Use Email to scan files on Virustotal

Use Email to scan files on Virustotal

Virustotal, an online virus scanning service operated by Google, is a handy resource to verify that files are clean before you execute them on your devices.

All it takes is to visit the Virustotal website, drop a file on the interface from the local system, and wait for the scan results to be displayed after the scan.

The service is ideal to get a quick overview of a file’s reputation. Results are not 100% trustworthy especially if some engines report hits while others don’t; the likelihood of false positives is higher on Virustotal than with any one antivirus engine that you check files against.

Virustotal maintains an email scanning service next to the Web version and the APIs that it provides. You send emails with a file attachment to the service and get a report soon thereafter as a reply.

Here is how that works:

  • Create a new email and use scan@virustotal.com as the recipient.
  • Put Scan in the subject field and leave the body empty.
  • Attach a single file to the email.

The email is returned by the recipient’s email address (scan@virustotal.com) and uses the subject [VirusTotal] Server notification.

It lists file information — name, size, md5 and sha1 hashes — and results of all supported engines. Each engine is listed with its name, version, and last update date.

virustotal scan results email

Email scanning is quite handy at times, e.g. when you are on a mobile and want a file scanned, cannot access the VirusTotal website, or want multiple files scanned in a short period of time.

The system has several limitations, however:

  • Email attachments have a size limited that depends on the email provider but it is usually 25 Megabytes.
  • Some providers, e.g. Gmail, prevent the sending of executable files types. Gmail blocks these even when you zip them.
  • Results are limited when compared to the wealth of tools that Virustotal provides, e.g. relations, online calls, and operational details.

Closing Words

It is better, usually, to use Virustotal directly or through a program as you don’t run into any of the limitations that way. Sometimes however, email scanning may come in handy.

george