[_a9]

The URL scanner doesnt directly scan the file. It checks the URL against other web firewalls and returns stuff like the headers, chain, the sha256 hash of the body (which links to the actual file analysis https://www.virustotal.com/gui/url/9525d0fe32cebf7933bf84dcf...)

You can see and compare the different vendors of each. File analysis goes to all the antivirus' and does the sandbox stuff and the URL analysis goes to things like Google Safebrowsing, phishing check services, etc

tldr different systems for URL analysis (web firewall check) & file analysis (antivirus/sandbox check)

[nilslindemann]

Thx, seems we posted at the same time. AI confirms what you say.