Guide for VirusTotal

K, so first thing to check on a VT scan is that the last scan date is actually recent, if not, rerun the scan (new detections can be found and old false positives removed).

Then go to the details tab and have a look at the Creation Time, First Seen In The Wild, and First Submission. Creation Time isn't always reliable as it can be faked, but if it's obviously fake (e.g. 2099) then that should give you pause. As for the other two, if they're before the actual release date of a product (e.g. a game came out 2wks ago but it was first seen 3yrs ago) then it's probably some old recycled malware (assuming it's not a generic library file).

Next, look at the names it has been submitted as. Names that look like hashes or 'sample1.exe' can be ignored, but if it's appearing as 5 different names for 5 completely different products, then it's probably malware.

For pirated software, signatures won't be helpful as cracks or patched files won't be valid, but typically if there was an invalid signature it would be suspicious.

The relations tab won't always be available, but if it is then this can be useful.

Execution Parents/Resource Parents are installers or archives, things which contained, dropped, or downloaded the file you're scanning. If you're scanning an installer and you didn't extract it from another file, then this can be ignored, as typically what it's showing are fake installers - they drop the real installer, run it so the user isn't aware anything is wrong, and do their malicious crap in the background.

Dropped Files/Bundled Files shows you the files contained within the file you scanned, which are extracted when you run or open it. Particularly when scanning an archive file, looking at these results is more useful that those of the archive. VT plays nicer with .zip files, so if you have a .rar or something else, extract the files, then add them to a .zip and upload it instead. If you're dealing with any password protected archive file, .zip or not, do the same.

Contacted IP Addresses/URLs can be useful if the results are overwhelmingly malicious, but some of the AVs are overreactive and will mark anything it once heard a rumour about from it's dog walker's cousin's barber's sister (e.g. drive.google.com is currently flagged as a phishing site by one of them). If the file is meant to just be a keygen or patcher, and it's making requests, that's suspicious.

The behaviour tab is a lot more complex, but in simple terms files and keys being opened and read isn't particularly worrying, writing and deleting its own temp files isn't either, and obviously an installer is going to write to a few different places, but if it starts going where it doesn't need to be, that's suspicious.

Highlighted actions is rarely enlightening, but if you see something like 'all your files are belong to us', burn it with fire.

The community tab is typically a mess, but occasionally you find something of use.

Lastly, we go back to the detections tab. If they're pretty much all generic/gen/susgen (or essentially generic detections like W32.Trojan.Gen), or AI/ML (some AI/ML detections will use single word labels like 'malicious', 'suspicious', and 'unsafe'), and there's nothing specific, then it typically means they're detecting something which seems like malware, but it doesn't match any known malware. This is common for pirated software, as they use similar methods to malware (e.g. file packing, encryption, obfuscation, file injection).

Also common for cracks, patches, keygens, activators, etc. are the detections riskware, hacktool, and not-a-virus (the last one is specific to Kaspersky).

You should also keep in mind the age of the file (use First Seen In The Wild and First Submission for this), as something only a few hours to a few days old will likely not have many accurate detections, whereas anything over a few weeks should. Dealing with a 2yr old file like this, if it's just the above, it's probably fine.

If there are multiple similar specific detections, that's when you should be concerned.

As for this file, even after saying all that, the honest answer is I don't know. I'd lean heavily towards it being fine, but I wouldn't use it myself. It's a ~2yr old file with almost only generic and AI/ML detections, but the behaviour tab shows a weird 'important_document.exe' being run (though I've seen something similar before and it seemed like a sandbox reporting error rather than being real).

Hopefully that helps.

It's not as simple as 'if it has <5 detections it is probably fine'.