VirusTotal

https://docs.virustotal.com/
Admin
VirusTotal is a free online service that analyzes files and URLs for viruses, worms, trojans, and...
Tokens:676,641
Snippets:3,595
Trust Score:9.9
Update:1 week ago
Show doc for...
Tokens:
Raw
### Example user JSON response

Source: https://docs.virustotal.com/reference/monitoritem-description

Example JSON response from the GET /users/{id} endpoint showing the monitor privilege with the inherited_from field set to the group name.

```json
{
  "type": "user",
  "id": "wcoyote",
  "links": {
    "self": "https://www.virustotal.com/api/v3/users/wcoyote"
  },
  "data": {
    "attributes": {
      "privileges": {
        "monitor": {
          "granted": true,
          "inherited_from": "acme"
        },
      }
    }  
  }
}
```

--------------------------------

### files_copied example with actual file paths

Source: https://docs.virustotal.com/reference/file-behaviour-object-files-copied

Shows a concrete example of the files_copied object with real file paths for destination and source. Demonstrates the expected format for a file copy event.

```json
{
    "data": {
        "attributes": {
            "files_copied": [
                {
                    "destination": "C:\\Program Files (x86)\\blablabla\\blablabla.exe",
                    "source": "C:\\Users\\FD1HVy\\Downloads\\blablabla.exe"
                }
            ]
        }
    }
}
```

--------------------------------

### dot_net_guids example response

Source: https://docs.virustotal.com/reference/file-object-dot-net-guids

Example JSON response with actual GUID values for mvid and typelib_id.

```json
{
    "data": {
        "attributes": {
            "dot_net_guids": {
                "mvid": "c24b4a43-444e-4468-4081-c4422484a246",
                "typelib_id": "48484de4-4465-4403-448f-45c148474bf4"
            }
        }
    }
}
```

--------------------------------

### Example response with user objects

Source: https://docs.virustotal.com/reference/group-users

Concrete example response showing two user objects with attributes like email, preferences, privileges, and quotas.

```json
{
	"data": [
		{
			"attributes": {
				"apikey": "3333333t33333333333333r333333f333333g33333333c3333333f333333333a",
				"email": "blabla@blabla.com",
				"first_name": "Sabrina",
				"has_2fa": true,
				"last_login": 1598966628,
				"last_name": "Spellman",
				"preferences": {
					"graph": {
						"last_visit": 1597683192814,
						"main_walkthrough_version_seen": "1.0.0"
					},
					"ui": {
						"last_read_notification_date": 1598436845
					}
				},
				"privileges": {
					"cases": {
						"granted": false
					},
					"dogfooder": {
						"granted": false
					},
					"downloads-tier-1": {
						"granted": false
					},
					"downloads-tier-2": {
						"expiration_date": 1601510400,
						"granted": true,
						"inherited_from": "spellmans",
						"inherited_via": "api_quota_group"
					}
				},
				"profile_phrase": "",
				"quotas": {
					"api_requests_daily": {
						"allowed": 1000000000,
						"used": 101
					},
					"api_requests_hourly": {
						"allowed": 60000000000,
						"used": 0
					},
					"api_requests_monthly": {
						"allowed": 1000000000,
						"used": 1433
					},
					"cases_creation_monthly": {
						"allowed": 20,
						"used": 0
					}
				},
				"reputation": 1,
				"status": "active",
				"user_since": 1557214525
			},
			"id": "spellman",
			"links": {
				"self": "https://www.virustotal.com/api/v3/users/spellman"
			},
			"type": "user"
		},
		{
			"attributes": {
				"first_name": "Salem",
				"last_name": "Spellman",
				"profile_phrase": "Meow",
				"reputation": 1,
				"status": "active",
				"user_since": 1557214525
			},
			"id": "salem",
			"links": {
				"self": "https://www.virustotal.com/api/v3/users/salem"
			},
			"type": "user"
		}
	],
	"links": {
		"self": "https://www.virustotal.com/api/v3/groups/spellmans/users?limit=10"
	},
	"meta": {
		"count": 2
	}
}
```

--------------------------------

### cURL: Search graphs with GET

Source: https://docs.virustotal.com/reference/graphs-api

Example cURL request using the GET method to search graphs.

```shell
curl --request GET \
     --url https://www.virustotal.com/api/v3/graphs
```

--------------------------------

### Get a graph object - response example

Source: https://docs.virustotal.com/reference/graphs-info

Example response for the GET /api/v3/graphs/{id} endpoint. Shows the structure of a Graph object, including attributes like graph_data, links, nodes, and metadata such as creation_date and position. The response includes the graph ID and a self link.

```json
{
  "data": {
    "attributes": {
      "graph_data": {
        "description": "Hooli.com investigation"
      },
      "links": [
        {
          "connection_type": "resolutions",
          "source": "www.hooli.com",
          "target": "relationships_resolutions_wwwhoolicom"
        },
        {
          "connection_type": "resolutions",
          "source": "relationships_resolutions_wwwhoolicom",
          "target": "8.8.8.8"
        }
      ],
      "private": false,
      "creation_date": 1530006951,
      "position": {
        "y": 388,
        "x": 897,
        "scale": "1"
      },
      "nodes": [
        {
          "index": 0,
          "entity_id": "www.hooli.com",
          "text": "Root Node",
          "y": 65,
          "x": -18,
          "type": "domain"
        },
        {
          "y": 42,
          "index": 1,
          "entity_id": "relationships_resolutions_wwwhoolicom",
          "type": "relationship",
          "x": -56
        },
        {
          "index": 2,
          "entity_id": "8.8.8.8",
          "fx": 3.3,
          "fy": 4.4,
          "y": 0,
          "x": -64,
          "type": "ip_address"
        },
        {
          "index": 2,
          "entity_id": "131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267",
          "fx": 3.3,
          "fy": 4.4,
          "y": 0,
          "x": -64,
          "type": "file"
        },
        {
          "index": 2,
          "entity_id": "1a0556926f7e76419d12e4c6ad52f10388af11f2689f6c0fb6111a2b85f131de",
          "fx": 3.3,
          "fy": 4.4,
          "y": 0,
          "x": -64,
          "type": "url"
        }
      ]
    },
    "type": "graph",
    "id": "g3ad78ce6c21ae675e81ac376a6fc016c37befa6dc87484b95a2b069f8d04ef44",
    "links": {
      "self": "https://www.virustotal.com/api/v3/graphs/g3ad78ce6c21ae675e81ac376a6fc016c37befa6dc87484b95a2b069f8d04ef44"
    }
  }
}
```

--------------------------------

### Example response for MITRE ATT&CK summary

Source: https://docs.virustotal.com/reference/get-a-summary-of-all-mitre-attck-techniques-observed-in-a-file

Example JSON response showing the structure with sandbox names like 'VirusTotal Observer' and 'Zenbox', including tactics, techniques, and signatures.

```json
{
	"data": {
		"VirusTotal Observer": {
			"tactics": []
		},
		"Zenbox": {
			"tactics": [
				{
					"description": "The adversary is trying to figure out your environment.\n\nDiscovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective. ",
					"techniques": [
						{
							"description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\nTools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space. Adversaries may also leverage a Network Device CLI on network devices to gather detailed system information. System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.\nInfrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.",
							"signatures": [
								{
									"severity": "INFO",
									"description": "Reads software policies"
								}
							],
							"link": "https://attack.mitre.org/techniques/T1082/",
							"id": "T1082",
							"name": "System Information Discovery"
						},
						{
							"description": "Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\nMany command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate. Custom tools may also be used to gather file and directory information and interact with the Native API. Adversaries may also leverage a Network Device CLI on network devices to gather file and directory information.",
							"signatures": [
								{
									"severity": "INFO",
									"description": "Reads ini files"
								}
							],
							"link": "https://attack.mitre.org/techniques/T1083/",
							"id": "T1083",
							"name": "File and Directory Discovery"
						}
					],
					"link": "https://attack.mitre.org/tactics/TA0007/",
					"id": "TA0007",
					"name": "Discovery"
				},
				{

```

--------------------------------

### Detailed example response for pe_resource_children

Source: https://docs.virustotal.com/reference/file-object-pe-resource-children

Shows a full example response with a File object's attributes, including exiftool data, first_submission_date, last_analysis_date, and last_analysis_results with multiple antivirus engine results.

```json
{
    "data": [
        {
            "attributes": {
                "authentihash": "0c4226e47eda883ce9eff9ec1ae6ce1a13ee3cc63e6960ae5a3ae4ad2e8eeee5",
                "creation_date": 1587044124,
                "downloadable": true,
                "exiftool": {
                    "AssemblyVersion": "1.3.30.0",
                    "CharacterSet": "Unicode",
                    "CodeSize": "104448",
                    "Comments": "blablablabla",
                    "CompanyName": "blablabla",
                    "EntryPoint": "0xccef",
                    "FileDescription": "blablabla",
                    "FileFlagsMask": "0x003f",
                    "FileOS": "Win32",
                    "FileSubtype": "0",
                    "FileType": "Win32 EXE",
                    "FileTypeExtension": "exe",
                    "FileVersion": "1.3.30.0",
                    "FileVersionNumber": "1.3.30.0",
                    "ImageFileCharacteristics": "No relocs, Executable, Large address aware, 32-bit",
                    "ImageVersion": "0.0",
                    "InitializedDataSize": "339968",
                    "InternalName": "blablabla.exe",
                    "LanguageCode": "Neutral",
                    "LegalCopyright": "Copyright © blablabla 2020",
                    "LegalTrademarks": "blablabla",
                    "LinkerVersion": "9.0",
                    "MIMEType": "application/octet-stream",
                    "MachineType": "Intel 386 or later, and compatibles",
                    "OSVersion": "5.0",
                    "ObjectFileType": "Executable application",
                    "OriginalFileName": "blablabla.exe",
                    "PEType": "PE32",
                    "ProductName": "blablabla",
                    "ProductVersion": "1.3.30.0",
                    "ProductVersionNumber": "1.3.30.0",
                    "Subsystem": "Windows GUI",
                    "SubsystemVersion": "5.0",
                    "TimeStamp": "2020:04:16 15:35:24+02:00",
                    "UninitializedDataSize": "0"
                },
                "first_submission_date": 1587049407,
                "last_analysis_date": 1588653326,
                "last_analysis_results": {
                    "ALYac": {
                        "category": "malicious",
                        "engine_name": "ALYac",
                        "engine_update": "20200505",
                        "engine_version": "1.1.1.5",
                        "method": "blacklist",
                        "result": "Trojan.GenericKD.42996961"
                    },
                    "APEX": {
                        "category": "malicious",
                        "engine_name": "APEX",
                        "engine_update": "20200504",
                        "engine_version": "6.18",
                        "method": "blacklist",
                        "result": "Malicious"
                    },
                    "AVG": {
                        "category": "undetected",
                        "engine_name": "AVG",
                        "engine_update": "20200505",
                        "engine_version": "18.4.3895.0",
                        "method": "blacklist",
                        "result": null
                    },
                    "Acronis": {
                        "category": "malicious",
                        "engine_name": "Acronis",
                        "engine_update": "20200422",
                        "engine_version": "1.1.1.75",
                        "method": "blacklist",
                        "result": "suspicious"
                    },
                    "Ad-Aware": {
                        "category": "malicious",
                        "engine_name": "Ad-Aware",
                        "engine_update": "20200505",
                        "engine_version": "3.0.5.370",
                        "method": "blacklist",
                        "result": "Trojan.GenericKD.42996961"
                    }
                }
            }
        }
    ]
}
```

--------------------------------

### Example response for GET /api/v3/private/analyses

Source: https://docs.virustotal.com/reference/analyses

Example JSON response with a single private analysis object, including attributes like status, sandbox_status, and links.

```json
{
	"meta": {
		"count": 90,
		"cursor": "1"
	},
	"data": [
		{
			"attributes": {
				"status": "completed",
				"sandbox_status": {
					"Zenbox": {
						"status": "finished",
						"in_progress_percent": 100
					}
				},
				"sandbox_configuration": {
					"enable_internet": false,
					"command_line": ""
				},
				"date": 1666170912
			},
			"type": "private_analysis",
			"id": "NTJjNTM1MThmMzhiNWRiNGE1ZWQ5ZDhiZjQyNWY2NzM6NTJjMjllYmQ3MThjODM2OWRjNmFiNmIzOTc2MmM3OTY6MTY2NjE3MDkxMg==",
			"links": {
				"item": "https://www.virustotal.com/api/v3/private/files/16f6c6439c5b971218b9cd1d616ba40c7cad08c94984ecfde443dfa3c61c6152",
				"self": "https://www.virustotal.com/api/v3/private/analyses/NTJjNTM1MThmMzhiNWRiNGE1ZWQ5ZDhiZjQyNWY2NzM6NTJjMjllYmQ3MThjODM2OWRjNmFiNmIzOTc2MmM3OTY6MTY2NjE3MDkxMg=="
			}
		}
	],
	"links": {
		"self": "https://www.virustotal.com/api/v3/private/analyses?limit=1",
		"next": "https://www.virustotal.com/api/v3/private/analyses?cursor=1&limit=1"
	}
}
```

--------------------------------

### GET response from a collection

Source: https://docs.virustotal.com/reference/collections

Example JSON response from a GET request to /api/v3/{collection name}, showing data array, cursor in meta, and links for pagination.

```json
{
    "data": [
      { .. object 1 .. },
      { .. object 2 .. },
      { .. object 3 .. }
    ],
    "meta": {
      "cursor": "CuABChEKBGRhdGUSCQjA1.."
    },
    "links": {
        "next": "https://www.virustotal.com/api/v3/{collection name}?cursor=CuABChEKBGRhdGUSCQjA1..",
        "self": "https://www.virustotal.com/api/v3/{collection name}"
    }
}
```

--------------------------------

### Example response from behaviour_mitre_trees endpoint

Source: https://docs.virustotal.com/reference/private-files-api

Sample JSON response from the /files/{id}/behaviour_mitre_trees endpoint, showing the structure with tactics and techniques. The example is truncated, but illustrates the data format.

```json
{
	"data": {
		"Zenbox": {
			"tactics": [
				{
					"description": "The adversary is trying to get into your network.\n\nInitial Access consists of techniques that use various entry vectors to gain their initial foothold within a network. Techniques used to gain a foothold include targeted spearphishing and exploiting weaknesses on public-facing web servers. Footholds gained through initial access may allow for continued access, like valid accounts and use of external remote services, or may be limited-use due to changing passwords.",
					"techniques": [
						{

```

--------------------------------

### Example response with actual data

Source: https://docs.virustotal.com/reference/hunting-rulesets-editors

Shows a concrete example response with a group object, including attributes like quotas and privileges, and links to the group.

```json
{
    "data": [
        {
            "attributes": {
                "auto_add_users": [],
                "country": "United States",
                "country_iso": "US",
                "domain_name": "blabla.com",
                "industry": "IT",
                "organization": "Company",
                "organization_legal_name": "Company Inc",
                "privileges": {
                    "admin": {
                        "granted": false
                    },
                    "allinfo": {
                        "granted": false
                    },
                    "big-files": {
                        "expiration_date": 1601510400,
                        "granted": true
                    },
                    "cases": {
                        "granted": false
                    },
                    "click_to_accept": {
                        "granted": false
                    }
                },
                "quota_usage_by_user": {},
                "quotas": {
                    "api_requests_daily": {
                        "allowed": 1000,
                        "used": 13
                    },
                    "api_requests_hourly": {
                        "allowed": 60000,
                        "used": 1
                    },
                    "api_requests_monthly": {
                        "allowed": 30000,
                        "used": 104
                    }
                }
            },
            "id": "blabla",
            "links": {
                "self": "https://www.virustotal.com/api/v3/groups/blabla"
            },
            "type": "group"
        },
    ],
    "links": {
        "self": "https://www.virustotal.com/api/v3/intelligence/hunting_rulesets/0000000000000000/editors?limit=10"
    },
    "meta": {
        "count": 1
    }
}
```

--------------------------------

### API v3 - Python GET and POST requests example

Source: https://docs.virustotal.com/reference/api-v2-v3-migration-guide

Shows how to make GET and POST requests in VirusTotal API v3, where the API key is sent in the headers, following REST principles and avoiding exposure in GET requests.

```python
# API v3 - Python GET and POST requests example
headers = {'accept': 'application/json', 'x-apikey': VT_API_KEY}
response = requests.get(url, headers=headers)
response = requests.post(url, headers=headers)
```

--------------------------------

### Port Info object example (concrete)

Source: https://docs.virustotal.com/reference/port-info-object

Shows a concrete example of a Port Info object for the entity 1.2.3.4:443, with actual values for all attributes and a sample latest_analysis.

```json
{
  "data": {
    "type": "port_info",
    "id": "1.2.3.4:443",
    "attributes": {
      "netloc": "1.2.3.4",
      "entity_type": "ip_address",
      "port": 443,
      "status": "PORT_INFO_STATUS_OPEN",
      "first_seen": 1700000000,
      "last_seen": 1718534400,
      "open_since": 1716000000,
      "last_seen_open": 1718534400,
      "latest_analysis": {
        "netloc": "1.2.3.4",
        "port": 443,
        "date": 1718534400,
        "risk_rating": "RISK_RATING_LOW",
        "transport": "TRANSPORT_TCP",
        "is_tls": true,
        "port_state": "open",
        "port_service": {
          "protocol": "https",
          "product": "nginx",
          "version": "1.25.3"
        }
      }
    },
    "links": {
      "self": "https://www.virustotal.com/api/v3/port_infos/1.2.3.4:443"
    }
  }
}
```

--------------------------------

### Example JSON Response for Get Latest Comments

Source: https://docs.virustotal.com/reference/get-comments

This JSON shows the response structure for the Get latest comments endpoint. It includes metadata with a cursor, an array of comment objects with attributes like votes, tags, text, and date, and links for pagination. The example uses a filter for tag:malware and limit=1.

```json
{
  "meta": {
    "cursor": "Cs8BChEKBGRhdGUSCQiCnsTiupvwAhK1AWoRc352aXJ1c3RvdGFsY2xvdWRynwELEgNVUkwiQDAxMTkxNTk0MmRiNTU2YmJhYjUxMzdmNzYxZWZlNjFmZWQyYjAwNTk4ZmVhOTAwMzYwYjgwMGIxOTNhN2JmMzEMCxIHQ29tbWVudCJJMDExOTE1OTQyZGI1NTZiYmFiNTEzN2Y3NjFlZmU2MWZlZDJiMDA1OThmZWE5MDAzNjBiODAwYjE5M2E3YmYzMS1kOTRkN2M4YQwYACAB"
  },
  "data": [
    {
      "attributes": {
        "votes": {
          "positive": 0,
          "abuse": 0,
          "negative": 0
        },
        "tags": [
          "_:api",
          "_:public",
          "aicc",
          "monitorapp",
          "malware"
        ],
        "text": "#aicc #monitorapp #malware",
        "html": "#aicc #monitorapp #malware",
        "date": 1619424604
      },
      "type": "comment",
      "id": "u-011915942db556bbab5137f761efe61fed2b00598fea900360b800b193a7bf31-d94d7c8a",
      "links": {
        "self": "https://www.virustotal.com/api/v3/comments/u-011915942db556bbab5137f761efe61fed2b00598fea900360b800b193a7bf31-d94d7c8a"
      }
    }
  ],
  "links": {
    "self": "https://www.virustotal.com/api/v3/comments?filter=tag%3Amalware&limit=1",
    "next": "https://www.virustotal.com/api/v3/comments?filter=tag%3Amalware&cursor=Cs8BChEKBGRhdGUSCQiCnsTiupvwAhK1AWoRc352aXJ1c3RvdGFsY2xvdWRynwELEgNVUkwiQDAxMTkxNTk0MmRiNTU2YmJhYjUxMzdmNzYxZWZlNjFmZWQyYjAwNTk4ZmVhOTAwMzYwYjgwMGIxOTNhN2JmMzEMCxIHQ29tbWVudCJJMDExOTE1OTQyZGI1NTZiYmFiNTEzN2Y3NjFlZmU2MWZlZDJiMDA1OThmZWE5MDAzNjBiODAwYjE5M2E3YmYzMS1kOTRkN2M4YQwYACAB&limit=1"
  }
}
```

--------------------------------

### Example File object in referrer_files response

Source: https://docs.virustotal.com/reference/ip-object-referrer-files

Detailed example of a File object returned in the referrer_files relationship. Includes attributes like authentic hash, creation date, exiftool metadata, and last analysis results from multiple antivirus engines.

```json
{
    "data": [
        {
            "attributes": {
                "authentihash": "0c4226e47eda883ce9eff9ec1ae6ce1a13ee3cc63e6960ae5a3ae4ad2e8eeee5",
                "creation_date": 1587044124,
                "downloadable": true,
                "exiftool": {
                    "AssemblyVersion": "1.3.30.0",
                    "CharacterSet": "Unicode",
                    "CodeSize": "104448",
                    "Comments": "blablablabla",
                    "CompanyName": "blablabla",
                    "EntryPoint": "0xccef",
                    "FileDescription": "blablabla",
                    "FileFlagsMask": "0x003f",
                    "FileOS": "Win32",
                    "FileSubtype": "0",
                    "FileType": "Win32 EXE",
                    "FileTypeExtension": "exe",
                    "FileVersion": "1.3.30.0",
                    "FileVersionNumber": "1.3.30.0",
                    "ImageFileCharacteristics": "No relocs, Executable, Large address aware, 32-bit",
                    "ImageVersion": "0.0",
                    "InitializedDataSize": "339968",
                    "InternalName": "blablabla.exe",
                    "LanguageCode": "Neutral",
                    "LegalCopyright": "Copyright © blablabla 2020",
                    "LegalTrademarks": "blablabla",
                    "LinkerVersion": "9.0",
                    "MIMEType": "application/octet-stream",
                    "MachineType": "Intel 386 or later, and compatibles",
                    "OSVersion": "5.0",
                    "ObjectFileType": "Executable application",
                    "OriginalFileName": "blablabla.exe",
                    "PEType": "PE32",
                    "ProductName": "blablabla",
                    "ProductVersion": "1.3.30.0",
                    "ProductVersionNumber": "1.3.30.0",
                    "Subsystem": "Windows GUI",
                    "SubsystemVersion": "5.0",
                    "TimeStamp": "2020:04:16 15:35:24+02:00",
                    "UninitializedDataSize": "0"
                },
                "first_submission_date": 1587049407,
                "last_analysis_date": 1588653326,
                "last_analysis_results": {
                    "ALYac": {
                        "category": "malicious",
                        "engine_name": "ALYac",
                        "engine_update": "20200505",
                        "engine_version": "1.1.1.5",
                        "method": "blacklist",
                        "result": "Trojan.GenericKD.42996961"
                    },
                    "APEX": {
                        "category": "malicious",
                        "engine_name": "APEX",
                        "engine_update": "20200504",
                        "engine_version": "6.18",
                        "method": "blacklist",
                        "result": "Malicious"
                    },
                    "AVG": {
                        "category": "undetected",
                        "engine_name": "AVG",
                        "engine_update": "20200505",
                        "engine_version": "18.4.3895.0",
                        "method": "blacklist",
                        "result": null
                    },
                    "Acronis": {
                        "category": "malicious",
                        "engine_name": "Acronis",
                        "engine_update": "20200422",
                        "engine_version": "1.1.1.75",
                        "method": "blacklist",
                        "result": "suspicious"
                    },
                    "Ad-Aware": {
                        "category": "malicious",
                        "engine_name": "Ad-Aware",
                        "engine_update": "20200505",
                        "engine_version": "3.0.5.370",
                        "method": "blacklist",
                        "result": "Trojan.GenericKD.42996961"
                    },
                    "AegisLab": {
                        "category": "undetected",
                        "engine_name": "AegisLab",
                        "engine_update": "20200505",
                        "engine_version": "6.18",
                        "method": "blacklist",
                        "result": null
                    }
                }
            }
        }
    ]
}
```

--------------------------------

### Root domain appearing in a sample behavior for first time

Source: https://docs.virustotal.com/docs/nethunt-examples

Detects when the root domain example.com appears in a sample behavior for the first time. The condition requires the root domain to match and the communicating file to be new for the domain.

```YARA
import "vt"

rule newDomainRelationshipForIOC {
meta:
  description = "Root domain appearing in a sample behavior for first time"
  author = "virustotal"
  target_entity = "domain"
condition:
  vt.net.domain.root == "example.com" and
  vt.net.domain.communicating_file.new_for_domain
}
```

--------------------------------

### Example response for GET /api/v3/yara_rules

Source: https://docs.virustotal.com/reference/list-crowdsourced-yara-rules

Example response from the List Crowdsourced YARA Rules endpoint. Shows a single rule with metadata, the YARA rule source, and pagination links.

```json
{
	"meta": {
		"cursor": "Ck8KDwoCbG0SCQjdvIy9kdv-AhI4ahFzfnZpcnVzdG90YWxjbG91ZHIjCxIIWWFyYVJ1bGUiFTAwM2UxYzUxZWZ8UEtfQVhBX2Z1bgwYACAB"
	},
	"data": [
		{
			"attributes": {
				"name": "PK_AXA_fun",
				"tags": [
					"AXA"
				],
				"matches": 0,
				"author": "Thomas Damonneville",
				"enabled": true,
				"rule": "rule PK_AXA_fun : AXA\n{\n    meta:\n        description = \"Phishing Kit impersonating AXA banque\"\n        licence = \"GPL-3.0\"\n        author = \"Thomas Damonneville\"\n        reference = \"\"\n        date = \"2023-05-02\"\n        comment = \"Phishing Kit - AXA - using a fun.php page\"\n\n    strings:\n        // the zipfile working on\n        $zip_file = { 50 4b 03 04 }\n        $spec_dir = \"css\"\n        $spec_dir2 = \"images\"\n        // specific file found in PhishingKit\n        $spec_file = \"detail.html\"\n        $spec_file2 = \"fun.php\"\n        $spec_file3 = \"fin.html\"\n        $spec_file4 = \"axa_pp_blanc.min.css\"\n\n    condition:\n        // look for the ZIP header\n        uint32(0) == 0x04034b50 and\n        // make sure we have a local file header\n        $zip_file and\n        // check for file\n        all of ($spec_file*) and\n        all of ($spec_dir*)\n}",
				"creation_date": 1682985600,
				"meta": [
					{
						"key": "description",
						"value": "Phishing Kit impersonating AXA banque"
					},
					{
						"key": "licence",
						"value": "GPL-3.0"
					},
					{
						"key": "author",
						"value": "Thomas Damonneville"
					},
					{
						"key": "reference",
						"value": ""
					},
					{
						"key": "date",
						"value": "2023-05-02"
					},
					{
						"key": "comment",
						"value": "Phishing Kit - AXA - using a fun.php page"
					}
				],
				"last_modification_date": 1683185194
			},
			"type": "yara_rule",
			"id": "003e1c51ef|PK_AXA_fun",
			"links": {
				"self": "https://www.virustotal.com/api/v3/yara_rules/003e1c51ef|PK_AXA_fun"
			}
		}
	],
	"links": {
		"self": "https://www.virustotal.com/api/v3/yara_rules?limit=1",
		"next": "https://www.virustotal.com/api/v3/yara_rules?cursor=Ck8KDwoCbG0SCQjdvIy9kdv-AhI4ahFzfnZpcnVzdG90YWxjbG91ZHIjCxIIWWFyYVJ1bGUiFTAwM2UxYzUxZWZ8UEtfQVhBX2Z1bgwYACAB&limit=1"
	}
}
```

--------------------------------

### API v2 - Python GET and POST requests example

Source: https://docs.virustotal.com/reference/api-v2-v3-migration-guide

Shows how to make GET and POST requests in VirusTotal API v2, where the API key is passed as a request parameter. This approach can expose the API key in GET requests if intercepted or logged.

```python
# API v2 - Python GET and POST requests example
params = {'apikey':VT_API_KEY, 'query': query}
response = requests.get(url, params=params)
response = requests.post(url, params=params)
```

--------------------------------

### Port Info object example (generic)

Source: https://docs.virustotal.com/reference/port-info-object

Shows the generic structure of a Port Info object with placeholder values. Use as a template for understanding the object's fields.

```json
{
  "type": "port_info",
  "id": <string>,
  "attributes": {
    "netloc": <string>,
    "entity_type": <string>,
    "port": <integer>,
    "status": <string>,
    "first_seen": <integer>,
    "last_seen": <integer>,
    "open_since": <integer>,
    "last_seen_open": <integer>,
    "latest_analysis": <dictionary>
  },
  "links": {
    "self": <string>
  }
}
```

--------------------------------

### Example response for ZIP file status

Source: https://docs.virustotal.com/reference/get-zip-files

Example JSON response from the endpoint. The 'status' attribute can be 'starting', 'creating', 'finished', 'timeout', 'error-starting', or 'error-creating'. When status is 'finished', the file can be downloaded.

```json
{
  "data": {
    "type": "zip_file",
    "id": "4939392292",
    "attributes": {
      "status": "creating",
      "progress": 45,
      "files_ok": 3,
      "files_error": 0
    }  
  }
}
```

--------------------------------

### Example response with actual collection data

Source: https://docs.virustotal.com/reference/user-object-collections

Shows a concrete example response from the collections endpoint, including a collection object with attributes like name, description, and counts, as well as pagination links and meta cursor.

```json
{
  "meta": {
    "count": 2,
    "cursor": "CocBChoKDWNyZWF0aW9uX2RhdGUSCQjmsteuveDyAhJlahFzfnZpcnVzdG90YWxjbG91ZHJQCxIKQ29sbGVjdGlvbiJAZGUyZGM5MmU5ZThkYTQ3OWVmY2JkZjczMTBhMWI1ZTY3ODgxYmYxMGRjOTFmNmU1ZjcxNTlhNTJjMjlhODEyZQwYACAB"
  },
  "data": [
    {
      "attributes": {
        "description": "Test collection",
        "name": "Prevx infected",
        "tags": [],
        "ip_addresses_count": 0,
        "targeted_industries": [],
        "domains_count": 0,
        "creation_date": 1630592216,
        "references_count": 0,
        "alt_names": [],
        "urls_count": 0,
        "autogenerated_tags": [
          "bobsoft",
          "pecompact",
          "themida",
          "rlpack",
          "yoda",
          "mew",
          "aspack",
          "nspack",
          "attachment",
          "pespin",
          "molebox",
          "telock",
          "yodaprot",
          "ahpack",
          "armadillo",
          "execryptor",
          "upack",
          "asprotect",
          "xorcrypt",
          "fsg",
          "ntkrnl",
          "upx"
        ],
        "last_modification_date": 1630592216,
        "top_icon_md5": [
          "4e36c557b0188de9290a9ff9685cce17",
          "5fff7c360c84b7ad1554b722598fb43c",
          "44abfa8c8002712b3ed19f8f2847dd0d"
        ],
        "targeted_countries": [],
        "files_count": 1234
      },
      "type": "collection",
      "id": "de2dc92e9e8da479efcbdf7310a1b5e67881bf10dc91f6e5f7159a52c29a812e",
      "links": {
        "self": "https://www.virustotal.com/api/v3/collections/de2dc92e9e8da479efcbdf7310a1b5e67881bf10dc91f6e5f7159a52c29a812e"
      }
    }
  ],
  "links": {
    "self": "https://www.virustotal.com/api/v3/users/roadrunner/collections?filter=name%3Ainfected&limit=1&order=creation_date-",
    "next": "https://www.virustotal.com/api/v3/users/roadrunner/collections?filter=name%3Ainfected&cursor=CocBChoKDWNyZWF0aW9uX2RhdGUSCQjmsteuveDyAhJlahFzfnZpcnVzdG90YWxjbG91ZHJQCxIKQ29sbGVjdGlvbiJAZGUyZGM5MmU5ZThkYTQ3OWVmY2JkZjczMTBhMWI1ZTY3ODgxYmYxMGRjOTFmNmU1ZjcxNTlhNTJjMjlhODEyZQwYACAB&limit=1&order=creation_date-"
  }
}
```

--------------------------------

### cURL request to get a private analysis

Source: https://docs.virustotal.com/reference/private-analysis

Sends a GET request to the private analyses endpoint with the analysis ID in the URL and an accept header for JSON. Requires an API key in the x-apikey header (not shown in the example).

```shell
curl --request GET \
     --url https://www.virustotal.com/api/v3/private/analyses/id \
     --header 'accept: application/json'
```

--------------------------------

### Example response for /users/{id}/hunting_rulesets

Source: https://docs.virustotal.com/reference/user-object-hunting-rulesets

Shows the general structure of the response for the hunting_rulesets relationship. Contains a data array with placeholder Hunting Ruleset objects, plus links and meta fields.

```json
{
  "data": [
    <HUNTING_RULESET_OBJECT>,
    <HUNTING_RULESET_OBJECT>,
    ...
  ],
  "links": {
    "next": "<string>",
    "self": "<string>"
  },
  "meta": {
    "count": <int>,
    "cursor": "<string>"
  }
}
```

--------------------------------

### Example JSON response with download URL

Source: https://docs.virustotal.com/reference/files-download-url

Shows the JSON response containing the signed download URL. The URL can be used multiple times without consuming quota, but expires after 1 hour.

```json
{
  "data": "https://vtsamples.commondatastorage.googleapis.com/275a..fd0f?GoogleAccessId=758681729565-rc7fcckv235v1@developer.gserviceaccount.com&Expires=1524733537&Signature=GRs9WLy...oHA%3D"
}
```
Tokens:
Raw