VirusTotal Alternatives: Check a File Without Uploading It

The best VirusTotal alternative depends on what you can afford to share. For a SOC analyst the rule is hash first: compute the file's SHA-256 locally and search it on VirusTotal, Talos, MalwareBazaar or MetaDefender, which never see the file. Upload only public malware to a free sandbox, and never upload an internal document anywhere.

This guide sorts 20 tools into three groups by what they need from you: lookups that take a hash or URL, hosted sandboxes that run your file and usually publish it, and self-hosted tools where nothing leaves your machine. Every entry was checked on October 19, 2026 against its own site or repository.

How we picked and checked these tools

A tool made the list if a tier 1 or tier 2 analyst can use it during triage without a procurement cycle: free, or free for the use described. Each one was checked on October 19, 2026 against four questions:

1. What does it take as input? A hash, a URL, or the file itself.
2. Where does your submission go? Kept private, shared with vendors, or published. If the vendor's own pages do not say, the entry says so rather than guessing.
3. What is the free limit? Quotas, file size, run time and license terms, from the vendor's plan or FAQ page.
4. Is it maintained? For open source tools, the latest release or push date on the repository.

Intezer Analyze is left out. Its site now sells an AI SOC platform priced for enterprises and MSSPs, and we could not confirm that a free tier still exists.

VirusTotal alternatives at a glance

What VirusTotal does with your upload

VirusTotal's how it works page is direct about it: when you submit a file or URL, basic results are shared with the submitter and between the examining partners, and scanning reports are shared with the public VirusTotal community. That sharing is what pays for the free service, and it is why an internal file needs a tool that can answer without seeing it.

The free public API allows 500 requests a day at 4 a minute and must not be used in commercial products or in business workflows that do not contribute new files. Fine for a home lab; a corporate SOC enriching alerts automatically needs the paid tier or a different source.

Lookups that never need the file

These take a hash or a URL. Nothing about the file's contents leaves your network, which makes them the default first step for any attachment or download that lands in an alert.

VirusTotal by hash

Searching a SHA-256, SHA-1 or MD5 in the search bar, or calling the file report endpoint with your API key, returns the existing report if anyone has uploaded those bytes before. No upload happens. It is still the largest single source, so for most analysts the first alternative to uploading is a hash search on the same site.

Skip it if you need automated lookups at work and only have the public key. The terms above rule that out.

Talos File Reputation

Cisco Talos File Reputation takes a SHA-256 and returns a disposition, file name, a weighted reputation score when available, and detection information. Talos says the same reputation data feeds Cisco Secure Firewall, ClamAV and Snort. The page limits you to one lookup at a time and to hash matching only, so it is a second opinion, not a bulk tool.

Jotti's malware scan

Jotti has a "Search hash" tab next to its upload form, which is the part you want. The upload form takes up to 5 files at a time, 250 MB each, and Jotti states that all files are shared with anti-virus companies. Use the hash tab for anything that is not already public malware.

MetaDefender Cloud

MetaDefender Cloud from OPSWAT scans files, URLs, IPs and hashes with more than 20 antivirus engines, according to its home page. On privacy, OPSWAT's MetaDefender Cloud product page says the service processes files in temporary storage and removes them after analysis, and that the options which do not store your files in the cloud are commercial ones. On the free tier, a hash lookup is still the safe default for internal material.

MalwareBazaar

MalwareBazaar from abuse.ch is a sample-sharing database, so a hit comes with tags, a signature name and often the delivery method. Since June 30, 2025 its API needs a free Auth-Key, as the abuse.ch announcement set out; an unauthenticated query today returns Unauthorized. The FAQ caps sample downloads at 2,000 per IP address a day. It only knows samples someone shared, so a miss here is common and means little on its own.

LevelBlue OTX

Open Threat Exchange, now under the LevelBlue name after years as AlienVault OTX, lets you search an indicator against the threat intelligence its community shares. Its value is context rather than a verdict: what other researchers published next to that hash, domain or IP, which feeds straight into your IOC list.

Kaspersky Threat Intelligence Portal

The Kaspersky Threat Intelligence Portal describes itself as a way to scan files, domains, IP addresses and URLs. The pages we could read do not say what happens to an uploaded file, so use it for lookups.

Hybrid Analysis (search)

Hybrid Analysis is a free service built on CrowdStrike Falcon Sandbox. Its search covers hashes, IPs and domains against reports others have already generated, which is often enough to see the process tree of a known sample without detonating anything. It also accepts submissions, but we could not confirm from its public pages whether a free account can keep a submission private, so we list the search here and not the upload.

urlscan.io (for URLs)

For a suspicious link, urlscan.io is the URL counterpart of a hash lookup, with one difference: a scan makes urlscan visit the page. The free plan gives 50 private, 1,000 unlisted and 5,000 public scans a day. Unlisted scans are hidden from the public but visible to users of urlscan Pro, so use a private scan for anything that contains a recipient's email address or a session token. The phishing email analysis guide covers how to pull those links out of a message safely.

Sandboxes that run your file (and usually publish it)

A sandbox answers what a hash cannot: what the file does when it runs. On the free tiers below, the price is that your sample, and often the full report, becomes public. That is fine for a commodity sample already on MalwareBazaar. It is not fine for a document with a customer's name in it.

ANY.RUN Community

ANY.RUN is interactive: you click through the dialog boxes and installers in a live VM while it records the process tree and network traffic. The free Community plan gives a 60-second VM run, files up to 16 MB and a personal license, on Windows 7 and 10, Android and Ubuntu. Private analyses start at the paid Hunter plan, so everything on Community is public. You can also search public tasks for a family you are reading about, such as the infostealer in the RedLine Stealer breakdown, and study a run without detonating anything yourself.

Skip it if the sample needs more than a minute to show its behavior or the file is internal.

Joe Sandbox Cloud Basic

Joe Sandbox Cloud Basic is free for a single user and states it plainly: "Samples & results publicly shared". It includes two minutes of live interaction and a limited REST API. The same page gives two different numbers for the monthly analysis quota, so check your account rather than trusting either.

Triage

Triage, now presented as Recorded Future: Sandbox, runs files and URLs and extracts malware configurations for many families. Free accounts produce public reports. Use it for config extraction. A C2 address pulled from the sample's own config is a stronger indicator than a domain seen once in traffic.

MetaDefender Aether (formerly Filescan)

OPSWAT's sandbox, sold as MetaDefender Aether (previously OPSWAT Filescan Sandbox), still has a free community front end at filescan.io. OPSWAT describes it as an emulation-based sandbox that forces evasive code paths to execute. Privacy of community uploads is not stated on the pages we read.

Manalyzer

Manalyzer is free static analysis for Windows PE executables that flags undesirable behavior without running the file. The home page lists the hashes of the latest uploaded samples, which tells you uploads are visible to others.

VirSCAN

VirSCAN is a multi-engine scanner in the Jotti mold with a 100 MB file limit. Its site does not say how uploads are handled. Use it only for public samples.

Self-hosted: nothing leaves your machine

When the file is internal, or when you suspect a targeted attack and do not want to tip off the operator by publishing their sample, the analysis has to stay on your own hardware.

CAPE Sandbox

CAPE is a malware sandbox derived from Cuckoo, with payload and config extraction on top, and it is actively developed: the repository's last push was October 18, 2026. Many "free malware analysis tools" lists still recommend Cuckoo Sandbox itself, but that repository is archived and was last pushed on May 3, 2022. CAPE needs a dedicated host and real hypervisor setup, so plan for that before you promise it to your team.

REMnux

REMnux is a Linux toolkit of community malware analysis tools, available as a VM, an install on Ubuntu, or Docker images. It gives you a disposable analysis box where opening a suspicious archive cannot touch your workstation. If you are building one from scratch, the home lab guide covers the network isolation side.

capa

capa from Mandiant's FLARE team reads a PE, ELF, .NET module, shellcode or sandbox report and tells you what the program can probably do: that it looks like a backdoor, can install services or relies on HTTP to communicate, with findings mapped to ATT&CK where the rule carries it. Version 10.0.0 shipped on October 16, 2026. Apache-2.0.

FLOSS

FLOSS extracts and deobfuscates strings that a plain strings run misses, including stack strings and decoded strings. Version 3.2.0 shipped on October 16, 2026. Run it next to capa to look for C2 domains and file paths without detonating anything.

PEStudio

PEStudio is a Windows tool for static inspection of executables. The basic version is free for malware analysis in a private context only; the professional license costs 159 EUR per user per year. The basic version also retrieves the VirusTotal score, which means it sends the file's hash out. Run it offline if even the hash is sensitive.

A five-minute triage flow for a suspicious attachment

This is the order that keeps you from leaking anything you did not mean to.

1. Hash it where it sits. On Windows, Get-FileHash uses SHA-256 by default:

Get-FileHash -Path .\Remittance_0412.zip -Algorithm SHA256

On Linux or REMnux, sha256sum does the same:

sha256sum Remittance_0412.zip

2. Look up the hash. In the browser, or from a script with your own keys. Both calls below follow the vendors' documentation; without a key, VirusTotal answers AuthenticationRequiredError and MalwareBazaar answers Unauthorized:

# VirusTotal file report by hash (public API: 4/min, 500/day, non-commercial)
curl -s -H "x-apikey: $VT_API_KEY" \
  "https://www.virustotal.com/api/v3/files/$SHA256"
 
# MalwareBazaar lookup (free Auth-Key required since June 30, 2025)
curl -s -H "Auth-Key: $ABUSECH_AUTH_KEY" \
  -d "query=get_info&hash=$SHA256" \
  https://mb-api.abuse.ch/api/v1/

3. If it is an archive, hash what is inside too. Extract it in the REMnux VM, never on your workstation, and repeat steps 1 and 2 for each file.

4. Decide. A known-bad hit is enough to escalate and pivot on the threat intelligence attached to it. No hit on anything means you need behavior: detonate a public sample in a free sandbox, or anything internal in CAPE, and read the result with static tools like capa and FLOSS.

Here is what that looks like in a ticket:

# Simulated example generated by SOCSimulator Research
alert       MAIL-ATT-0412  attachment allowed by gateway, user opened it
recipient   l.ortega@corp.example
file        Remittance_0412_LOrtega.zip   sha256 9c4e...a71f   (container)
  lookup    VirusTotal hash      no report
  lookup    MalwareBazaar        hash_not_found
inner file  Remittance_0412.pdf.exe       sha256 52d0...0be3   (payload)
  lookup    VirusTotal hash      report exists, multiple engines detect
  lookup    MalwareBazaar        found, tagged as an infostealer
decision    escalate to tier 2, isolate host, block sender domain
upload      none. Container name carries the recipient's name; payload already public.

The container hash was unknown because the archive was built for this recipient, with her name in it. The payload inside had already been seen. An analyst who stopped at step 2 would have closed this as "no detections".

Five mistakes that leak data or miss malware

1. Treating "not found" as clean. Nobody can have a report for bytes nobody submitted. Phishing kits that build a document or archive per recipient produce a new hash every time, as in the example above.
2. Hashing only the container. ZIP, ISO and IMG wrappers change between waves; the payload inside is reused far more often. Hash both.
3. Uploading the "harmless" file to check it. If the file turns out clean, it was a real business document, and it is now in a public sandbox or with dozens of AV vendors. That is how a false positive becomes a data incident.
4. Choosing "unlisted" on urlscan as if it were private. Unlisted scans are visible to users of urlscan Pro. A phishing URL with the victim's email address in a parameter belongs in a private scan.
5. Assuming local tools stay local. PEStudio basic fetches the VirusTotal score for the file, which sends its hash out. Before you run any desktop tool on a file whose hash you cannot share, check whether it does online enrichment and turn that off.

Where this fits in the SOC workflow

Hash lookups belong in the first minutes of alert triage, right after you confirm the file actually reached the endpoint. Sandboxes and static tools come in when the lookup is empty and the alert still looks wrong. If your EDR already quarantined the file, the EDR vs antivirus vs XDR guide explains what a quarantine record does and does not tell you. For the rest of the analyst toolkit around these tools, see the SOC tools overview and, for proactive work, the threat hunting tools list, where VirusTotal sits in the enrichment layer.

The hard part of this flow is deciding, with a queue behind you, that "no detections" is not an answer. The phishing and malware operations in SOCSimulator put suspicious attachments in front of you inside a live SIEM, XDR and Firewall console, so you can practice that call where getting it wrong costs nothing.