Lion Cipher Lab
Check a suspicious file on VirusTotal — safely
- Threat Intel Analyst
- Beginner
- ~30 min
- Free · no account required
Why it matters
Sooner or later you'll have a file you're unsure about — an email attachment, a downloaded installer, something a friend sent — and you'll want a second opinion before you trust it. VirusTotal aggregates the verdicts of dozens of antivirus engines and threat-intel sources for exactly this. But using it well is a skill with a sharp edge: the safe, private way to check a file is to search its HASH (which gives away nothing about the file's contents), while UPLOADING a file shares it with the whole security community — which is fine for a genuine malware sample and a serious data leak for…
What you'll learn
- computing a file's SHA-256
- searching a hash on VirusTotal instead of uploading
- reading a detection ratio and vendor verdicts
- reasoning about false positives and clean-but-unknown results
- the privacy rule: never upload sensitive files
- turning a verdict into a decision
Steps in this lab
- The one rule before you touch VirusTotal: hash, don't upload
- Compute the file's SHA-256
- Search the hash on VirusTotal
- Read the verdicts, not just the number
- Understand what a clean result does and doesn't mean
- When uploading is appropriate — and when it never is
- Why the discipline matters more than the tool