### Python Example: Get IoCs in STIX Format Source: https://gtidocs.virustotal.com/reference/threat-profile_download-url Python example that requests a download URL for STIX format and then downloads the export using the obtained URL. ```python import requests id = "dc2f47a9baa2460089cdd78f7339b19c" format = "stix" url = f"https://www.virustotal.com/api/v3/threat_profiles/{id}/download_url/{format}" headers = {"x-apikey": ,"accept": "application/json"} response = requests.get(url, headers=headers) response = requests.get(response.json()["data"], headers=headers) ``` -------------------------------- ### Example response for GET /intelligence/hunting_rulesets Source: https://gtidocs.virustotal.com/reference/list-hunting-rulesets Example response from the Get Livehunt rulesets endpoint. Shows the structure of a hunting_ruleset object and the pagination links that point to /users/{user}/hunting_rulesets. ```json { "data": [ { "type": "hunting_ruleset", "id": "{id}", "links": { "self": "https://www.virustotal.com/api/v3/intelligence/hunting_rulesets/{id}" }, "attributes": { "creation_date": 1523635880, "enabled": true, "limit": 1000, "modification_date": 1525263069, "name": "foo", "notification_emails": [], "rules": "rule foo {condition: false}" } }, { .. ruleset 2 .. }, { .. ruleset 3 .. }, { .. ruleset 4 .. }, ], "meta": { "cursor": "Cu0FCsACCpIC9xuRl9v..." }, "links": { "self": "https://www.virustotal.com/api/v3/users/{user}/hunting_rulesets", "next": "https://www.virustotal.com/api/v3/users/{user}/hunting_rulesets?cursor=Cu0FCsACCpIC9xuRl9v..." } } ``` -------------------------------- ### dmg_info concrete example Source: https://gtidocs.virustotal.com/reference/file-object-dmg-info Shows a real-world example of dmg_info with actual values, including a partition entry and HFS info_plist with bundle details. ```json { "data": { "attributes": { "dmg_info": { "blkx": [ { "attributes": "0x0050", "name": "whole disk (Apple_HFS : 0)" } ], "data_fork_length": 2811866, "data_fork_offset": 0, "dmg_version": 4, "gpt": { "alternate_lba": 1, "disk_uuid": "453d595d-a580-455c-8158-5d5850f54579", "entries_crc32": 3948022686, "entries_lba": 16414, "first_usable_lba": 34, "header_crc32": 1111275827, "last_usable_lba": 16413, "my_lba": 16446, "number_of_entries": 128, "partitions": [ { "attrs_flags": 0, "ending_lba": 16407, "name": "disk image", "starting_lba": 40, "type_guid": "48455350-0500-51aa-5a11-50356545ecac", "unique_guid": "e5005611-561f-45b6-5659-845651f5f2" } ], "revision": "0x100", "signature": "EFI PART", "size": 92, "size_of_entry": 128 }, "hfs": { "info_plist": { "BuildMachineOSBuild": "18G5033", "CFBundleDevelopmentRegion": "English", "CFBundleExecutable": "Blablabla", "CFBundleHelpBookFolder": "help", "CFBundleHelpBookName": "BLablabla blablabla blablabla", "CFBundleIconFile": "app.icns", "CFBundleIdentifier": "com.nchsoftware.blablabla-free", "CFBundleInfoDictionaryVersion": "6.0", "CFBundleLongVersionString": "8.14, Copyright BBB Software", "CFBundleName": "Blablabla", "CFBundlePackageType": "APPL", "CFBundleShortVersionString": "8.14", "CFBundleSignature": "bbbbb", "CFBundleSupportedPlatforms": "['MacOSX']", "CFBundleVersion": "8.14", "CFExecutableName": "Blablabla", "CSResourcesFileMapped": "True", "DTCompiler": "com.apple.compilers.llvm.clang.1_0", "DTPlatformBuild": "11C504" } } } } } } ``` -------------------------------- ### Example response with MITRE ATT&CK techniques Source: https://gtidocs.virustotal.com/reference/get-summary-all-mitre-attack-techniques-observed-in-a-file Example response from the endpoint showing a 'data' object with sandbox names like 'VirusTotal Observer' and 'Zenbox', each containing a 'tactics' array. The example includes a tactic with a technique and its signature, demonstrating the structure. ```json { "data": { "VirusTotal Observer": { "tactics": [] }, "Zenbox": { "tactics": [ { "description": "The adversary is trying to figure out your environment.\n\nDiscovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used towards this post-compromise information-gathering objective. ", "techniques": [ { "description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\nTools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space. Adversaries may also leverage a Network Device CLI on network devices to gather detailed system information. System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.\nInfrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.", "signatures": [ { "severity": "INFO", "description": "Reads ini files" } ], "link": "https://attack.mitre.org/techniques/T1083/", "id": "T1083", "name": "File and Directory Discovery" } ], "link": "https://attack.mitre.org/tactics/TA0007/", "id": "TA0007", "name": "Discovery" } ] } } } ``` -------------------------------- ### Example response for GET /files/upload_url Source: https://gtidocs.virustotal.com/reference/files-upload-url Example response from the GET /files/upload_url endpoint, containing the upload URL in the data field. This URL is used for uploading files larger than 32MB and can only be used once. ```json { "data": "http://www.virustotal.com/_ah/upload/AMmfu6b-_DXUeFe36Sb3b0F4B8mH9Nb-CHbRoUNVOPwG/" } ``` -------------------------------- ### Get group users response example Source: https://gtidocs.virustotal.com/reference/get-group-users Example response body for the Get group users endpoint. Shows the structure of a user descriptor with type, id, and context_attributes containing role, quota_limits, and roles fields. ```json { "data": [ { "type": "user", "id": "\<_string_> user ID.", "context_attributes": { "role": "\<_string_> user group role as \"admin\" or \"user\".", "quota_limits": "\<_dictionary_> a dictionary of quota overrides. These entries appear only when a user's individual allowance is configured to be lower than the group’s default.", "roles": "\<_list of strings_> a list of privileges assigned to the user within the group, such as USER_ROLE_GROUP_ADMIN, USER_ROLE_PRIVATE_SCANNING, USER_ROLE_FILE_DOWNLOADS, USER_ROLE_DTM_ADMIN, USER_ROLE_ASM_USER, etc." } } ] } ``` -------------------------------- ### Basic OpenVPN server setup script Source: https://gtidocs.virustotal.com/docs/private-scanning-openvpn A single bash script that automates a basic OpenVPN server setup on a clean Debian/Ubuntu system. It updates packages, installs OpenVPN and Easy-RSA, initializes the PKI, generates CA/server/client certificates, writes server.conf and client .ovpn files, configures IP forwarding and NAT, and starts the service. Replace all <...> placeholders and run as root; it is not production-ready and hardcodes passwords. ```bash #!/usr/bin/env bash # Basic OpenVPN setup script # --- CONFIGURATION --- VPN_SERVER_IP="" # Your server's public IP address VPN_SUBNET="10.8.0.0" # VPN subnet (private IP range for clients) VPN_NETMASK="255.255.255.0" # VPN subnet netmask EASY_RSA_LOCATION="/etc/openvpn/easy-rsa" # Easy-RSA directory CA_COUNTRY="US" CA_PROVINCE="CA" CA_CITY="SanFrancisco" CA_ORG="MyOrganization" CA_EMAIL="admin@example.com" SERVER_NAME="vpn-server" CLIENT_NAME="client1" OPEN_VPN_PORT="1194" RED='\033[0;31m' GREEN='\033[0;32m' YELLOW='\033[0;33m' NC='\033[0m' # No Color check_root() { if [[ $EUID -ne 0 ]]; then echo -e "${RED}This script must be run as root.${NC}" exit 1 fi } update_system() { echo -e "${YELLOW}Updating system packages...${NC}" apt update && apt upgrade -y } install_openvpn() { echo -e "${YELLOW}Installing OpenVPN and Easy-RSA...${NC}" apt install -y openvpn easy-rsa } create_easy_rsa() { echo -e "${YELLOW}Setting up Easy-RSA...${NC}" mkdir -p "$EASY_RSA_LOCATION" cp -r /usr/share/easy-rsa/* "$EASY_RSA_LOCATION" cd "$EASY_RSA_LOCATION" ./easyrsa init-pki } generate_ca_server_key() { echo -e "${YELLOW}Generating CA certificate and server key...${NC}" cd "$EASY_RSA_LOCATION" # Create vars file for defaults cat < vars export EASYRSA_COUNTRY="$CA_COUNTRY" export EASYRSA_PROVINCE="$CA_PROVINCE" export EASYRSA_CITY="$CA_CITY" export EASYRSA_ORG="$CA_ORG" export EASYRSA_EMAIL="$CA_EMAIL" export EASYRSA_OU="IT Department" EOF source vars ./easyrsa build-ca nopass ./easyrsa gen-req $SERVER_NAME nopass ./easyrsa sign-req server $SERVER_NAME openssl dhparam -out pki/dh.pem 2048 } configure_openvpn() { echo -e "${YELLOW}Configuring OpenVPN server...${NC}" cd "$EASY_RSA_LOCATION" # Copy keys to OpenVPN directory cp pki/ca.crt /etc/openvpn/ cp pki/issued/$SERVER_NAME.crt /etc/openvpn/ cp pki/private/$SERVER_NAME.key /etc/openvpn/ cp pki/dh.pem /etc/openvpn/ # Create server.conf cat < /etc/openvpn/server.conf port $OPEN_VPN_PORT proto udp dev tun ca ca.crt cert $SERVER_NAME.crt key $SERVER_NAME.key dh dh.pem server $VPN_SUBNET $VPN_NETMASK ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" keepalive 10 120 cipher AES-256-CBC user nobody group nogroup persist-key persist-tun status openvpn-status.log log-append openvpn.log verb 3 explicit-exit-notify 1 EOF # Enable IP forwarding echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf sysctl -p # Configure NAT (masquerade) for the VPN subnet iptables -t nat -A POSTROUTING -s "$VPN_SUBNET/$VPN_NETMASK" -o $(ip route get 8.8.8.8 | awk '{print $5;exit}') -j MASQUERADE iptables -I FORWARD 1 -s "$VPN_SUBNET/$VPN_NETMASK" -j ACCEPT iptables -I FORWARD 1 -d "$VPN_SUBNET/$VPN_NETMASK" -j ACCEPT dpkg -s iptables-persistent > /dev/null 2>&1 || apt install -y iptables-persistent netfilter-persistent save } create_client_config() { echo -e "${YELLOW}Creating client configuration...${NC}" cd "$EASY_RSA_LOCATION" ./easyrsa gen-req $CLIENT_NAME nopass ./easyrsa sign-req client $CLIENT_NAME # Create client config file cat < /etc/openvpn/$CLIENT_NAME.ovpn client dev tun proto udp remote $VPN_SERVER_IP $OPEN_VPN_PORT resolv-retry infinite nobind persist-key persist-tun remote-cert-tls server cipher AES-256-CBC verb 3 $(cat pki/ca.crt) $(cat pki/issued/$CLIENT_NAME.crt) $(cat pki/private/$CLIENT_NAME.key) EOF # Copy client config to home directory (or other accessible location) cp /etc/openvpn/$CLIENT_NAME.ovpn ~/$CLIENT_NAME.ovpn echo -e "${GREEN}Client configuration file created: ~/$CLIENT_NAME.ovpn${NC}" echo -e "${YELLOW}Transfer this file securely to your device.${NC}" } start_openvpn() { echo -e "${YELLOW}Starting OpenVPN server...${NC}" systemctl start openvpn@server systemctl enable openvpn@server } check_root update_system install_openvpn create_easy_rsa generate_ca_server_key configure_openvpn create_client_config start_openvpn exit 0 ``` -------------------------------- ### powershell_info example response Source: https://gtidocs.virustotal.com/reference/file-object-powershell-info Shows a sample response with actual values for cmdlets, aliases, .NET calls, functions, and variables. ```json { "data": { "attributes": { "powershell_info": { "cmdlets": [ "add-type", "get-process", "get-wmiobject", "new-object", "remove-item" ], "cmdlets_alias": [ "Sleep", "where" ], "dotnet_calls": [ "IO.Compression.CompressionMode", "IO.File", "System.Convert", "System.Diagnostics.Process", "System.Drawing.Graphics", "System.Drawing.Imaging.Encoder" ], "functions": [ "CMDOS", "CURRENT-instance", "CompressedByteArray", "DecompressedByteArray", "info", "process-m" ], "ps_variables": [ "$input", "$null", "$pid" ] } } } } ``` -------------------------------- ### Example response for MITRE ATT&CK techniques summary Source: https://gtidocs.virustotal.com/reference/get-a-summary-of-all-mitre-attck-techniques-observed-in-a-file Example response from the endpoint. Shows the data structure with sandbox names as keys, each containing a tactics array. In this example, 'VirusTotal Observer' has an empty tactics array, while 'Zenbox' includes a Discovery tactic with techniques like System Information Discovery (T1082) and File and Directory Discovery (T1083), each with signatures and MITRE links. ```json { "data": { "VirusTotal Observer": { "tactics": [] }, "Zenbox": { "tactics": [ { "description": "The adversary is trying to figure out your environment.\n\nDiscovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective. ", "techniques": [ { "description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\nTools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space. Adversaries may also leverage a Network Device CLI on network devices to gather detailed system information. System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.\nInfrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.", "signatures": [ { "severity": "INFO", "description": "Reads software policies" } ], "link": "https://attack.mitre.org/techniques/T1082/", "id": "T1082", "name": "System Information Discovery" }, { "description": "Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\nMany command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate. Custom tools may also be used to gather file and directory information and interact with the Native API. Adversaries may also leverage a Network Device CLI on network devices to gather file and directory information.", "signatures": [ { "severity": "INFO", "description": "Reads ini files" } ], "link": "https://attack.mitre.org/techniques/T1083/", "id": "T1083", "name": "File and Directory Discovery" } ], "link": "https://attack.mitre.org/tactics/TA0007/", "id": "TA0007", "name": "Discovery" }, { ``` -------------------------------- ### Response example for Get latest comments Source: https://gtidocs.virustotal.com/reference/get-comments Example response from the GET /api/v3/comments endpoint. Shows the structure with meta cursor, data array containing comment attributes (votes, tags, text, html, date), and links for pagination. ```json { "meta": { "cursor": "Cs8BChEKBGRhdGUSCQiCnsTiupvwAhK1AWoRc352aXJ1c3RvdGFsY2xvdWRynwELEgNVUkwiQDAxMTkxNTk0MmRiNTU2YmJhYjUxMzdmNzYxZWZlNjFmZWQyYjAwNTk4ZmVhOTAwMzYwYjgwMGIxOTNhN2JmMzEMCxIHQ29tbWVudCJJMDExOTE1OTQyZGI1NTZiYmFiNTEzN2Y3NjFlZmU2MWZlZDJiMDA1OThmZWE5MDAzNjBiODAwYjE5M2E3YmYzMS1kOTRkN2M4YQwYACAB" }, "data": [ { "attributes": { "votes": { "positive": 0, "abuse": 0, "negative": 0 }, "tags": [ "_:api", "_:public", "aicc", "monitorapp", "malware" ], "text": "#aicc #monitorapp #malware", "html": "#aicc #monitorapp #malware", "date": 1619424604 }, "type": "comment", "id": "u-011915942db556bbab5137f761efe61fed2b00598fea900360b800b193a7bf31-d94d7c8a", "links": { "self": "https://www.virustotal.com/api/v3/comments/u-011915942db556bbab5137f761efe61fed2b00598fea900360b800b193a7bf31-d94d7c8a" } } ], "links": { "self": "https://www.virustotal.com/api/v3/comments?filter=tag%3Amalware&limit=1", "next": "https://www.virustotal.com/api/v3/comments?filter=tag%3Amalware&cursor=Cs8BChEKBGRhdGUSCQiCnsTiupvwAhK1AWoRc352aXJ1c3RvdGFsY2xvdWRynwELEgNVUkwiQDAxMTkxNTk0MmRiNTU2YmJhYjUxMzdmNzYxZWZlNjFmZWQyYjAwNTk4ZmVhOTAwMzYwYjgwMGIxOTNhN2JmMzEMCxIHQ29tbWVudCJJMDExOTE1OTQyZGI1NTZiYmFiNTEzN2Y3NjFlZmU2MWZlZDJiMDA1OThmZWE5MDAzNjBiODAwYjE5M2E3YmYzMS1kOTRkN2M4YQwYACAB&limit=1" } } ``` -------------------------------- ### GET /api/v3/comments Source: https://gtidocs.virustotal.com/reference/get-comments This snippet documents the GET /api/v3/comments endpoint, including its parameters, headers, request example, and response structure. ```APIDOC ## GET /api/v3/comments ### Description This endpoint retrieves information about the latest comments added to Google Threat Intelligence. It supports filtering by tags and pagination. ### Method GET ### Endpoint https://www.virustotal.com/api/v3/comments ### Parameters #### Query Parameters - **limit** (int32) - Optional - Number of items to retrieve. Range: 0 to 40. Defaults to 10. - **filter** (string) - Optional - Filter returned elements. Example: `filter=tag:malware`. - **cursor** (string) - Optional - Continuation cursor for pagination. #### Headers - **x-apikey** (string) - Required - Your API key. ### Request Example ``` curl --request GET \ --url https://www.virustotal.com/api/v3/comments \ --header 'accept: application/json' ``` ### Response #### Success Response (200) - **meta** (object) - Contains pagination cursor. - **data** (array) - List of comment objects. - **attributes** (object) - Comment details: votes, tags, text, html, date. - **type** (string) - Type of object, e.g., "comment". - **id** (string) - Unique identifier of the comment. - **links** (object) - Self link to the comment. - **links** (object) - Pagination links: self and next. #### Response Example ``` { "meta": { "cursor": "Cs8BChEKBGRhdGUSCQiCnsTiupvwAhK1AWoRc352aXJ1c3RvdGFsY2xvdWRynwELEgNVUkwiQDAxMTkxNTk0MmRiNTU2YmJhYjUxMzdmNzYxZWZlNjFmZWQyYjAwNTk4ZmVhOTAwMzYwYjgwMGIxOTNhN2JmMzEMCxIHQ29tbWVudCJJMDExOTE1OTQyZGI1NTZiYmFiNTEzN2Y3NjFlZmU2MWZlZDJiMDA1OThmZWE5MDAzNjBiODAwYjE5M2E3YmYzMS1kOTRkN2M4YQwYACAB" }, "data": [ { "attributes": { "votes": { "positive": 0, "abuse": 0, "negative": 0 }, "tags": [ "_:api", "_:public", "aicc", "monitorapp", "malware" ], "text": "#aicc #monitorapp #malware", "html": "#aicc #monitorapp #malware", "date": 1619424604 }, "type": "comment", "id": "u-011915942db556bbab5137f761efe61fed2b00598fea900360b800b193a7bf31-d94d7c8a", "links": { "self": "https://www.virustotal.com/api/v3/comments/u-011915942db556bbab5137f761efe61fed2b00598fea900360b800b193a7bf31-d94d7c8a" } } ], "links": { "self": "https://www.virustotal.com/api/v3/comments?filter=tag%3Amalware&limit=1", "next": "https://www.virustotal.com/api/v3/comments?filter=tag%3Amalware&cursor=Cs8BChEKBGRhdGUSCQiCnsTiupvwAhK1AWoRc352aXJ1c3RvdGFsY2xvdWRynwELEgNVUkwiQDAxMTkxNTk0MmRiNTU2YmJhYjUxMzdmNzYxZWZlNjFmZWQyYjAwNTk4ZmVhOTAwMzYwYjgwMGIxOTNhN2JmMzEMCxIHQ29tbWVudCJJMDExOTE1OTQyZGI1NTZiYmFiNTEzN2Y3NjFlZmU2MWZlZDJiMDA1OThmZWE5MDAzNjBiODAwYjE5M2E3YmYzMS1kOTRkN2M4YQwYACAB&limit=1" } } ``` ### Error Handling - **400** - Bad request. Check parameters and headers. ``` -------------------------------- ### Example response for POST /private/zip_files Source: https://gtidocs.virustotal.com/reference/private-scanning-zip-files Example response from the endpoint. The returned object has status and progress attributes indicating the ZIP creation process; the ZIP file is not ready for download immediately. ```json { "data": { "type": "zip_file", "id": "4939392292", "attributes": { "status": "starting", "progress": 0, "files_ok": 0, "files_error": 0 } } } ``` -------------------------------- ### Example response for GET /api/v3/files/{id}/behaviours Source: https://gtidocs.virustotal.com/reference/get-all-behavior-reports-for-a-file Example response from the GET /api/v3/files/{id}/behaviours endpoint. Shows the structure of the returned File behaviour object, including meta count, sandbox-specific attributes, and fields such as has_html_report, has_pcap, and processes_tree. ```json { "meta": { "count": 5 }, "data": [ { "attributes": { "verdicts": [ "UNKNOWN_VERDICT" ], "has_pcap": false, "analysis_date": 1669409515, "processes_tree": [ { "process_id": "2248", "name": "%windir%\\System32\\svchost.exe -k WerSvcGroup" }, { "process_id": "2940", "name": "wmiadap.exe /F /T /R" }, { "process_id": "2988", "name": "%windir%\\system32\\wbem\\wmiprvse.exe" }, { "process_id": "2676", "name": "%SAMPLEPATH%" } ], "sandbox_name": "C2AE", "has_html_report": false, "processes_terminated": [ "%windir%\\System32\\svchost.exe -k WerSvcGroup", "wmiadap.exe /F /T /R" ], "behash": "7eb58e30b74038daa9b31b5d9df78cf2", "has_evtx": false, "last_modification_date": 1669495931, "has_memdump": false }, "type": "file_behaviour", "id": "edd0a64dc65087ffe453ca94b267169b39458a983b29ac31320fcaa983d0f97e_C2AE", "links": { "self": "https://www.virustotal.com/api/v3/file_behaviours/edd0a64dc65087ffe453ca94b267169b39458a983b29ac31320fcaa983d0f97e_C2AE" } }, { "attributes": { "mitre_attack_techniques": [ { "signature_description": "link function at runtime on Windows", "id": "T1129", "severity": "IMPACT_SEVERITY_INFO" }, { "signature_description": "packed with UPX", "id": "T1027.002", "severity": "IMPACT_SEVERITY_INFO" }, { "refs": [ { "ref": "#signature_matches", "value": "link function at runtime on Windows" } ], "signature_description": "link function at runtime on Windows", "id": "T1129", "severity": "IMPACT_SEVERITY_INFO" }, { "refs": [ { "ref": "#signature_matches", "value": "packed with UPX" } ], "signature_description": "packed with UPX", "id": "T1027.002", "severity": "IMPACT_SEVERITY_INFO" } ], "has_pcap": false, "analysis_date": 1669611166, "sandbox_name": "CAPA", "has_html_report": false, "behash": "76c6c8e44cd4f1dbddc0f6c2202c1480", "has_evtx": false, "signature_matches": [ { "format": "SIG_FORMAT_CAPA", ``` -------------------------------- ### Example response for /users/{id}/hunting_notification_files Source: https://gtidocs.virustotal.com/reference/user-object-hunting-notification-files Example response for the /users/{id}/hunting_notification_files endpoint. Shows a list of File objects with context attributes from the corresponding Hunting Notification and Hunting Ruleset objects, including match_in_subfile, ruleset_id, ruleset_name, rule_name, rule_tags, notification_id, notification_date, notification_snippet, notification_tags, notification_source_key, and notification_source_country. ```json { "data": [ { "attributes": , "context_attributes": { "match_in_subfile": , "notification_date": , "notification_id": "", "notification_snippet": "", "notification_source_country": "", "notification_source_key": "", "notification_tags": [ "" ], "rule_name": "", "rule_tags": [ "" ], "ruleset_id": "", "ruleset_name": "" }, "id": "", "links": { "self": "https://www.virustotal.com/api/v3/files/" }, "type": "file" } ], "links": { "next": "", "self": "" }, "meta": { "count": , "cursor": "" } } ``` -------------------------------- ### ipa_info apps array example Source: https://gtidocs.virustotal.com/reference/file-object-ipa-info Example of the apps array within ipa_info, showing Mach-O binary details such as commands, headers, libs, and segments. ```json { "data": { "attributes": { "ipa_info": { "apps": [ { "commands": [ { "type": "LC_DYLD_INFO_ONLY" }, { "type": "LC_SYMTAB" }, { "type": "LC_DYSYMTAB" }, { "type": "LC_LOAD_DYLINKER" }, { "type": "LC_UUID" } ], "headers": { "cpu_subtype": "ARM_V7", "cpu_type": "ARM", "entrypoint": "0xe5ed", "file_type": "executable file", "flags": [ "BINDS_TO_WEAK", "DYLDLINK", "NOUNDEFS", "PIE", "TWOLEVEL", "WEAK_DEFINES" ], "magic": "0xfeedface", "num_cmds": 54, "size_cmds": 5564 }, "libs": [ "/System/Library/Frameworks/blabla.framework/blablabla", "/System/Library/Frameworks/bleble.framework/blebleble" ], "segments": [ { "fileoff": "0x0", "filesize": "0x0", "name": "__PAGEZERO", "sections": [], "vmaddr": "0x0", "vmsize": "0x4000" }, { "fileoff": "0x0", "filesize": "0x990000", "name": "__TEXT", "sections": [ { "flags": [ "SECTION_ATTRIBUTES_USR", "SECTION_ATTRIBUTES_SYS" ], "name": "__text", ``` -------------------------------- ### GET https://www.virustotal.com/api/v3/search Source: https://gtidocs.virustotal.com/reference/api-search This code snippet documents the GET /api/v3/search endpoint, including its parameters, request example, and response structure. ```APIDOC ## [GET] https://www.virustotal.com/api/v3/search ### Description This endpoint searches for files, URLs, domains, IPs, and comments based on a query. It returns a list of objects matching the query. ### Method GET ### Endpoint https://www.virustotal.com/api/v3/search ### Parameters #### Query Parameters - **query** (string) - Required - Search query. #### Headers - **x-apikey** (string) - Required - Your API key ### Request Example ``` curl --request GET \ --url https://www.virustotal.com/api/v3/search \ --header 'accept: application/json' ``` ### Response #### Success Response (200) Returns a list of objects matching the query. The response includes a `data` array, `links` for pagination, and `meta` with a cursor. #### Response Example ``` { "data": [ { "attributes": { "date": 1597349426, "html": "search comment #example.", "tags": [ "example" ], "text": "search comment #example.", "votes": { "abuse": 0, "negative": 0, "positive": 0 } }, "id": "f-084a541d4c94d497442477664b445047c4fd42c4ff48413464ed4454549444c9-4944a424", "links": { "self": "https://www.virustotal.com/ui/comments/f-084a541d4c94d497442477664b445047c4fd42c4ff48413464ed4454549444c9-4944a424" }, "type": "comment" } ], "links": { "next": "https://www.virustotal.com/api/v3/search?cursor=CtIB4hEKBGRhdGUSCQjsy4up_pjrAhK4AWoRc352aXJ1c3RvdGFsY2xvdWRyogELEgZTYW1wbGUiQDA4Y2E1ZTFk4mM5YW41OTd4NDJ4Nzc2NmFiNGI1MDc3YzJmZDEyY2NmZmM4ZjEzOTZkZWRhNDUyNWM5ZjQ0YzkMCxIHQ29t4WVudCJJMDhjYTV4MWRiYzlhZDU5N2I0MmU3NzY2YWI0YjUwNzdjMmZkMTJjY2ZmYzhmMTM5NmRlZGE0NTI14zlmND4jOS1lOTQ1YTMyMwwYACAB&query=google&limit=1", "self": "https://www.virustotal.com/api/v3/search?query=example&limit=1" }, "meta": { "cursor": "CtIB4hEKBGRhdGUSCQjsy4up_pjrAhK4AWoRc352aXJ1c3RvdGFsY2xvdWRyogELEgZTYW1wbGUiQDA4Y2E1ZTFk4mM5YW41OTd4NDJ4Nzc2NmFiNGI1MDc3YzJmZDEyY2NmZmM4ZjEzOTZkZWRhNDUyNWM5ZjQ0YzkMCxIHQ29t4WVudCJJMDhjYTV4MWRiYzlhZDU5N2I0MmU3NzY2YWI0YjUwNzdjMmZkMTJjY2ZmYzhmMTM5NmRlZGE0NTI14zlmND4jOS1lOTQ1YTMyMwwYACAB" } } ``` #### Error Response (400) Bad request. The response may include an error message. ``` -------------------------------- ### GET /api/v3/files/{id}/{relationship} Source: https://gtidocs.virustotal.com/reference/files-relationships This snippet documents the GET endpoint for retrieving objects related to a file, including its parameters, headers, and example request. ```APIDOC ## GET /api/v3/files/{id}/{relationship} ### Description Retrieves objects related to a file based on the specified relationship. This endpoint allows you to fetch related files and objects by sending a GET request to the relationship URL. ### Method GET ### Endpoint https://www.virustotal.com/api/v3/files/{id}/{relationship} ### Parameters #### Path Parameters - **id** (string) - Required - SHA-256, SHA-1 or MD5 identifying the file - **relationship** (string) - Required - Relationship name (see table) #### Query Parameters - **limit** (int32) - Optional - Maximum number of related objects to retrieve. Range: 0 to 40. Defaults to 10. - **cursor** (string) - Optional - Continuation cursor #### Headers - **x-apikey** (string) - Required - Your API key ### Request Example ``` curl --request GET \ --url https://www.virustotal.com/api/v3/files/id/relationship \ --header 'accept: application/json' ``` ### Response #### Success Response (200) Returns the related objects. #### Error Response (400) Returns an error if the request is invalid. ``` -------------------------------- ### ipa_info JSON example Source: https://gtidocs.virustotal.com/reference/file-object-ipa-info Example JSON response showing the structure of the ipa_info object, including the apps array with commands, headers, libs, segments, and the provision object with entitlements and provisioning profile details. ```json { "data": { "attributes": { "ipa_info": { "apps": [ { "commands": [ { "type": "LC_DYLD_INFO_ONLY" }, { "type": "LC_SYMTAB" }, { "type": "LC_DYSYMTAB" } ], "headers": { "cpu_subtype": "ARM_V7", "cpu_type": "ARM", "entrypoint": "0x41a1d", "file_type": "executable file", "flags": [ "BINDS_TO_WEAK", "DYLDLINK", "NOUNDEFS", "PIE", "TWOLEVEL", "WEAK_DEFINES" ], "magic": "0xfeedface", "num_cmds": 50, "size_cmds": 5272 }, "libs": [ "/System/Library/Frameworks/AVFoundation.framework/AVFoundation", "/System/Library/Frameworks/AdSupport.framework/AdSupport", "/System/Library/Frameworks/AssetsLibrary.framework/AssetsLibrary", "/System/Library/Frameworks/AudioToolbox.framework/AudioToolbox", "/System/Library/Frameworks/CFNetwork.framework/CFNetwork" ], "segments": [ { "fileoff": "0x0", "filesize": "0x0", ``` -------------------------------- ### Example response for POST /intelligence/zip_files Source: https://gtidocs.virustotal.com/reference/zip_files Example response from the endpoint. The returned object has a status and progress attribute indicating the ZIP creation process; the ZIP file is not ready immediately and must be polled via GET /intelligence/zip_files/{id} until status is finished. ```json { "data": { "type": "zip_file", "id": "4939392292", "attributes": { "status": "starting", "progress": 0, "files_ok": 0, "files_error": 0 } } } ``` -------------------------------- ### Example response Source: https://gtidocs.virustotal.com/reference/introduction-objects Example JSON response from a GET request to an object's URL. Shows the structure with type, id, links, attributes, and optional relationships. ```json { "data": { "type": "{object type}", "id": "{object id}", "links": { "self": "https://www.virustotal.com/api/v3/{collection name}/{object id}" }, "attributes" : { "integer_attribute": 1234, "string_attribute": "this is a string", "dictionary_attribute": { "one": 1, "two": 2 }, "list_attribute": [ "foo", "bar", "baz" ] }, "relationships" : { .. } } } ```