> Absolutely true, but VirusTotal is only using hashing to determine if it's already scanned a particular file (and even if it has, you can still force a re-sca

> Absolutely true, but VirusTotal is only using hashing to determine if it's already scanned a particular file (and even if it has, you can still force a re-scan). Most of the individual AV engines have at least basic heuristics, so, for example, you can detonate a piece of malware in a VM, dump the memory, carve out the offending module[1], upload it to VirusTotal, and still get a positive hit. I was referring to the method they currently use, which is just matching hashes, not VirusTotal. No matter what, you need to somehow run the code through an antivirus at some point, so the files need to go up to the server or you need to run the AV locally.