R Client for the VirusTotal API

virustotal: R Client for the VirusTotal API v3

Use VirusTotal, a Google service that analyzes files and URLs for viruses, worms, trojans and other malware, categorizes the content hosted by a domain using a variety of prominent services, and provides passive DNS information, among other things.

The package covers the VirusTotal API v3: file, URL, domain and IP reports; scanning and rescanning; IoC relationships; sandbox behavior artifacts; comments and votes. Requests are paced to the public API’s 4-per-minute allowance automatically, transient failures are retried honoring the server’s Retry-After, and API failures surface as typed R conditions you can tryCatch on. Files larger than 32 MiB use a single-use upload URL; these uploads are not automatically retried.

Installation

From CRAN:

install.packages("virustotal")

Development version from GitHub:

# install.packages("pak")
pak::pak("themains/virustotal")

Quick start

Get a key from your VirusTotal API key page, then:

library(virustotal)
set_key("your_api_key") # or set VIRUSTOTAL_API_KEY in .Renviron

# What does VirusTotal know about a domain, an IP, a file hash, a URL?
domain_report("google.com")
ip_report("8.8.8.8")
file_report("99017f6eebbac24f351415dd410d522d")
url_report("http://www.google.com")

# Submit new things for analysis
scan_url("https://example.org")
scan_file("suspicious.exe")

# Errors are typed conditions
tryCatch(
  file_report("0123456789abcdef0123456789abcdef"),
  virustotal_error = function(e) message("VT said: ", conditionMessage(e))
)
#> VT said: Resource not found.

The package defaults to 4 requests per minute. Daily quotas are enforced by VirusTotal. Premium keys can raise the request rate:

options(virustotal.requests_per_minute = 1000)

The vignette walks through the full surface:

vignette("using_virustotal", package = "virustotal")

License

Released under the MIT License.