r/computerviruses • u/sewnbnny • 23d ago

File / URL Check need help with virustotal results

https://www.virustotal.com/gui/file/0aadf0001294f4cd7c26ceb990e30e2465f7a66a9f727a8035d830cf1278c1ce/behavior

it said "No security vendors flagged this file as

malicious" but it literally infected my laptop and there was no release under the github page but it had a big red button that said releases and it redirected me to a zip file? i was told to use virustotal to scan stuff and although my computer is okay now, I don't know what to make of this if it isn't detected on virustotal when it's actually malicious? i would appreciate any help..

https://www.virustotal.com/gui/file/0aadf0001294f4cd7c26ceb990e30e2465f7a66a9f727a8035d830cf1278c1ce/behavior

2 Upvotes

100% Upvoted

7 comments sorted by

1

u/rifteyy_ Malware Removal Expert 23d ago

But youā€™ve ran the executable inside and that already has a few detections - https://www.virustotal.com/gui/file/0ad1d861cdcf5f80139820b11abcdeb5b884d2f682d1f6392029c54fd9a0cb8d/detection

1

u/sewnbnny 23d ago

omg! thank you! I was confused and I got really scared to try to touch the exe again.

edit: also so virustotal said the zip wasn't flagged as malicious? is it because the exe has to be scanned and not zip? šŸ˜µā€šŸ’«

1

u/rifteyy_ Malware Removal Expert 22d ago

I do not know the exact convention of when malicious file causes and doesn't cause a detection on the uploaded ZIP, but my ruleset that I follow and works is that I upload whole ZIP and then inspect each file inside of the ZIP (visible in relations -> bundled files).

In this case, it could have been the fact the ZIP is 180mb, which is relatively large and can make the engines halt at that big of a size.

1

u/sewnbnny 22d ago

interesting, I never even thought about paying attention to the size, that is also a big red flag in a way.. hm. well, I will follow your ruleset as well from now on!

1

u/[deleted] 22d ago

[removed] ā€” view removed comment

1

u/sewnbnny 22d ago

thank you so much for your comment, it's so eloquent! and I sound naive but I thought GitHub was really 100% safe regardless.. since I never had any issues before but that was also because all the code and releases and such were so open. I feel so childish for clicking on a banner like that.. when the red flags were there! (no releases and no download counts) etc. it also sounded and looked like ai kinda ??? this taught me a lot. I will run the exe files instead of the zip from now on with everything using virustotal or equivalent. i didn't even know that this scam stuff was so relevant until it happened to me and i looked into it.. it's so easy for them to bypass because it looks so normal.

1

u/sewnbnny 22d ago

oh! and also I checked the behavior tab but I didn't understand it to be honest ): but I still had a bad feeling.. I am not knowledgeable on it or some of these terms/rules but I will look into it and try to learn.