To @b in reply to #2335047, where you asked:
How would you check a webmail attachment against VirusTotal without downloading it?
by using webmail, it’s never downloaded to your device,(unless you wish to do so) it’s only visable in your online mail account, which can be checked via VT/ purged from therein.
I took that to mean that I could find an e-mailed document in my webmail and check it in VT without downloading it.
So this is what I did to check a document that I e-mailed to myself (to see how VirusTotal works):
Step 1: I found the document in my webmail, but I did not do anything to download it, but instead did Step 2.
Step 2: I clicked on the entry for the document and an URL showed up in the URL field of my Firefox browser.
Step 3: I pasted the URL into the URL search field in VirusTotal
Step 4: I viewed the results.
See attachments here for Steps 1 thru 4.
So, am seeing the results of checking the e-mail message, including the attached document, both of which have not been downloaded? or both of which HAVE been downloaded?
Or am I seeing the results of checking the e-mail message only which has not been downloaded? Or which HAS been downloaded?