Python implements a way to upload samples to virustotal and query the scan information
- 2020-04-02 14:11:42
- OfStack
This article illustrates the python implementation of uploading a sample to virustotal and querying the scan information. Share with you for your reference. Specific methods are as follows:
import simplejson
import urllib
import urllib2
import os
MD5 = "5248f774d2ee0a10936d0b1dc89107f1"
MD5 = "12fa5fb74201d9b6a14f63fbf9a81ff6" #do not have report on virustotal.com
########################################################################
APIKEY = "e0a50a50e77fxxxxxxxxxxxxxx4f17e31 Here use yourself in virustotal On the applied account number KEY"
class VirusTotal:
""""""
def __init__(self, md5):
"""Constructor"""
self._virus_dict = {}
self._md5 = md5
def repr(self):
return str(self._virus_dict)
def submit_md5(self, file_path):
import postfile
#submit the file
FILE_NAME = os.path.basename(file_path)
host = "www.virustotal.com"
selector = "https://www.virustotal.com/vtapi/v2/file/scan"
fields = [("apikey", APIKEY)]
file_to_send = open(file_path, "rb").read()
files = [("file", FILE_NAME, file_to_send)]
json = postfile.post_multipart(host, selector, fields, files)
print json
pass
def get_report_dict(self):
result_dict = {}
url = "https://www.virustotal.com/vtapi/v2/file/report"
parameters = {"resource": self._md5,
"apikey": APIKEY}
data = urllib.urlencode(parameters)
req = urllib2.Request(url, data)
response = urllib2.urlopen(req)
json = response.read()
response_dict = simplejson.loads(json)
if response_dict["response_code"]: #has result
scans_dict = response_dict.get("scans", {})
for anti_virus_comany, virus_name in scans_dict.iteritems():
if virus_name["detected"]:
self._virus_dict.setdefault(anti_virus_comany, virus_name["result"])
return self._virus_dict
The result returned is: {u'Sophos': u'Sus/ behav-1010 '}, if there are any scanned results..
The method is called as follows:
MD5 = "12fa5fb74201d9b6a14f63fbf9a81ff6" #do not have report on virustotal.com
MD5 = "5248f774d2ee0a10936d0b1dc89107f1"
FILE_PATH = r"D:backSample109af41bc012d66c98ca2f9c68ba38e98f_ICQLiteShell.dll"
from getVirusTotalInfo import VirusTotal
# Get the scan and print it out
virus_total = VirusTotal(MD5)
print virus_total.get_report_dict()
# Submit the file to the scan and you can follow this later MD5 Got the scan
virus_total.submit_md5(FILE_PATH)
I hope this article has helped you with your Python programming.