快捷導(dǎo)航

python實(shí)現(xiàn)上傳樣本到virustotal并查詢掃描信息的方法

更新時間：2014年10月05日 13:43:30 投稿：shichen2014

這篇文章主要介紹了python實(shí)現(xiàn)上傳樣本到virustotal并查詢掃描信息的方法,是比較實(shí)用的技巧,需要的朋友可以參考下

本文實(shí)例講述了python實(shí)現(xiàn)上傳樣本到virustotal并查詢掃描信息的方法。分享給大家供大家參考。具體方法如下：

import simplejson 
import urllib 
import urllib2 
import os  
 
MD5 = "5248f774d2ee0a10936d0b1dc89107f1" 
MD5 = "12fa5fb74201d9b6a14f63fbf9a81ff6" #do not have report on virustotal.com 
       
######################################################################## 
APIKEY = "e0a50a50e77fxxxxxxxxxxxxxx4f17e31 這里用你自己在virustotal上申請的賬號的KEY" 
 
 
class VirusTotal: 
  """""" 
 
  def __init__(self, md5): 
    """Constructor""" 
    self._virus_dict = {} 
    self._md5 = md5 
     
     
  def repr(self): 
    return str(self._virus_dict) 
   
  def submit_md5(self, file_path): 
    import postfile                                      
    #submit the file 
    FILE_NAME = os.path.basename(file_path)  
               
                                                  
    host = "www.virustotal.com"                                
    selector = "https://www.virustotal.com/vtapi/v2/file/scan"                 
    fields = [("apikey", APIKEY)] 
    file_to_send = open(file_path, "rb").read()                        
    files = [("file", FILE_NAME, file_to_send)]                        
    json = postfile.post_multipart(host, selector, fields, files)               
    print json 
    pass 
   
  def get_report_dict(self): 
    result_dict = {} 
     
    url = "https://www.virustotal.com/vtapi/v2/file/report" 
    parameters = {"resource": self._md5, 
            "apikey": APIKEY} 
    data = urllib.urlencode(parameters) 
    req = urllib2.Request(url, data) 
    response = urllib2.urlopen(req) 
    json = response.read() 
     
    response_dict = simplejson.loads(json) 
    if response_dict["response_code"]: #has result  
      scans_dict = response_dict.get("scans", {}) 
      for anti_virus_comany, virus_name in scans_dict.iteritems(): 
        if virus_name["detected"]: 
          self._virus_dict.setdefault(anti_virus_comany, virus_name["result"]) 
    return self._virus_dict

返回的結(jié)果為：{u'Sophos': u'Sus/Behav-1010'}，如果有掃描出的結(jié)果的話..

調(diào)用的方法如下：

MD5 = "12fa5fb74201d9b6a14f63fbf9a81ff6" #do not have report on virustotal.com 
MD5 = "5248f774d2ee0a10936d0b1dc89107f1" 
FILE_PATH = r"D:\backSample\10\9af41bc012d66c98ca2f9c68ba38e98f_ICQLiteShell.dll" 
 
from getVirusTotalInfo import VirusTotal 
#得到掃描結(jié)果并打印出來 
virus_total = VirusTotal(MD5) 
print virus_total.get_report_dict() 
 
#提交文件到掃描，以后就可以根據(jù)這個MD5取掃描結(jié)果了 
virus_total.submit_md5(FILE_PATH)

希望本文所述對大家的Python程序設(shè)計有所幫助。

您可能感興趣的文章: