diff --git a/CHANGELOG.md b/CHANGELOG.md
index 42df9d7711..c9b232ef52 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,8 @@
 - **sqlite:** Fix compatibility with Windows PowerShell ([#6045](https://github.com/ScoopInstaller/Scoop/issues/6045))
 - **install:** Expand `env_set` items before setting Environment Variables ([#6050](https://github.com/ScoopInstaller/Scoop/issues/6050))
 - **bucket:** Implement error handling for failed bucket addition ([#6051](https://github.com/ScoopInstaller/Scoop/issues/6051))
-- **install:** Fix parsing error when installing multiple apps w/ specific version ([#6039](https://github.com/ScoopInstaller/Scoop/pull/6039))
+- **scoop-virustotal:** Adjust `json_path` parameters to retrieve correct analysis stats ([#6044](https://github.com/ScoopInstaller/Scoop/issues/6044))
+- **install:** Fix parsing error when installing multiple apps w/ specific version ([#6039](https://github.com/ScoopInstaller/Scoop/issues/6039))
 
 ## [v0.5.0](https://github.com/ScoopInstaller/Scoop/compare/v0.4.2...v0.5.0) - 2024-07-01
 
diff --git a/libexec/scoop-virustotal.ps1 b/libexec/scoop-virustotal.ps1
index e1e7b9f75c..026712e9cc 100644
--- a/libexec/scoop-virustotal.ps1
+++ b/libexec/scoop-virustotal.ps1
@@ -102,14 +102,14 @@ Function Get-VirusTotalResultByHash ($hash, $url, $app) {
     $response = Invoke-WebRequest -Uri $api_url -Method GET -Headers $headers -UseBasicParsing
     $result = $response.Content
     $stats = json_path $result '$.data.attributes.last_analysis_stats'
-    [int]$malicious = json_path $stats '$.malicious'
-    [int]$suspicious = json_path $stats '$.suspicious'
-    [int]$timeout = json_path $stats '$.timeout'
-    [int]$undetected = json_path $stats '$.undetected'
+    [int]$malicious = json_path $stats '$[0].malicious' $null $false $true
+    [int]$suspicious = json_path $stats '$[0].suspicious' $null $false $true
+    [int]$timeout = json_path $stats '$[0].timeout' $null $false $true
+    [int]$undetected = json_path $stats '$[0].undetected' $null $false $true
     [int]$unsafe = $malicious + $suspicious
     [int]$total = $unsafe + $undetected
-    [int]$fileSize = json_path $result '$.data.attributes.size'
-    $report_hash = json_path $result '$.data.attributes.sha256'
+    [int]$fileSize = json_path $result '$.data.attributes.size' $null $false $true
+    $report_hash = json_path $result '$.data.attributes.sha256' $null $false $true
     $report_url = "https://www.virustotal.com/gui/file/$report_hash"
     if ($total -eq 0) {
         info "$app`: Analysis in progress."