© 2025
For a while now, I've been noticing something about VirusTotal I don't see people talking about.
In 2023, I was on the hunt for a series of lost apps in the Madoka Fone series, something I've already talked about here before. I was having an incredibly hard time finding working download links for the core apps; any link to it, either to the app itself or even to its assets, were long dead. I eventually stumbled upon a Baidu Wangpan aggregator which listed the app. Shenanigans ensued and I did some increasingly ridiculous things in order to download the apps.
After getting some of the apps, I scanned them to VirusTotal as usual - this was a force of habit I developed back in 2020 as a precaution to downloading random APKs. The strangest thing happened however, the app had already been analyzed by the website several years prior to my discovery. This struck me as odd, as I could barely get a download of the apps myself.
This process repeated itself for several other apps I perceived to be so obscure they were practically lost media, particularly for apps that had been made by Aniplex and HeART BIT (recurring topics of this blog funny enough).
All of this is very important, because you can actually download files on VirusTotal, but only if you have VT Enterprise.
Example #1: Madoka Fone Madoka Ver.
https://www.virustotal.com/gui/file/ee981fd186bfb45e26cdea3fbad14162b057bbfa03b8538d1112d5712aad3257/details
First Submission: 2014-09-01 17:45:56 UTC
Last Submission: 2025-04-22 20:33:11 UTC
Last Analysis: 2019-01-28 11:39:16 UTC
This app was quite literally unavailable to the general public for at least 6+ years; it could've been found using VirusTotal API. I recovered the app in August 2023.
Example #2: Mami Tomoe Wallpaper app (Aniplex)
https://www.virustotal.com/gui/file/c134a9d851e7551ec4bb7cc817d12d2ed517736a8a791a6920891d0ef7c57ed4/details
First Submission: 2016-05-26 21:15:47 UTC
Last Submission: 2024-04-28 03:00:40 UTC
Last Analysis: 2024-04-28 03:00:40 UTC
This app took me almost a week of searching to discover. I have never seen any dead download links for this app even; there were zero known mentions of this app on the western side of the Internet before I started rambling about it. And curiously, the file has been on VirusTotal since 2016.
Example #3: XR City's release version
The oldest publicly available version of the XR City app is version 02.00.00009 (internal version: 21).
https://apkpure.com/xr-city‐新感覚街あそびアプリ/com.nttdocomo.android.xrcity/versions
https://apkpure.com/xr-city‐新感覚街あそびアプリ/com.nttdocomo.android.xrcity/download/02.00.00009
https://www.virustotal.com/gui/file/40fe430e0ada4780327193a9367f98e6da47bb54642931e2b1ec8d8bdf7d8b79/details
Earlier today, I managed to download the oldest actual version of XR City (internal version: 3), which by all means, was completely lost media prior to today; and yet it has been on VirusTotal since 2023.
https://www.virustotal.com/gui/file/2fe70f40c1ecc13a492d9fcd9cf3425f8e8e15f1866d8b9c99bb4a4b06ab4561/details
First Submission: 2023-01-23 23:50:37 UTC
Last Submission: 2025-12-23 00:01:11 UTC (this was me)
Last Analysis: 2023-01-23 23:50:37 UTC
This would be very useful to lost media hunters, particularly of software. However there is a big problem when it comes to using VirusTotal. Every feature needed is locked behind VT Enterprise, which according to some sources (cough cough Reddit) costs anywhere from $10K to $150K a year.
Here are some of the search filters that could be used for lost media hunting. If you happen to have VT Enterprise, go wild: https://gtidocs.virustotal.com/docs/full-list-of-google-threat-intelligence-search-modifiers
© 2025