Virus total can’t assure that theme\plugin is original.
Making such check is very theme\plugin specific so it’s just general advice.
First just check theme by theme name if it’s free or paid. Just google for it. Get to theme\plugin’s developers website and check what is latest version of this theme\plugin and check which version you have.
Then depending on theme\plugin – check if it has license key set up.
If you’ve found that your site using paid theme\plugin, ask your agency to provide you with keys which will allow updates later on.
Some Plugins like GravityForms offer only a per year licenses so you’ll have to renew it yourself probably.
Bad things for you if you have some plugin\theme nulled used are:
- you will not get updates,
- you may have a built into code security breaches\viruses\backdors injected by those who nulled it.
You can also try Wordfence wp plugin to check core and free plugins code for consistency wordpress.org/plugins/wordfence/ so their codes will not be different from the ones in wordpress.org repository. I’m not sure it will check premium\paid plugins\themes files but you can give it a try.
Also make a backup of your whole site before checking, making changes, so you’ll be able to rollback easily without data loss if something will go wrong. For example License may expire on some plugin and plugin will figure this out at time of your make a check.