VirustotalAPI
This python module help you check if the URL or file is malicious through Virustotal public API 2.0
you can get more infomation at https://www.virustotal.com/en/documentation/public-api/
To use this module you need to apply an account and get a public api key at https://www.virustotal.com/
Dependency
python requests
Installation
install by pip
pip install vtapi
install by git
cd /tmp
git clone https://github.com/z-sean-huang/VirustotalAPI.git
cd VirustotalAPI
python setup.py install
uninstall
pip uninstall vtapi
Usage
examples as command tool:
help
python vtapi.py --help [-h]
url report
python vtapi.py google.com
file report
python vtapi.py /bin/ping
or
python vtapi.py 7b36e9a3418f2c99de9652c0d87ea36dba3da7a2
examples as library:
import vtapi
vt = vtapi.VtApi("PUT YOUR VIRUSTOTAL PUBLIC KEY HERE")
# rating for url
print(vt.rating("google.com"))
# In this case, you shold get
# (0, "https://www.virustotal.com/en/url/cf4b367e49bf0b22041c6f065f4aa19f3cfe39c8d5abc0617343d1a66c6a26f5/analysis/")
# 0 means its detected number by virus scan engines
# the higher the detected number, the more likely malicious it is.
# get url scan report from virustotal
print(vt.rul_report("google.com"))
# rating for file
# for the privacy sake, I don't send any file to virustotal
# just query if there is the same file in virustotal
# you should keep in mind don't send any secret files to virustotal.
print(vt.rating("/PATH/TO/FILE"))
# rating by file's md5/sha1/sha256
# query by the hash, return none if it doesn't exist.
print(vt.rating("HASH_OF_FILE"))
# get file scan report from virustotal
print(vt.file_report("HASH_OF_FILE"))
