Lion Cipher Lab

Read a VirusTotal report: detections, behavior, and what actually makes a verdict

• Digital Forensics & IR (DFIR)
• Beginner
• ~30 min
• Free · no account required

Why it matters

One day an alert, an email attachment, or a hash from a colleague will land on your desk, and the fastest thing you can do is paste it into VirusTotal and stare at the result. The trap is that the big number at the top — '48/72 vendors flagged this' — looks like the answer, and it isn't. Real analysts get burned in both directions: they wave through a fresh, targeted sample that shows 0/72 because nobody has seen it yet, or they panic over a 3/72 that is a harmless installer three no-name engines mislabel. This lab hands you a finished report and teaches you to read it the way a DFIR analyst…

What you'll learn

• reading a VirusTotal report end to end (Detection, Details, Relations, Behavior)
• interpreting a detection ratio without over- or under-trusting it
• telling a specific malware-family name from a Generic/heuristic detection, and pivoting on it
• extracting the real indicators of compromise (IOCs) from Relations and Behavior, not the ratio
• spotting attacker-controllable metadata (a forged compilation timestamp, a packer)
• the operational rule: never upload sensitive or targeted samples — the community score is a lead, not a verdict
• judgment: when VirusTotal is the right first stop and when it will mislead you

Steps in this lab

1. What you're looking at — the report, and how to read it safely
2. The detection ratio: what 48/72 does and does NOT tell you
3. Reading the vendor verdicts: family names vs 'Generic' — and how to pivot
4. The Details block: the metadata an attacker can lie to you with
5. Relations + Behavior: where the REAL indicators of compromise live
6. The persistence tell: reading the Run key
7. The rule that outranks the report: never upload the wrong file
8. When VirusTotal answers the question — and when it fools you

Open the full interactive lab →