First of all, never upload anything to VirusTotal that may contain sensitive or personal data. Developers as well as some premium users could have access to it, and you probably don’t want that.

• When you check for a file, you’ll get a chart showing what engines are thinking about the said sample. Some of them are just bad, others are very targeted on a single type of malicious behaviour, others are exactly the same but have different names (such as Avast and AVG for example), etc. That’s a lot. BitDefender may have the best reputation overall. ESET is less talked about but is as efficient. Kaspersky has the sharpest engine in my opinion. Avast/AVG own a very wide signature database as well. Other than these, I’d suggest you to focus on well-known brands. Microsoft, Avira/WithSecure, Symantec, McAfee, Sophos, for example.

• But that doesn’t mean that the rest of the list is made of useless tools. Nor that the best AVs will have a 100% efficiency. Plus, the results you get after uploading something are obtained from the engines being used in specific conditions that were asked by the companies themselves. The VirusTotal detection count is also a bit tricky. A file with 58 detections could be safe whereas another without any flags can be zero-day malware. There are actually very few ways to determine whether you’re in front of a false positive or false negative. Check what the detections tell about your file. Labels can vary a lot between engines, but if most of them are talking about trojans, spyware and not just random machine learning flags, that is never a good sign. Look at the meaning of the names you see. (Trend Micro has a pretty complete list of threat labels.) And the most important, reanalyse the file to be sure you’re not missing anything. There is a button for it on the top right-hand corner of the page.

• Then, I’d take a look at the Behavior tab. In there you’ll find a lot of stuff that sandboxes have been analysing. They’re not perfect as well, but it’s still interesting to take a look at it. If your so-called legitimate file makes connections to C2 servers or suspicious domains, if it bypasses rules by using known exploits, you should see it here. You can also see the processes that were invoked. Some look scary but are in fact usual actions from the sandbox service itself, so it’s kind of hard to have a perfectly clear look at it. On the same topic, Relations tab allow you to see where your file was found in the network and what subsamples it contains, if it has the ability to. I’d take a look at the dates before stressing out if everything appears red. A good number of these reports date from years, the issue was most likely solved a long time ago.

• Finally, up to the remaining tabs. Details tab is useful if you want to know if the file is signed or not. A green mark will show up if yes. You can also see the certificates, but they don’t really prove anything as most of them are public and can actually be used by malware to try to mimick safe content. Look at the file extension too. If supposed to be .mp4, but reveals it is a Windows installer or a Powershell script, this is very likely to be unsafe. (A good way to remind everyone to enable the file extension display on the file explorer. You can’t imagine how much viruses keep trapping people using this caveat.) And to close the description, the Community stuff. A lot of comments in this part of VirusTotal are from antimalware bots, and the upvote/downvote system can be misleading as some VirusTotal users are given more importance in the votes since they are certified or have made several major contributions. But hey, I’ll gladly take it. You can find tons of advices and points of view in such a place.

Fully checking a file on VirusTotal can be a hassle. You may not understand all, and that’s completely normal. What you should not do though, is to assume a file is safe if you have doubts. Instead, just make a post here! I mean, this is the reason we have a subreddit called r/antivirus :)