How to Scan Downloads for Malware Before Opening Them

Checking a file for viruses before you run it is straightforward with the right tools. The most reliable approach layers a few quick checks: scan the download URL before fetching the file, use VirusTotal or Windows Defender to scan the file itself, and verify the publisher’s digital signature. No single check is foolproof, but combining two or three takes under two minutes and eliminates the most common threats.

This guide covers every practical method, in order of how early in the process you can apply them.

Step 1: Scan the Download URL Before You Click

You can check a URL for known malware before downloading anything from it. This catches the most common threat: fake download pages that impersonate legitimate software or sites distributing known malicious installers.

• VirusTotal URL scan: go to virustotal.com, click the URL tab, and paste the full download link. VirusTotal checks it against 90+ security engines and URL databases. Known malware distribution sites and phishing pages show up here. Results in seconds.
• Google Safe Browsing: you can check any URL at safebrowsing.google.com/safebrowsing/report_badware or use Google’s Transparency Report site checker (transparencyreport.google.com/safe-browsing/search). Chrome, Firefox, and Edge already query Safe Browsing in the background during every page load, so if the site itself is flagged you will see a red warning page before you even see the download button.
• URLhaus: ch runs URLhaus (urlhaus.abuse.ch), a database of URLs actively distributing malware. More technical, but useful for checking unfamiliar file-hosting domains.

The most effective pre-download check costs zero time if you are already in a browser: look at the domain in the address bar. A download page at zoom.us is different from one at zoom-downloads.net. Checking the URL takes a second; recovering from malware takes hours.

Step 2: Search VirusTotal by Hash (No Upload Required)

If the software’s download page publishes a SHA-256 checksum alongside the download link, you can check that hash against VirusTotal’s database before downloading the file at all. VirusTotal has scanned billions of files. If the exact binary you are about to download has ever been submitted to VirusTotal, the results are already there.

At virustotal.com, paste the SHA-256 hash into the search box. If the file has been scanned before, you get the full engine results instantly, with no file upload needed and no sending of the actual file to a third party.

If the hash returns no results, the file has not been scanned yet. That is common for freshly released software. It does not mean the file is malicious, just that you need to do the local scan after downloading.

Step 3: Upload the File to VirusTotal

VirusTotal scans uploaded files with over 70 antivirus engines simultaneously and returns results in under a minute for most files. This is the most comprehensive free scanning option available.

Go to virustotal.com, click Choose file, select the downloaded file, and wait for the results page. The key number is the detection ratio: how many engines flagged the file as malicious out of the total that scanned it.

Reading VirusTotal results correctly

• 0 detections: no engine flagged the file. Strong signal that it is clean, particularly for established software that has been in circulation long enough for engines to have catalogued it.
• 1 to 2 detections from obscure engines: likely a false positive. Some low-tier engines flag files aggressively. Check whether the detecting engines are names you recognize (Kaspersky, Microsoft, Bitdefender, ESET, Sophos) or unfamiliar ones. A single detection from an engine named something like ‘Zoner’ or ‘VBA32’ while 70 others show clean is typically noise.
• 3 to 5 detections including from major engines: take seriously. Research what the detections say. ‘PUA’ (Potentially Unwanted Application) labels from major engines often flag legitimate software with aggressive update mechanisms; ‘Trojan’ or ‘Backdoor’ labels are a different matter.
• 5 or more detections, especially from multiple major engines: do not run the file. This is almost certainly malicious.

VirusTotal results are public. When you upload a file, other researchers and analysts can see it. Do not upload files containing confidential data, source code, private documents, or internal business files. For those, scan locally with Windows Defender or a local AV tool.

Step 4: Scan With Windows Defender Before Running

Windows Defender (now called Microsoft Defender Antivirus) is built into every Windows 10 and 11 installation. It scans downloads automatically in the background, but you can trigger an explicit on-demand scan before opening a file.

Right-click the downloaded file in File Explorer and select ‘Scan with Microsoft Defender.’ Defender scans the file against its current definition database and returns a result. If no threat is found, the dialog confirms it. This takes a few seconds for most files.

For automated or scripted scanning, Defender’s command-line tool provides the same capability:

Step 5: Verify the Publisher Signature

Antivirus scanning and the publisher’s digital signature answer different questions. Virus scanning asks: do I recognize this as malware? The Authenticode signature asks: who made this, and has it been modified?

On Windows, right-click the downloaded file, select Properties, and look for the Digital Signatures tab. If it is present, click on the listed signature and select Details. The signer name should match the organization you expected to download from. If the signer is ‘Microsoft Corporation’ for a Microsoft product, or ‘Zoom Video Communications, Inc.’ for a Zoom installer, that is a good sign. If it shows ‘Unknown Publisher’ or a company name you don’t recognize for software you expected from a known publisher, that is worth investigating.

A valid signature with the expected publisher name means: this file was produced by that verified organization and has not been changed since they signed it. Combined with a clean VirusTotal scan, this combination covers both the content-based and identity-based verification angles.

Step 6 (Optional): Behavioral Analysis in a Sandbox

Signature-based scanning like VirusTotal and Defender works by recognizing known malware. A brand-new piece of malware that hasn’t been seen before passes these checks. Sandbox analysis provides a different signal: instead of asking whether the file is known to be malicious, it runs the file in an isolated virtual environment and observes what it actually does.

• run (app.any.run): an interactive online sandbox. Upload the file or provide a URL. The sandbox runs the file, shows you the network connections it makes, files it creates or modifies, registry changes, and processes it spawns. Suspicious behavior like connecting to unusual IP addresses, creating files in system directories, or spawning cmd.exe is visible in the analysis.
• Hybrid Analysis (hybrid-analysis.com): a free service that runs files in multiple environments and provides detailed behavioral reports. Particularly thorough for Windows executables.
• Windows Sandbox (built into Windows 10/11 Pro and Enterprise): a local isolated environment. Enable it in Windows Features, launch Windows Sandbox, copy the file into it, and run it. Anything the file does is contained to the sandbox and disappears when you close it. No internet submission required.

Sandbox analysis is most valuable for files from unfamiliar sources where VirusTotal shows a clean result but something still feels off about the source. It requires more time than the earlier steps (a few minutes versus a few seconds) and is not necessary for established software from official sources that passes hash verification and signature checks.

What Virus Scanning Cannot Catch

Every scanning method has limits worth understanding:

• Zero-day and freshly compiled malware: malware written and compiled in the last 24 hours has not been catalogued. Signature-based scanners, including VirusTotal’s 70+ engines, will show zero detections. Behavioral sandbox analysis provides the best coverage here.
• Heavily obfuscated or packed files: malware authors use packers and obfuscators to disguise malicious code from static analysis. The packed outer shell looks harmless; the malicious code is only unpacked at runtime. Behavioral analysis catches this where static scanning doesn’t.
• Legitimately signed malware: in rare cases, malware is distributed with a valid code signing certificate, either from a compromised legitimate publisher or from a fraudulently obtained certificate. A valid Authenticode signature from a name you don’t recognize, or from a name that sounds plausible but doesn’t match the actual publisher you intended to download from, warrants extra caution.
• Safe content from unsafe intent: VirusTotal scans the file’s code. It doesn’t evaluate whether the application does things you wouldn’t want (excessive telemetry, aggressive update mechanisms, terms that grant access to your files). These are judgment calls the scanner cannot make.

Quick Comparison: Which Check to Use When

Frequently Asked Questions

If VirusTotal shows 0 detections, is the file definitely safe?

Not definitively, but it is a strong signal for established software. VirusTotal’s database covers an enormous range of known malware, and zero detections from 70+ engines makes known malware very unlikely. The gap is new or targeted malware that hasn’t been catalogued yet. For software from well-known publishers distributed through official channels, 0 detections combined with a valid Authenticode signature from the expected publisher is reliable assurance. For software from unfamiliar sources, zero detections is reassuring but sandbox analysis provides additional coverage.

My antivirus flagged a file that seems legitimate. Is it malware?

Possibly not. False positives are common, particularly for newly released software, software that uses packaging tools that resemble malware patterns, and utilities that interact with system internals in ways that trigger heuristic rules. Check VirusTotal: if only one or two engines flag it while 68 others show clean, and the detecting engines are not major names, it is likely a false positive. Check whether the file has a valid Authenticode signature from the developer. If multiple major engines flag it, treat it as genuinely suspicious until you can verify from the developer’s official channels.

Is there a way to check a file without uploading it anywhere?

Yes. Windows Defender’s on-demand scan (right-click > Scan with Microsoft Defender, or MpCmdRun.exe) scans locally without submitting the file externally. If you have the file’s published SHA-256 hash from the developer’s download page, searching that hash on VirusTotal shows any previous scan results without uploading the file. Windows Sandbox lets you run a file in an isolated local environment and observe its behavior without any network submission. These options cover most cases where privacy or confidentiality prevents external upload.

Gloria Bradford

Gloria Bradford is a renowned expert in the field of encryption, widely recognized for her pioneering work in safeguarding digital information and communication. With a career spanning over two decades, she has played a pivotal role in shaping the landscape of cybersecurity and data protection.

Throughout her illustrious career, Gloria has occupied key roles in both private industry and government agencies. Her expertise has been instrumental in developing state-of-the-art encryption and code signing technologies that have fortified digital fortresses against the relentless tide of cyber threats.