VirusTotal, Threat Intelligence

VirusTotal aggregates results from 70+ antivirus engines and threat intelligence feeds. Check file hashes, URLs, domains, and IP addresses for known malware, phishing, and suspicious activity.

Requires: VIRUSTOTAL_API_KEY, free at https://www.virustotal.com/gui/my-apikey (4 req/min on free tier).

When to Use

• User has a file hash and wants to know if it is malware
• User has a suspicious URL and wants a reputation check
• User is investigating an incident and needs threat context for a domain or IP
• User asks "is this hash malicious?", "check this URL", or "is this domain flagged?"
• SOC/IR workflow: triage IOCs (indicators of compromise) quickly

How to Use

Check a file hash (MD5, SHA-1, or SHA-256)

$hash = "44d88612fea8a8f36de82e1278abb02f"   # EICAR test file
$key  = $env:VIRUSTOTAL_API_KEY
$url  = "https://www.virustotal.com/api/v3/files/$hash"

$result = Invoke-RestMethod -Uri $url -Headers @{ "x-apikey" = $key }
$stats  = $result.data.attributes.last_analysis_stats
Write-Host "File: $($result.data.attributes.meaningful_name)"
Write-Host "Malicious:  $($stats.malicious) / $($stats.malicious + $stats.undetected + $stats.harmless)"
Write-Host "Suspicious: $($stats.suspicious)"
Write-Host "First seen: $($result.data.attributes.first_submission_date)"

Check a URL for malware or phishing

$targetUrl = "https://example.com"
$key       = $env:VIRUSTOTAL_API_KEY

# URL id = URL-safe base64 without padding
$bytes  = [System.Text.Encoding]::UTF8.GetBytes($targetUrl)
$b64    = [Convert]::ToBase64String($bytes).Replace('+','-').Replace('/','_').TrimEnd('=')
$url    = "https://www.virustotal.com/api/v3/urls/$b64"