2
When you select a file on your computer to be uploaded and analyzed by Virustotal it first computes the hash of the file to see if it hasn't already been scanned. How does the hash computation happen - it seems to be performed on my computer, so is that a function of the browser?
kat
Posted 2017-07-08T20:12:46.520
Reputation: 175
2
They use the Javascript File API to read the file and calculate the hash before uploading it.
Just like Javascript can read what you enter into text fields without waiting for you to submit the form, it can do the same with files you select for uploading. As soon as you hit the "OK" button in your file selection dialog, an event is triggered and the script can get read access to the file.
1
No, the "hash" or "checksum is calculated by virustotal's website once you uploaded the file, so it can be sure that the file you uploaded is the same file it has previously scanned, byte for byte identical.
KoKo
Posted 2017-07-08T20:12:46.520
Reputation: 1 498
1
According to this blog post, yes, the calculation of the hash on your PC is dependent on your browser supporting HTML5.
You will also perceive that very often your file uploads will be immediate, this is because we have made use of HTML5 (in those browsers that support it) to compute the hash of the file on the client-side so as to avoid submissions of files that are already present in our store
http://blog.virustotal.com/2011/12/moving-to-google-app-engine.html
lx07
Posted 2017-07-08T20:12:46.520
Reputation: 1 415
Based on VirusTotal own documentation they calculate the MD5, SHA1, and SHA256 checksum of a file. What information is used to calculate this checksum isn't provided. Without, that information, we would only be guessing at what VirusTotal uses to calculate the checksum of a file.
– Ramhound – 2017-07-08T20:16:48.813