https://www.veil-framework.com/component---src-components-page-tem…heck-virustotal-mdx-fb3709f50c82b7d50955.js

1"use strict";(self.webpackChunkveil_framework=self.webpackChunkveil_framework||[]).push([[3652],{7304:function(e,t,n){n.d(t,{A:function(){return r}});var a=n(6540);function l({href:e,children:t,className:n,...l}){return a.createElement("a",Object.assign({href:e,target:"_blank",rel:"sponsored nofollow noopener",className:n},l),t)}function r(){const e="/veil-recommends/infosec-fundamentals";return a.createElement("aside",{className:"fc-wrap","aria-label":"Recommended course"},a.createElement("div",{className:"fc-header"},a.createElement("span",{className:"fc-dot fc-dot-r","aria-hidden":"true"}),a.createElement("span",{className:"fc-dot fc-dot-a","aria-hidden":"true"}),a.createElement("span",{className:"fc-dot fc-dot-g","aria-hidden":"true"}),a.createElement("span",{className:"fc-header-label"},"course_spotlight.sh")),a.createElement(l,{href:e,className:"fc-image-link","aria-label":"View Information Security Fundamentals course"},a.createElement("img",{src:"/img/hero/infosec-fundamentals.webp",alt:"Information Security Fundamentals course cover",className:"fc-image",loading:"lazy",width:"300",height:"169"})),a.createElement("div",{className:"fc-body"},a.createElement("div",{className:"fc-tag"},"Recommended Course"),a.createElement("h3",{className:"fc-title"},a.createElement(l,{href:e,className:"fc-title-link"},"Information Security Fundamentals")),a.createElement("p",{className:"fc-desc"},"Build a solid foundation in cybersecurity. Covers network fundamentals, common attack vectors, defensive controls, and the mindset needed for security research."),a.createElement("ul",{className:"fc-features"},a.createElement("li",{className:"fc-feature"},a.createElement("span",{className:"fc-feature-icon","aria-hidden":"true"},"▸"),"Beginner-friendly — no prior experience needed"),a.createElement("li",{className:"fc-feature"},a.createElement("span",{className:"fc-feature-icon","aria-hidden":"true"},"▸"),"Network attacks & defences"),a.createElement("li",{className:"fc-feature"},a.createElement("span",{className:"fc-feature-icon","aria-hidden":"true"},"▸"),"Real-world security concepts")),a.createElement(l,{href:e,className:"fc-cta"},"View Course",a.createElement("span",{className:"fc-cta-arrow","aria-hidden":"true"}," →")),a.createElement("p",{className:"fc-disclosure"},"We may earn a commission if you enrol via our link, at no extra cost to you.")))}},7566:function(e,t,n){n.r(t),n.d(t,{Head:function(){return f},default:function(){return p}});var a=n(8453),l=n(6540);function r(e){const t=Object.assign({h1:"h1",p:"p",h2:"h2",h3:"h3",ul:"ul",li:"li",strong:"strong",a:"a"},(0,a.RP)(),e.components);return l.createElement(l.Fragment,null,l.createElement(t.h1,null,"How to Safely Check Veil Payloads Against VirusTotal"),"\n",l.createElement(t.p,null,'One of the most common questions from teams running evasion tests is: "Should I upload the payload to VirusTotal?" The answer is nuanced. VirusTotal is a valuable tool for understanding detection coverage, but using it carelessly can compromise your testing methodology and share intelligence with the broader AV community — which may not align with your testing goals.'),"\n",l.createElement(t.p,null,"This guide covers the principles of safe payload analysis, when and how to use scanning services responsibly, and the operational considerations that matter for structured testing programs."),"\n",l.createElement(t.h2,null,"The Core Problem"),"\n",l.createElement(t.p,null,"VirusTotal aggregates results from dozens of antivirus engines and shares submitted samples with participating vendors. When you upload a file, it becomes part of a shared dataset. For research samples and known malware, this is fine. For payloads generated during a specific engagement or testing exercise, the implications are different."),"\n",l.createElement(t.p,null,'If you are testing whether your organization\'s defenses detect a particular evasion technique, uploading the payload to VirusTotal effectively shares it with every AV vendor. Their detection will improve — not because your defenses got better, but because the sample entered the vendor ecosystem. Your next test with the same technique will show better "detection rates" that have nothing to do with your own controls.'),"\n",l.createElement(t.h2,null,"Safe Analysis Principles"),"\n",l.createElement(t.h3,null,"Use Isolated Environments"),"\n",l.createElement(t.p,null,"Perform analysis in environments that do not leak data:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,"Air-gapped VMs with no internet access for initial behavioral analysis"),"\n",l.createElement(t.li,null,"Snapshot your analysis VM before each session and revert afterward"),"\n",l.createElement(t.li,null,"Use network monitoring on the analysis host to verify no unintended outbound connections"),"\n"),"\n",l.createElement(t.h3,null,"Understand What You Are Measuring"),"\n",l.createElement(t.p,null,"Be clear about what question you are trying to answer:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,l.createElement(t.strong,null,'"Does my organization\'s specific AV detect this?"')," → Test against your deployed product in your lab. Do not upload to VirusTotal."),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,'"What is the broader industry detection rate for this technique?"')," → VirusTotal is appropriate, but understand the consequences."),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,'"Is this payload s

1afe to analyze?"')," → Static analysis and sandboxed dynamic analysis first, before any network-connected scanning."),"\n"),"\n",l.createElement(t.h3,null,"Hash-Based Lookups First"),"\n",l.createElement(t.p,null,"Before uploading any file, check the hash against VirusTotal's existing database. If the hash is already known, you get detection information without contributing a new sample. This is the safest approach for routine checks."),"\n",l.createElement(t.h2,null,"When Not to Upload"),"\n",l.createElement(t.p,null,"Do not upload payloads to scanning services when:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,"The payload was generated for a specific client engagement (operational security)"),"\n",l.createElement(t.li,null,"You are measuring your own detection capabilities (the upload skews results)"),"\n",l.createElement(t.li,null,"The payload contains environment-specific configuration (IP addresses, domain names, credentials)"),"\n",l.createElement(t.li,null,"You are in the middle of a red team exercise (sharing samples mid-engagement is a critical operational error)"),"\n"),"\n",l.createElement(t.h2,null,"Responsible Handling Guidance"),"\n",l.createElement(t.p,null,"For comprehensive guidance on safely handling potentially malicious files in research and testing contexts, ",l.createElement(t.a,{href:"https://www.cisa.gov/resources-tools/resources/malware-analysis-report-guidance"},"CISA's malware analysis resources")," provide authoritative recommendations on isolated analysis environments, evidence handling, and safe practices that complement the operational considerations discussed here."),"\n",l.createElement(t.h2,null,"Building an Internal Analysis Capability"),"\n",l.createElement(t.p,null,"Rather than relying on external services, consider building internal analysis capacity:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Static analysis tools")," — File format parsers, string extractors, disassemblers for examining payload structure"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Sandboxed execution")," — Automated malware sandboxes (Cuckoo, CAPE, or commercial alternatives) that run samples in instrumented VMs"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"YARA rules")," — Custom detection signatures that you control and that do not leak intelligence externally"),"\n"),"\n",l.createElement(t.p,null,"This approach keeps your analysis internal while still providing detection rate data against your own rules and signatures."),"\n",l.createElement(t.h2,null,"Related"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/framework/veil-evasion/"},"Veil-Evasion"))," — Payload generation module"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/honor-amongst-thieves-building-trust-in-veil-evasion-payloads/"},"Trust in Evasion Payloads"))," — Integrity and supply-chain considerations"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/framework/"},"Framework Overview"))," — Where payload analysis fits in the testing lifecycle"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/guides/"},"Guides"))," — All available guides"),"\n"))}var s=function(e={}){const{wrapper:t}=Object.assign({},(0,a.RP)(),e.components);return t?l.createElement(t,e,l.createElement(r,e)):r(e)},i=n(9329),o=n(1744),c=n(8963),m=n(8752),u=n(7304);function d(e){if(!e)return null;try{return new Intl.DateTimeFormat("en-GB",{day:"numeric",month:"long",year:"numeric",timeZone:"UTC"}).format(new Date(e))}catch{return null}}function h({pageContext:e,children:t}){const{frontmatter:n}=e,a=(null==n?void 0:n.title)||"",r=(null==n?void 0:n.description)||"",s=(null==n?void 0:n.slug)||"",o=(null==n?void 0:n.heroImage)||null,h=(null==n?void 0:n.date)||null,p=(null==n?void 0:n.lastmod)||null,f=d(h),g=p&&p!==h?d(p):null;return l.createElement(i.A,null,o&&l.createElement(c.A,{title:a,subtitle:r,backgroundImage:o}),l.createElement("article",{className:"page-content"},l.createElement("div",{className:"container"},f&&l.createElement("p",{className:"post-meta"},l.createElement("time",{dateTime:h},"Published ",f),g&&l.createElement(l.Fragment,null," · ",l.createElement("time",{dateTime:p}

1,"Updated ",g))),l.createElement("div",{className:"post-layout-grid"},l.createElement("div",{className:"post-main"},t),l.createElement("aside",{className:"post-sidebar","aria-label":"Sidebar"},l.createElement("div",{className:"post-sidebar-scroll"},l.createElement(u.A),l.createElement(m.A,{sourceUrl:s})))))))}function p(e){return l.createElement(h,e,l.createElement(s,e))}function f({pageContext:e}){const{frontmatter:t}=e,n=null!=t&&t.heroImage?`https://www.veil-framework.com${t.heroImage}`:null;return l.createElement(o.A,{title:null==t?void 0:t.title,description:null==t?void 0:t.description,pathname:null==t?void 0:t.slug},(null==t?void 0:t.date)&&l.createElement("meta",{property:"article:published_time",content:t.date}),(null==t?void 0:t.lastmod)&&l.createElement("meta",{property:"article:modified_time",content:t.lastmod}),n&&l.createElement("meta",{property:"og:image",content:n}),n&&l.createElement("meta",{name:"twitter:image",content:n}))}},8453:function(e,t,n){n.d(t,{RP:function(){return r}});var a=n(6540);const l=a.createContext({});function r(e){const t=a.useContext(l);return a.useMemo(()=>"function"==typeof e?e(t):{...t,...e},[t,e])}},8752:function(e,t,n){n.d(t,{A:function(){return l}});var a=n(6540);function l({sourceUrl:e}){const{0:t,1:n}=(0,a.useState)("idle"),{0:l,1:r}=(0,a.useState)("");return a.createElement("aside",{className:"nl-sw-wrap","aria-label":"Newsletter signup"},a.createElement("div",{className:"nl-sw-header"},a.createElement("span",{className:"nl-sw-dot nl-sw-dot-r","aria-hidden":"true"}),a.createElement("span",{className:"nl-sw-dot nl-sw-dot-a","aria-hidden":"true"}),a.createElement("span",{className:"nl-sw-dot nl-sw-dot-g","aria-hidden":"true"}),a.createElement("span",{className:"nl-sw-title"},"intel_feed.sh")),a.createElement("div",{className:"nl-sw-body"},a.createElement("p",{className:"nl-sw-prompt"},a.createElement("span",{className:"nl-sw-caret","aria-hidden":"true"},"$")," ","subscribe --to evasion-intel"),a.createElement("h3",{className:"nl-sw-heading"},"Stay ahead of the curve"),a.createElement("p",{className:"nl-sw-desc"},"AV bypass techniques, detection gaps, and lab-tested research — delivered before the mainstream catches up."),"done"===t?a.createElement("div",{className:"nl-sw-success",role:"status"},a.createElement("span",{className:"nl-sw-check","aria-hidden":"true"},"✓"),a.createElement("div",null,a.createElement("strong",null,"Subscribed."),a.createElement("br",null),a.createElement("span",{className:"nl-sw-success-sub"},"Confirm your email to activate."))):a.createElement("form",{onSubmit:async function(e){e.preventDefault();const t=e.currentTarget,a=new FormData(t);if(!a.get("company")){n("loading"),r("");try{const e=await fetch("/api/subscribe",{method:"POST",body:a}),l=await e.json();l.success?(n("done"),t.reset()):(n("err"),r(l.error||"Something went wrong."))}catch{n("err"),r("Network error — please try again.")}}},className:"nl-sw-form",noValidate:!0},a.createElement("input",{type:"hidden",name:"site",value:"veil-framework"}),a.createElement("input",{type:"hidden",name:"source_url",value:e||""}),a.createElement("input",{type:"text",name:"company",tabIndex:"-1","aria-hidden":"true",className:"nl-sw-hp",autoComplete:"off"}),a.createElement("label",{htmlFor:"nl-sw-name",className:"nl-sw-label"},"Your name"),a.createElement("input",{id:"nl-sw-name",type:"text",name:"name",placeholder:"alias or handle",required:!0,autoComplete:"given-name",className:"nl-sw-input",disabled:"loading"===t}),a.createElement("label",{htmlFor:"nl-sw-email",className:"nl-sw-label"},"Email address"),a.createElement("input",{id:"nl-sw-email",type:"email",name:"email",placeholder:"[email protected]",required:!0,autoComplete:"email",className:"nl-sw-input",disabled:"loading"===t}),"err"===t&&a.createElement("p",{className:"nl-sw-error",role:"alert"},l),a.createElement("button",{type:"submit",className:"nl-sw-btn",disabled:"loading"===t},"loading"===t?"Connecting…":"Subscribe to intel →"),a.createElement("p",{className:"nl-sw-legal"},"No spam. No vendor fluff. Unsubscribe any time."))))}},8963:function(e,t,n){n.d(t,{A:function(){return l}});var a=n(6540);

1function l({title:e,subtitle:t,primaryLink:n,primaryText:l,secondaryLink:r,secondaryText:s,backgroundImage:i}){const o=i?{backgroundImage:`linear-gradient(135deg, rgba(37, 99, 235, 0.85) 0%, rgba(13, 33, 55, 0.9) 100%), url(${i})`,backgroundSize:"cover",backgroundPosition:"center"}:{};return a.createElement("section",{className:"hero blueprint-section-subtle",style:o},a.createElement("div",{className:"container"},a.createElement("h1",null,e),t&&a.createElement("p",null,t),(n||r)&&a.createElement("div",{style:{display:"flex",gap:"var(--space-md)",flexWrap:"wrap"}},n&&a.createElement("a",{href:n,className:"btn btn-primary"},l||"Get Started"),r&&a.createElement("a",{href:r,className:"btn btn-outline"},s||"Learn More"))))}}}]);
2//# sourceMappingURL=component---src-components-page-template-jsx-content-file-path-content-posts-safely-check-virustotal-mdx-fb3709f50c82b7d50955.js.map