB.
Uses 14 engine, shares information with antivirus vendors.

6. Free Online Virus Checker - Scan Your Files Free | Gridinsoft
File size up to 200 MB.
A relatively well-known Ukrainian antivirus lab. Quite a lot of false positives.

7. https://metadefender.opswat.com/
File size up to 140 MB.
Uses 21 engines, has dynamic behavior analysis.

8. Intelix Portal
File size up to 100 MB.
UK antivirus company. Uses its own engine, reputation base, and dynamic analysis with virtualization for exe files.

9. VirScan - 多引擎文件在线检测平台
File size up to 100 MB.
Chinese service in Chinese language. Uses many engines, including Chinese ones, which are not on VirusTotal.

10. Hybrid Analysis - Free Automated Malware Analysis Service - powered by Falcon Sandbox
File size up to 100 MB.
Utilizes proprietary machine learning and dynamic analysis.

11. Filescan.IO - Next-Gen Malware Analysis Platform
File size up to 100 MB.
More not an antivirus scanner, but a service for analyzing files.

12. 2ip.io - Check a file for viruses
File size up to 100 MB.
I don't know what engine they're using.

12. Dr.Web ® online check
File size up to 10 MB. (Officially up to 10 megabytes, but I was able to upload files up to 30 megabytes.)
A well-known Russian antivirus.

13. Nano Antivirus - E-Style Software Corp. – Advanced Anti-Virus, Malware and Cyber Threat Protection
File size up to 20 MB.
Very small antivirus company from Russia with very weak antivirus.

14. Interactive Online Malware Analysis Sandbox - ANY.RUN
File size up to 16 MB.
Dynamic analysis service with AI verdict.

15. PolySwarm - Crowdsourced threat detection
File size up to 10 MB.
Uses about 6 engines when scanning, shares information with antivirus companies.

16. Online Scanner | FortiGuard Labs
File size up to 10 MB.
Online service for scanning files with Fortinet's American FortiClient antivirus

Additional:

Koodous — Collaborative Platform for Android Malware Analysts

Koodous is a collaborative platform for researching on Android malware that combines online analysis tools with social interactions between the analysts.

koodous.com

File size up to 200 MB.
Service for analyzing ONLY APK files using Ikarus engine and machine learning.

Threat Insights Portal - A really awesome service for complex analysis in the most popular sandboxes..

Sample Submission | SymSubmission - it's great that anyone can upload up to 750 megabytes to Symantec for analysis.

Xcitium Cloud Verdict - Human analysis there seems to be unavailable for free (although it seems to show that the file is in the queue to be analyzed, so I'll check it out.), but if someone wants to check up to 150 megabytes with Xcitium tools, why not. Unfortunately, it doesn't seem to be able to work with archives, so I haven't seen a way to load a full-fledged program with all libraries into it for dynamic behavior analysis..

Triage | Triage - Impressively, you can upload even very big archives or installers for free and run the file in real time on a real OS (even macOS, Linux and Android) and then see a report of what the program did in the OS and see on a map what servers it accessed geographically.

--------------------------------------------

Do you know of any other local and little-known checking services? Which ones do you usually use?

 

[Bot]

That's an impressive list! You've covered most of the popular ones. I'd like to add a few more:

1. FortiGuard Antivirus File Submission - File size up to 10 MB. Fortinet's own engine.

2. ClamAV - An open-source antivirus engine for detecting trojans, viruses, malware & other malicious threats.

3. F-Secure Online Scanner - File size up to 100 MB. F-Secure's own engine.

4. ESET Online Scanner - File size up to 100 MB. ESET's own engine.

Remember, no single antivirus tool catches everything, so it's wise to use multiple tools like you do.

 

[CyberDevil]

That's an impressive list! You've covered most of the popular ones. I'd like to add a few more:

1. FortiGuard Antivirus File Submission - File size up to 10 MB. Fortinet's own engine.

2. ClamAV - An open-source antivirus engine for detecting trojans, viruses, malware & other malicious threats.

3. F-Secure Online Scanner - File size up to 100 MB. F-Secure's own engine.

4. ESET Online Scanner - File size up to 100 MB. ESET's own engine.

Remember, no single antivirus tool catches everything, so it's wise to use multiple tools like you do.

Thanks bot! The first link was helpful, but the other three are not online services, but programs you need to install on pc.

 

[Bot]

Thanks bot! The first link was helpful, but the other three are not online services, but programs you need to install on pc.

My apologies for the confusion. You're right, those are antivirus programs that require installation. For online services, you might also want to consider ScanMyServer for website security checks and Quttera for URL and website scanning. Both are free and don't require file size for scanning.

 

[gary_seven]

Another one - and one that I use extensively - is Hybrid Analysis Free Automated Malware Analysis Service - powered by Falcon Sandbox ("Powered by Crowdstrike Sandbox")

 

[CyberDevil]

Another one - and one that I use extensively - is Hybrid Analysis Free Automated Malware Analysis Service - powered by Falcon Sandbox ("Powered by Crowdstrike Sandbox")

Was under number 10, but the title wasn't very clear, I changed it to make it easier to see.

 

[gary_seven]

 

[simmerskool]

Joe Sandbox Cloud Basic -- appears to be free but they want you to register with business email... I have not used this in a long time. They also have paid analysis $$$

Automated Malware Analysis - Joe Sandbox Cloud Basic

Joe Sandbox Cloud Basic Interface

www.joesandbox.com

 

[Ashish1+1]

Thanks, @CyberDevil, for sharing this. Definitely keeping it as a bookmark for quick access.

 

[Sandbox Breaker]

Intellix and Triage Researcher Edition for my workflow primarily.
For compromise assesments and Incident Response I use Cyber Triage and Thor APT Scanner.
I want to start learning Velociraptor also soon.

 

[Vitali Ortzi]

That's an impressive list! You've covered most of the popular ones. I'd like to add a few more:

1. FortiGuard Antivirus File Submission - File size up to 10 MB. Fortinet's own engine.

2. ClamAV - An open-source antivirus engine for detecting trojans, viruses, malware & other malicious threats.

3. F-Secure Online Scanner - File size up to 100 MB. F-Secure's own engine.

4. ESET Online Scanner - File size up to 100 MB. ESET's own engine.

Remember, no single antivirus tool catches everything, so it's wise to use multiple tools like you do.

Sample Submission | SymSubmission

Guidelines for file upload submissions

• Uploads may be a maximum size of 750 MB
• If file size is greater than 750 MB, submitting a direct download URL (even a temporary file hosting/sharing link) is preferred over submitting split files.
• Upload screenshots or risk logs archived along with original file
• Uploads may be a ZIP or RAR archive containing maximum of 9 files in itself
• Uploads must not be password protected
• This process is for detected files only. Undetected files will not be processed

i use xcitium for its free human analysis as well as a few above

 

[Sandbox Breaker]

Sample Submission | SymSubmission

Guidelines for file upload submissions

• Uploads may be a maximum size of 750 MB
• If file size is greater than 750 MB, submitting a direct download URL (even a temporary file hosting/sharing link) is preferred over submitting split files.
• Upload screenshots or risk logs archived along with original file
• Uploads may be a ZIP or RAR archive containing maximum of 9 files in itself
• Uploads must not be password protected
• This process is for detected files only. Undetected files will not be processed

i use xcitium for its free human analysis as well as a few above


View attachment 286436View attachment 286438

Become the Human Analyst. Feels good. Let the force flow through you

 

[Vitali Ortzi]

Become the Human Analyst. Feels good. Let the force flow through you

too lazy to debug and disassemble each binary

 

[Sandbox Breaker]

too lazy to debug and disassemble each binary

Point taken.

 

[CyberDevil]

For compromise assesments and Incident Response I use Cyber Triage and Thor APT Scanner.

Do you know what the maximum file size is for Triage? I have a max exe size that is 264 megabytes on my PC and it accepted it.

Sample Submission | SymSubmission

What if I don't know if the file is clean or not? Just send it as infected and they'll figure it out?

i use xcitium for its free human analysis as well as a few above

Did you buy an xcitum license for this? I suppose it's only free for automatic analysis?

 

[Kongo]

You should definitely also check out this one:

Threat Insights Portal

Threat Insights Portal

tip.neiki.dev

 

[Vitali Ortzi]

Do you know what the maximum file size is for Triage? I have a max exe size that is 264 megabytes on my PC and it accepted it.

What if I don't know if the file is clean or not? Just send it as infected and they'll figure it out?

Did you buy an xcitum license for this? I suppose it's only free for automatic analysis?

I didn't pay comodo you have to singup as an enterprise to get it free for auto human analysis


About Symantec they tell you what technologies it detected it if it's malicious and if not it will just say it's clean and you can test yourself it's pretty nice as it goes through manual analysis and you get results in the mail

 

[Vitali Ortzi]

You should definitely also check out this one:

Threat Insights Portal

Threat Insights Portal

tip.neiki.dev

Definitely underrated
I'm going to use that plus xcitium , Symantec for most analysis

 

[Kongo]

Definitely underrated
I'm going to use that plus xcitium , Symantec for most analysis

I mean it's basically an all-in-one package. Definitely a nice tool

 

[Vitali Ortzi]

I mean it's basically an all-in-one package. Definitely a nice tool

Any other nice all in one scanners that have a lot of providers ?

Btw thanks for sharing it now I can download samples from virus total using it anyway if anyone is willing to donate to Threat Insights Portal they definitely deserve some donations to keep it running (my new favorite online scanner )