python-上传样本到virustotal,查询扫描信息



import simplejson
import urllib
import urllib2
import os 

MD5 = "5248f774d2ee0a10936d0b1dc89107f1"
MD5 = "12fa5fb74201d9b6a14f63fbf9a81ff6"  #do not have report on virustotal.com


            
########################################################################
APIKEY = "e0a50a50e77fxxxxxxxxxxxxxx4f17e31  这里用你自己在virustotal上申请的账号的KEY"


class VirusTotal:
    """"""

    #----------------------------------------------------------------------
    def __init__(self, md5):
        """Constructor"""
        self._virus_dict = {}
        self._md5 = md5
        
        
    def repr(self):
        return str(self._virus_dict)
    
    def submit_md5(self, file_path):
        import postfile                                                                          
        #submit the file
        FILE_NAME =  os.path.basename(file_path) 
                           
                                                                                                 
        host = "www.virustotal.com"                                                              
        selector = "https://www.virustotal.com/vtapi/v2/file/scan"                               
        fields = [("apikey", APIKEY)]
        file_to_send = open(file_path, "rb").read()                                              
        files = [("file", FILE_NAME, file_to_send)]                                              
        json = postfile.post_multipart(host, selector, fields, files)                            
        print json
        pass
    
    def get_report_dict(self):
        result_dict = {}
        
        url = "https://www.virustotal.com/vtapi/v2/file/report"
        parameters = {"resource": self._md5,
                       "apikey": APIKEY}
        data = urllib.urlencode(parameters)
        req = urllib2.Request(url, data)
        response = urllib2.urlopen(req)
        json = response.read()
        
        response_dict = simplejson.loads(json)
        if response_dict["response_code"]: #has result 
            scans_dict = response_dict.get("scans", {})
            for anti_virus_comany, virus_name in scans_dict.iteritems():
                if virus_name["detected"]:
                    self._virus_dict.setdefault(anti_virus_comany, virus_name["result"])
        return self._virus_dict
            
        
        
        
    
    


返回的结果为:{u'Sophos': u'Sus/Behav-1010'},如果有扫描出的结果的话..


调用的方法:

MD5 = "12fa5fb74201d9b6a14f63fbf9a81ff6"  #do not have report on virustotal.com
MD5 = "5248f774d2ee0a10936d0b1dc89107f1"
FILE_PATH = r"D:\backSample\10\9af41bc012d66c98ca2f9c68ba38e98f_ICQLiteShell.dll"

from getVirusTotalInfo import VirusTotal
#得到扫描结果并打印出来
virus_total = VirusTotal(MD5)
print virus_total.get_report_dict()

#提交文件到扫描,以后就可以根据这个MD5取扫描结果了
virus_total.submit_md5(FILE_PATH)


  • 0
    点赞
  • 2
    收藏
    觉得还不错? 一键收藏
  • 3
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 3
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值