2

When you select a file on your computer to be uploaded and analyzed by Virustotal it first computes the hash of the file to see if it hasn't already been scanned. How does the hash computation happen - it seems to be performed on my computer, so is that a function of the browser?

  • Based on VirusTotal own documentation they calculate the MD5, SHA1, and SHA256 checksum of a file. What information is used to calculate this checksum isn't provided. Without, that information, we would only be guessing at what VirusTotal uses to calculate the checksum of a file. – Ramhound Jul 8 '17 at 20:16
2

They use the Javascript File API to read the file and calculate the hash before uploading it.

Just like Javascript can read what you enter into text fields without waiting for you to submit the form, it can do the same with files you select for uploading. As soon as you hit the "OK" button in your file selection dialog, an event is triggered and the script can get read access to the file.

| improve this answer | |
1

No, the "hash" or "checksum is calculated by virustotal's website once you uploaded the file, so it can be sure that the file you uploaded is the same file it has previously scanned, byte for byte identical.

| improve this answer | |
1

According to this blog post, yes, the calculation of the hash on your PC is dependent on your browser supporting HTML5.

You will also perceive that very often your file uploads will be immediate, this is because we have made use of HTML5 (in those browsers that support it) to compute the hash of the file on the client-side so as to avoid submissions of files that are already present in our store

http://blog.virustotal.com/2011/12/moving-to-google-app-engine.html

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.