Before you run anything suspicious, you need a layered approach: check the hash first, then detonate it in an isolated environment. The order matters.
Start With VirusTotal (Before Running Anything)
Never upload the file directly if it’s sensitive or proprietary. Instead, get its hash first and search that. Open PowerShell and run:
powershellGet-FileHash "C:\path\to\file.exe" -Algorithm SHA256
Paste that hash into virustotal.com. If the file has been seen before, you get instant results from 70+ AV engines without ever sending the actual file. A clean hash doesn’t guarantee safety (a brand-new file won’t have results), but a known clean hash is reassuring.
Reading the results honestly: A 3/72 or 5/72 detection score is almost always a false positive, especially for tools that interact with system internals. DLL injectors, game trainers, process monitors, and anything that hooks into Windows APIs will get flagged by heuristic engines. Defender Control from Sordum is a textbook example: it legitimately disables Windows Defender, which is exactly the kind of behavior AV heuristics scream about, but the tool itself is clean. When you see detections, click through to each one and check if they’re flagging a generic heuristic like HackTool, RiskWare, or PUA rather than a named threat. Named threats (e.g., Trojan.AgentTesla, Mirai.Botnet) are far more credible than generic labels.
Hash integrity check: If the developer published an official SHA-256 hash, compare yours against it. A mismatch means the file was tampered with during download or distribution, regardless of what VirusTotal says.
Windows Sandbox (Quick and Easy)
Windows Sandbox is a built-in, throwaway VM that Microsoft ships with Windows 10/11 Pro, Enterprise, and Education. It spins up in seconds and deletes everything the moment you close it. No traces, no leftovers.
Enable it through Turn Windows features on or off, check “Windows Sandbox”, and reboot. Then just drag your suspicious file in and run it. Requirements are minimal: virtualization enabled in BIOS, 4GB RAM minimum (8GB is better), and admin rights.
By default it has internet access, which is fine for general testing. If you want harder isolation, you can write a .wsb config file to disable networking:
xml<Configuration>
<Networking>Disable</Networking>
</Configuration>
Save it as test.wsb and double-click it to launch a network-isolated Sandbox. The big caveat: Sandbox uses a fixed Windows snapshot, so if malware is VM-aware or requires specific software to activate, it might just sit there and do nothing.
Virtual Machines for Deeper Analysis
For anything you want to actually study rather than just quickly test, a proper VM gives you much more control. VirtualBox is free and works well. The critical part is the network configuration.
Isolation levels, from least to most locked down:
- NAT (default): VM has full internet access. Fine for basic tests, bad for running confirmed malware.
- Host-Only: VM can only talk to your host machine. No internet, no LAN exposure.
- Internal Network: VMs can talk to each other but not to the host or internet. Best for multi-machine analysis setups.
- No adapter: Completely air-gapped. The safest option if you don’t need network behavior.
Always take a snapshot before running anything. After your test, roll back to the clean snapshot. This is the key workflow that makes VMs reusable. Also, disable shared clipboard and drag-and-drop between host and VM, because those are real escape vectors if something aggressive gets in.
When a VM Is Not Enough
Sophisticated malware increasingly detects virtual environments by checking for VM artifacts (VirtualBox guest additions, VMware registry keys, specific CPUID values, too-clean hardware fingerprints). When it detects a VM, it either does nothing or behaves differently than it would on a real machine. If you’re dealing with something that seems suspiciously inert inside a VM, that’s a red flag worth noting.
For that level of analysis, you either need to harden the VM to look like real hardware, or use a dedicated bare-metal test machine that you can wipe and reinstall. Cheap old laptops are perfect for this.
The Right Mindset
A detection on VirusTotal means “investigate further,” not “this is definitely malware.” Conversely, zero detections don’t mean a file is safe, just that no known signature matches it. The real question is always: what does this file actually do? Tools like Process Monitor, Process Hacker, and Wireshark (run inside the VM) will tell you more in two minutes of live observation than any static scan ever will. Watch what processes it spawns, what registry keys it touches, and what network connections it attempts. That behavior tells the real story.