OSI bean dip posted:

Are you suggesting that I send the files straight to VirusTotal every time? Because I could do that and then wait six years for it to scan through 1 TB of files.

All this script does is sends off a hash to VirusTotal to check through its history. If you upload a file to them and it has previously been seen, it'll inform you that it has seen the file before using the very same method but will then rescan the file if you request. It doesn't really do anything beyond that other saying "yes" or "no" to whether or not it has been seen before. It's not a definitive answer because the signatures can apply to multiple different hash results.

Also sending files to VirusTotal is dumb in a lot of ways for a number of reasons, but mainly this: the files get sent to a number of organisations (including the well-respected Italian company, Hacking Team) in which they'll analyse it as they desire. If you're okay with sharing proprietary files from your organisation, then send them straight to VirusTotal. It can however lead to some hilarious results as some of us can attest.