### Pre-installation Script

Source: https://docs.virustotal.com/reference/file-object-deb-info

The preinst script runs before the package installation begins. It can be used for initial setup or checks required before the main installation process.

```bash
#!/bin/bash
# $Id: preinst 127855 2019-01-01 01:45:53Z bird $
## @file
# Blabla pre-install.
#
# Copyright (C) 2006-2019 Blabla Systems

```

--------------------------------

### Example Malware Configuration

Source: https://docs.virustotal.com/reference/file-object-malware-config

An example of a populated malware_config field, demonstrating typical key-value pairs such as campaign ID, domain, family, and installation details.

```json
{
    "data": {
        "attributes": {
            "malware_config": {
                "campaign_id": "Hcwfjr",
                "domain": "0.tcp.ngggke.io",
                "family": "njRat",
                "install_dir": "TEMP",
                "install_flag": "True",
                "install_name": "server1.exe",
                "network_separator": "|"|"",
                "port": "18354",
                "registry_value": "92893539d5d3558f5b256571544dccb0",
                "version": "0.7d"
            }
        }
    }
}
```

--------------------------------

### Install vt-py using pip

Source: https://docs.virustotal.com/docs/batch-file-downloads

Install the official VirusTotal Python client library using pip. This is the recommended installation method.

```bash
$ pip install vt-py
```

--------------------------------

### Monitor Info Example

Source: https://docs.virustotal.com/reference/file-object-monitor-info

An example of the monitor_info field showing a specific filename and organization.

```json
{
  "data": {
    "attributes": {
      "monitor_info": {
        "filenames": [
          "testfilename"
        ],
        "organizations": [
          "Example Inc."
        ]
      },
    }
}

```

--------------------------------

### Example HTTP Conversation

Source: https://docs.virustotal.com/reference/http-conversation

An example of a single HTTP GET request and its corresponding response, including headers, status code, and file type.

```json
{
    "data": {
        "attributes": {
            "http_conversations": [
                {
                    "request_headers": {
                        "Accept": "*/*",
                        "User-Agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)"
                    },
                    "request_method": "GET",
                    "response_body_filetype": "PDF",
                    "response_headers": {
                        "Cache-Control": "no-cache",
                        "Connection": "keep-alive",
                        "Content-Type": "text/html; charset=UTF-8",
                        "Date": "Sat, 23 Nov 2019 09:02:26 GMT",
                        "Server": "nginx/1.14.0",
                        "Status-Line": "HTTP/1.1 200",
                        "Transfer-Encoding": "chunked",
                        "Vary": "Accept-Encoding",
                        "X-Powered-By": "PHP/7.2.9"
                    },
                    "response_status_code": 200,
                    "url": "http://foo.blablabla.com/blablabla.pdf"
                }
            ]
        }
    }
}
```

--------------------------------

### Install vt-py using setup.py

Source: https://docs.virustotal.com/docs/batch-file-downloads

Install the vt-py library after obtaining the source code, using the setup.py script.

```bash
$ sudo python3 setup.py install
```

--------------------------------

### Install vt-py from source tarball

Source: https://docs.virustotal.com/docs/batch-file-downloads

Download and extract the vt-py source code tarball, then install it using setup.py.

```bash
$ tar -zxvf vt-py-X.Y.Z.tar.gz
$ cd vt-py-X.Y.Z
```

--------------------------------

### Example ISO Image File Information

Source: https://docs.virustotal.com/reference/file-object-isoimage-info

This example demonstrates a populated isoimage_info object, showing specific values for application ID, creation date, data preparer, file counts, and volume identifiers.

```json
{
    "data": {
        "attributes": {
            "isoimage_info": {
                "application_id": "CDIMAGE 2.56 (01/01/2005 TM)",
                "created": "2012-10-04 17:00:00",
                "data_preparer_id": "MICROSOFT CORPORATION, ONE MICROSOFT WAY, REDMOND WA 98052, (425) 882-8080",
                "effective": "0000-00-00 00:00:00",
                "expires": "0000-00-00 00:00:00",
                "file_structure_version": 1,
                "max_date": "2012-10-04 06:34:35",
                "min_date": "2011-12-13 22:04:47",
                "modified": "0000-00-00 00:00:00",
                "num_files": 127,
                "publisher_id": "MICROSOFT CORPORATION",
                "total_size": 5086954,
                "type_code": "CD001",
                "volume_id": "15.0.4420.1017",
                "volume_set_id": "15.0.4420.1017"
            }
        }
    }
}
```

--------------------------------

### Example OpenVPN Client Configuration

Source: https://docs.virustotal.com/docs/openvpn-support-on-private-scanning

A sample OpenVPN client configuration file. Ensure all keys and certificates are embedded directly within the file.

```openvpn
# Specify that we are a client.
client

# Currently we only support TUN interface
dev tun

# Currently we only support UDP to encapsulate traffic
proto udp

# The hostname/IP and port of the server.
remote 1.2.3.4 1194

# Always try to resolve the hostname of the OpenVPN server.
resolv-retry infinite

# Most clients don't need to bind to a specific local port number.
nobind

# Try to preserve some state across restarts.
persist-key
persist-tun

# Select a cryptographic cipher.
cipher AES-256-GCM
auth SHA256
# Certificate Authority 
<ca>
<REDACTED CA CERTIFICATE CONTENT>
</ca>

# User certificate
<cert>
redacted_certificate_content
</cert>

# This is the client's private key
<key>
<REDACTED KEY CONTENT>
</key>
```

--------------------------------

### Example Traffic Inspection Data

Source: https://docs.virustotal.com/reference/file-object-files-traffic-inspection

This example demonstrates the structure of traffic inspection data, showing two HTTP GET requests with details like binary hash, URL, and response size.

```json
{
    "data": {
        "attributes": {
            "traffic_inspection": {
                "http": [
                    {
                        "binary_hash": "0e735aab56c55e954405cef52a5d9e59935c4a5ea151b85eb5a1cf5b25a50505",
                        "binary_magic": "ASCII text, with very long lines, with no line terminators",
                        "datetime": "2020-06-03 22:56:01.449486",
                        "interesting_magic": 0,
                        "method": "GET",
                        "remote_host": "66.66.66.66:80",
                        "response_code": "200",
                        "response_size": 226132,
                        "url": "http://blablabla.com/blablabla.jpg",
                        "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)"
                    },
                    {
                        "binary_hash": "0e73f4ab6645649e4402ce452a4d9eb9431c4adea141b8b4b3a14fbb24a20e05",
                        "binary_magic": "ASCII text, with very long lines, with no line terminators",
                        "datetime": "2020-06-03 22:56:32.097305",
                        "interesting_magic": 0,
                        "method": "GET",
                        "remote_host": "66.66.66.66:80",
                        "response_code": "200",
                        "response_size": 226132,
                        "url": "http://blablabla.com/blablabla2.jpg",
                        "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)"
                    }
                ]
            }
        }
    }
}
```

--------------------------------

### IPA Info Example with Mach-O Commands

Source: https://docs.virustotal.com/reference/file-object-ipa-info

This example shows a snippet of the 'ipa_info' data, specifically detailing the Mach-O executable information. It lists various load commands and header details for the application binary.

```json
{
    "data": {
        "attributes": {
            "ipa_info": {
                "apps": [
                    {
                        "commands": [
                            {
                                "type": "LC_DYLD_INFO_ONLY"
                            },
                            {
                                "type": "LC_SYMTAB"
                            },
                            {
                                "type": "LC_DYSYMTAB"
                            },
                            {
                                "type": "LC_LOAD_DYLINKER"
                            },
                            {
                                "type": "LC_UUID"
                            }
                        ],
                        "headers": {
                            "cpu_subtype": "ARM_V7",
                            "cpu_type": "ARM",
                            "entrypoint": "0xe5ed",
                            "file_type": "executable file",
                            "flags": [
                                "BINDS_TO_WEAK",
                                "DYLDLINK",
                                "NOUNDEFS",
                                "PIE",
                                "TWOLEVEL",
                                "WEAK_DEFINES"
                            ],
                            "magic": "0xfeedface",
                            "num_cmds": 54
                        }
                    }
                ],
                "plist": {},
                "provision": {}
            }
        }
    }
}
```

--------------------------------

### Get File Content Search Snippets (Bad Request Example)

Source: https://docs.virustotal.com/reference/intelligence-search-snippets

This example illustrates a 'Bad Request' error response, typically occurring due to an invalid API token. It shows the error structure with a 'code' and 'message'.

```json
{
  "error": {
    "code": "BadRequestError",
    "message": "Invalid token"
  }
}
```

--------------------------------

### Get File Content Search Snippets (Success Example)

Source: https://docs.virustotal.com/reference/intelligence-search-snippets

This example demonstrates a successful response when retrieving file content search snippets. It shows the structure of the 'data' array containing matched content in hexdump and plain text formats.

```json
{
  "data": [
    "01CEE0A0: 09 20 2A 0A 09 20 2A  20 45 78 61 6D 70 6C 65 3A  . *.. * Example:\n01CEE0B0: 0A 09 20 2A 0A 09 20 2A  20 20 20 20 20 35 68 65  .. *.. *     5he\n01CEE0C0: 6C 6C 6F 20 77 6F 72 6C  64 0A 09 20 2A 20 20 20   llo world.. *   ",
    "01CEF650: 6D 70 6C 65 3A 0A 09 20  2A 0A 09 20 2A 20 20 20  mple:.. *.. *   \n01CEF660: 20 20 31 31 3A 68 65 6C  6C 6F 20 77 6F 72 6C 64    11:hel lo world\n01CEF670: 32 3A 68 69 0A 09 20 2A  0A 09 20 2A 20 49 66 20  2:hi.. *.. * If ",
    "01D22020: 5C 6E 20 2A 20 45 78 61  6D 70 6C 65 3A 5C 6E 20  \n * Example:\n \n01D22030: 2A 5C 6E 20 2A 20 20 20  20 20 35 68 65 6C 6C 6F  *\n *     5hel lo\n01D22040: 20 77 6F 72 6C 64 5C 6E  20 2A 20 20 20 20 20 33   world \n *     3",
    "02C29AB0: 6C 6F 67 28 68 65 6C 6C  6F 2C 20 27 77 6F 72 6C  log(hello, 'worl\n02C29AC0: 64 27 29 3B 0A 20 2A 20  27 68 65 6C 6C 6F 20 77  d');. * 'he llo w\n02C29AD0: 6F 72 6C 64 27 0A 20 2A  2F 0A 65 78 70 6F 72 74   orld '. */.export",
    "02C643E0: 28 68 65 6C 6C 6F 2C 20  27 77 6F 72 6C 64 27 29  (hello, 'world')\n02C643F0: 3B 0A 20 2A 20 27 68 65  6C 6C 6F 20 77 6F 72 6C  ;. * 'he llo worl\n02C64400: 64 27 0A 20 2A 2F 0A 76  61 72 20 6C 6F 67 20 3D  d '. */.var log ="
  ]
}
```

--------------------------------

### Example Bundle Info

Source: https://docs.virustotal.com/reference/file-object-bundle-info

An example of bundle_info for a ZIP file, showing extensions, file types, dates, password, and size.

```json
{
    "data": {
        "attributes": {
            "bundle_info": {
                "extensions": {
                    "exe": 1
                },
                "file_types": {
                    "Portable Executable": 1,
                    "XML": 1
                },
                "highest_datetime": "2017-06-07 09:07:38",
                "lowest_datetime": "1980-01-00 00:00:00",
                "num_children": 2,
                "password": "infected",
                "type": "ZIP",
                "uncompressed_size": 222702
            }
        }
    }
}
```

--------------------------------

### Example Response Body for ZIP File Creation

Source: https://docs.virustotal.com/reference/create-zip-files

This is an example of the response you will receive after requesting a ZIP file. It includes the ZIP file's ID, status, and progress. You must poll the GET /intelligence/zip_files/{id} endpoint to track completion.

```json
{
  "data": {
    "type": "zip_file",
    "id": "4939392292",
    "attributes": {
      "status": "starting",
      "progress": 0,
      "files_ok": 0,
      "files_error": 0
    }  
  }
}
```

--------------------------------

### Basic OpenVPN Server Setup Script

Source: https://docs.virustotal.com/docs/openvpn-support-on-private-scanning

A bash script to automate the basic setup of an OpenVPN server on a Linux system. Requires modifications for interface names, VPN subnet, and other placeholders.

```bash
#!/usr/bin/env bash

# Basic OpenVPN setup script

```

--------------------------------

### Example Request Body

Source: https://docs.virustotal.com/reference/collections-comments-create

The request body must be a JSON object representing a comment. Words starting with '#' in the text are treated as tags.

```json
{
  "data": {
    "type": "comment",
    "attributes": {
    	"text": "Lorem #ipsum dolor sit ..."
    }
  }
}
```

--------------------------------

### Get Monitor Items by Tag

Source: https://docs.virustotal.com/reference/monitor-items-filter

Retrieves a list of MonitorItem objects filtered by one or more tags. This example shows filtering by the 'detected' tag.

```APIDOC
## GET /monitor/items

### Description
Retrieves a list of MonitorItem objects filtered by a specified tag.

### Method
GET

### Endpoint
/monitor/items

### Query Parameters
- **filter** (string) - Required - The filter criteria. Use `tag:<tag_name>` to filter by tag. Example: `tag:detected`.
```

--------------------------------

### Example JAR File Information Response

Source: https://docs.virustotal.com/reference/file-object-jar-info

This is an example of the detailed information returned for a JAR file, including lists of filenames, file types, manifest content, date information, package names, and extracted strings.

```json
{
    "data": {
        "attributes": {
            "jar_info": {
                "filenames": [
                    "META-INF/MANIFEST.MF",
                    "net/blabla/blabla/blabla/blabla.class",
                    "net/blabla/blabla/blabla/blabla2.class",
                    "net/blabla/blabla/blabla/blabla3.class"
                ],
                "files_by_type": {
                    "ascii": 490,
                    "binary": 16,
                    "class": 760,
                    "jpg": 2,
                    "ogg": 3,
                    "png": 441
                },
                "manifest": "Manifest-Version: 1.0",
                "max_date": "2020-06-18 20:46:02",
                "max_depth": 5,
                "min_date": "2020-06-18 20:45:58",
                "packages": [
                    "java.io",
                    "java.lang",
                    "java.lang.Comparable<Lnet.blabla.blabla",
                    "java.lang.annotation",
                    "java.lang.invoke",
                    "java.lang.reflect",
                    "java.util",
                    "java.util.HashMap<Ljava.lang"
                ],
                "strings": [
                    ",,,,,,,",
                    ",/execute",
                    ",Ljava/util/Set<Lnet/blabla/block/Block",
                    ",Lnet/blabla/client/entity/blabla",
                    ",Lnet/blabla/entity/player/blabla2"
                ],
                "total_dirs": 36,
                "total_files": 1712
            }
        }
    }
}
```

--------------------------------

### Get User API Usage

Source: https://docs.virustotal.com/reference/user-api-usage

Retrieves the API usage data for a specific user. You can filter the results by specifying a start and end date.

```APIDOC
## GET /users/{id}/api_usage

### Description
Get a user

### Method
GET

### Endpoint
https://www.virustotal.com/api/v3/users/{id}/api_usage

### Parameters
#### Path Parameters
- **id** (string) - Required - User ID or API key

#### Query Parameters
- **start_date** (string) - Optional - A string in format YYYYMMDD
- **end_date** (string) - Optional - A string in format YYYYMMDD

#### Headers
- **x-apikey** (string) - Required - Your API key

### Response
#### Success Response (200)
- **Result** (object) - Example: {}

#### Error Response (400)
- **Result** (object) - Example: {}
```

--------------------------------

### Get Group API Usage

Source: https://docs.virustotal.com/reference/group-api-usage

Fetches the API usage statistics for a specified group. You can filter the results by providing a start and end date.

```APIDOC
## GET /groups/{id}/api_usage

### Description
Retrieves the API usage data for a specific group, allowing for optional date range filtering.

### Method
GET

### Endpoint
/groups/{id}/api_usage

### Parameters
#### Path Parameters
- **id** (string) - Required - The unique identifier of the group.

#### Query Parameters
- **start_date** (string) - Optional - Filters usage data from this date onwards. Format: YYYYMMDD.
- **end_date** (string) - Optional - Filters usage data up to this date. Format: YYYYMMDD.

#### Headers
- **x-apikey** (string) - Required - Your VirusTotal API key for authentication.

### Response
#### Success Response (200)
- The response will contain an object detailing the group's API usage. The exact structure is defined by the schema, which is an empty object in this example, implying a flexible or detailed response not fully specified here.

#### Response Example
{
  "example": "{}"
}
```

--------------------------------

### Example LNK File Information

Source: https://docs.virustotal.com/reference/file-object-lnk-info

This is an example of the JSON response when querying for LNK file information. It includes details like common path, machine ID, modification date, and link flags.

```json
{
  "data": {
    "attributes": {
      "lnkcheck": {
        "common_path": "C:\\Program Files\\Greenrain\\Submission\\unins000.exe", 
        "machine_id": "445817", 
        "modification_date": "2016-07-27T18:25:43.570251Z", 
        "link_flags": [
          "HasLinkInfo", 
          "HasRelativePath", 
          "IsUnicode", 
          "HasWorkingDir", 
          "HasExprString", 
          "EnableTargetMetadata"
        ],
        "vhash": "1234567890", 
        "network_share_name": "\\USER\\HTMLQA", 
        "creation_date": "2016-06-28T21:49:46.108805Z", 
        "header": {
          "show_window": 1, 
          "show_window_str": "SW_NORMAL", 
          "hot_key": "(0+0)", 
          "file_size": 6486
        },
        "relative_path": "..\\..\\..\\..\\..\\..\\Program Files\\Greenrain\\Submission\\unins000.exe", 
        "local_path": "C:\\Program Files\\Greenrain\\Submission\\unins000.exe", 
        "working_directory": "C:\\Program Files\\Greenrain\\Submission", 
        "mac_address": "00:50:56:a0:09:e3", 
        "access_date": "2016-06-28T21:49:46.108805Z", 
        "extra_data": {
          "dlt_properties": {
            "birth_droid_file_id": "33a6be73-453c-11e6-9444-00155d0b8406", 
            "droid_file_id": "33a6be73-453c-11e6-9444-00155d0b8406", 
            "birth_droid_volume_id": "85cdf8e2-5f07-4f3a-a953-67709a1e8150", 
            "droid_volume_id": "85cdf8e2-5f07-4f3a-a953-67709a1e8150"
          }
        },
        "mac_vendor_name": "VMware, Inc."
      }
    }
  }
}
```

--------------------------------

### Example NSRL Information

Source: https://docs.virustotal.com/reference/file-object-nsrl-info

This example demonstrates a populated nsrl_info object, showing sample filenames and software products associated with a file found in the NSRL. This format is now deprecated.

```json
{
    "data": {
        "attributes": {
            "nsrl_info": {
                "filenames": [
                    "NULL.TXT",
                    "x0r.{kf",
                    "x0r.{kc"
                ],
                "products": [
                    "Quicken (Unknown)",
                    "Linux Format Great Game Demos (Future Publishing)",
                    "DISTROS GALORE Gentoo Linux 2005.0 and Ubuntu 5.04 (Future Publishing)",
                    "Slackware Linux 10.1 (Linux Magazine)"
                ]
            }
        }
    }
}
```

--------------------------------

### Get Monitor Items by Path

Source: https://docs.virustotal.com/reference/monitor-items-filter

Retrieves a list of MonitorItem objects filtered by their path. This example shows filtering items within the root directory.

```APIDOC
## GET /monitor/items

### Description
Retrieves a list of MonitorItem objects filtered by their path.

### Method
GET

### Endpoint
/monitor/items

### Query Parameters
- **filter** (string) - Required - The filter criteria. Use `path:/your/folder/` to filter by path. Example: `path:/`.
```

--------------------------------

### API v3 Python Requests (GET/POST)

Source: https://docs.virustotal.com/reference/api-v2-v3-migration-guide

Example of making GET and POST requests using API v3, where the API key is sent in the headers and resources are part of the URL.

```python
# API v3 - Python GET and POST requests example
headers = {'accept': 'application/json', 'x-apikey': VT_API_KEY}
response = requests.get(url, headers=headers)
response = requests.post(url, headers=headers)
```

--------------------------------

### Example Subtechnique Object: Setuid and Setgid

Source: https://docs.virustotal.com/reference/attack-technique-object-subtechniques

This is an example of a sub-technique object returned for 'Setuid and Setgid'. It includes attributes like MITRE ATT&CK information, platform compatibility, and detection guidance.

```json
{
  "meta": {
    "count": 4
  },
  "data": [
    {
      "attributes": {
        "info": {
          "x_mitre_platforms": [
            "Linux",
            "macOS"
          ],
          "x_mitre_is_subtechnique": true,
          "x_mitre_permissions_required": [
            "User"
          ],
          "x_mitre_version": "1.0",
          "x_mitre_data_sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
          ],
          "x_mitre_detection": "Monitor the file system for files that have the setuid or setgid bits set. Monitor for execution of utilities, like chmod, and their command-line arguments to look for setuid or setguid bits being set."
        },
        "revoked": false,
        "name": "Setuid and Setgid",
        "creation_date": 1580393501,
        "link": "https://attack.mitre.org/techniques/T1548/001/",
        "stix_id": "attack-pattern--6831414d-bb70-42b7-8030-d4e06b2660c9",
        "last_modification_date": 1585269838,
        "description": "An adversary may perform shell escapes or exploit vulnerabilities in an application with the setsuid or setgid bits to get code running in a different user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application, the application will run with the privileges of the owning user or group respectively. . Normally an application is run in the current user’s context, regardless of which user or group owns the application. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them doesn’t need the elevated privileges.\nInstead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications. These bits are indicated with an \"s\" instead of an \"x\" when viewing a file's attributes via ls -l. The chmod program can set these bits with via bitmasking, chmod 4777 [file] or via shorthand naming, chmod u+s [file).\nAdversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.."
      },
      "type": "attack_technique",
      "id": "T1548.001",
      "links": {
        "self": "https://www.virustotal.com/api/v3/attack_techniques/T1548.001"
      }
    },
    {
      "attributes": {
        "info": {
          "x_mitre_contributors": [
            "Stefan Kanthak",
            "Casey Smith"
          ],
          "x_mitre_defense_bypassed": [
            "Windows User Account Control"
          ],
          "x_mitre_platforms": [
            "Windows"
          ],
          "x_mitre_is_subtechnique": true,
          "x_mitre_permissions_required": [
            "Administrator",
            "User"
          ],
          "x_mitre_effective_permissions": [
            "Administrator"
          ],
          "x_mitre_version": "2.0",
          "x_mitre_data_sources": [
            "Windows Registry",
            "Process command-line parameters",
            "Process monitoring"
          ],
          "x_mitre_detection": "There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Monitor process API calls for behavior that may be indicative of Process Injection and unusual loaded DLLs through DLL Search Order Hijacking, which indicate attempts to gain access to higher privileged processes.\nSome UAC bypass methods rely on modifying specific, user-accessible Registry settings. For example:\n\n\nThe eventvwr.exe bypass uses the [HKEY_CURRENT_USER]\Software\Classes\mscfile\shell\open\command Registry key.\n\n\nThe sdclt.exe bypass uses the [HKEY_CURRENT_USER]\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe and [HKEY_CURRENT_USER]\Software\Classes\exefile\shell\runas\command\isolatedCommand Registry keys.\n\n\nAnalysts should monitor these Registry settings for unauthorized changes."
        },
        "revoked": false,

```

--------------------------------

### API v2 Python Requests (GET/POST)

Source: https://docs.virustotal.com/reference/api-v2-v3-migration-guide

Example of making GET and POST requests using API v2, where the API key and query parameters are sent in the request body.

```python
# API v2 - Python GET and POST requests example
params = {'apikey':VT_API_KEY, 'query': query}
response = requests.get(url, params=params)
response = requests.post(url, params=params)
```

--------------------------------

### Example Search URL with Cursor

Source: https://docs.virustotal.com/reference/search-iocs-inside-a-collection

This example demonstrates how to paginate through search results using the 'cursor' parameter. This is essential for retrieving all results when the dataset exceeds the limit.

```http
https://www.virustotal.com/api/v3/collections/malpedia_win_emotet/search?cursor=eJwNyTEOgzAMBdAroZSVhYJQkOwo6ANK1nao7GTqAFgcvn3ru3cbHZtvGOkIw_j1z7kS-k9GvMh6IZslQx__t7RvkiqdjEUTuNCwtlm0ZbwcybsQ9ODqHVm8AoqEiTVMq7HE05emu381USYK&query=name%3Aemotet&limit=2&attributes=names
```

--------------------------------

### cURL Request Example

Source: https://docs.virustotal.com/reference/privatefile_behaviourssandbox_idrelationship

Demonstrates how to make a GET request to retrieve related objects for a private file's behavior report. Ensure you have the necessary API key and sandbox ID.

```shell
curl --request GET \
     --url 'https://www.virustotal.com/api/v3/private/file_behaviours/sandbox_id/relationship?limit=10' \
     --header 'accept: application/json'
```

--------------------------------

### Example MachO File Information

Source: https://docs.virustotal.com/reference/file-object-macho-info

This example demonstrates the structure of the 'macho_info' attribute for a specific MachO file, including its commands, headers, libraries, and segments.

```json
{
    "data": {
        "attributes": {
            "macho_info": [
                {
                    "commands": [
                        {
                            "type": "LC_UUID"
                        },
                        {
                            "type": "LC_DYLD_INFO_ONLY"
                        },
                        {
                            "type": "LC_SYMTAB"
                        },
                        {
                            "type": "LC_DYSYMTAB"
                        },
                        {
                            "type": "LC_LOAD_DYLIB"
                        }
                    ],
                    "headers": {
                        "cpu_subtype": "I386_ALL",
                        "cpu_type": "i386",
                        "file_type": "dynamically bound bundle file",
                        "flags": [
                            "DYLDLINK",
                            "NOUNDEFS",
                            "TWOLEVEL"
                        ],
                        "magic": "0xfe4d4ace",
                        "num_cmds": 8,
                        "size_cmds": 1008
                    },
                    "libs": [
                        "/usr/lib/libSystem.B.dylib"
                    ],
                    "segments": [
                        {
                            "fileoff": "0x0",
                            "filesize": "0x6000",
                            "name": "__TEXT",
                            "sections": [
                                {
                                    "flags": [
                                        "SECTION_ATTRIBUTES_USR",
                                        "SECTION_ATTRIBUTES_SYS"
                                    ],
                                    "name": "__text",
                                    "type": "S_REGULAR"
                                },
                                {
                                    "flags": [],
                                    "name": "__cstring",

```