[p0sx]

how does virsutotal scan a file in runtime or scantime ?

thx in advance

[sysopfb]

According to this
http://blog.virustotal.com/2012/07/viru ... ation.html

They use a cuckoo sandbox, I would imagine tweaked so they can generate their reports properly.

[voroojax]

scan is defenitfly static(scantime as you referred) but some samples get into cuckoo sandbox, but you should notice that cuckoo is not an AV, it's sandbox and show the dynamic activity.