Hi and thanks for the review! :)
A few hours ago, after reading your review, I was checking out how VirusTotal worked and saw that it did some "double" encoding of the search in a way that was very cumbersome to reproduce in SSS, even using replacements in searchTerms.
So I decided to add a new function that mimics the usual URL encoding, which it seems to be using.
SSS version 3.33.0 is currently in review. It will possibly take a few days for Mozilla reviewers to take a look at it, but when it arrives you should be able to use this for VirusTotal:
NOTE: this does not work yet, only when version 3.33.0 is available.