Categories: PowerShell

Working with VirusTotal from PowerShell

Virus Total is an excellent service. It's a single place where hundreds of antivirus engines can verify if the file, URL, domain name, or IP Address is trusted or not. Of course, it's not a silver bullet, but it brings tremendous value, and I often verify files I download before executing. Since I release a lot of new or updated PowerShell modules on a weekly/monthly basis, I thought it would be great to send newly released versions straight to Virus Total so I can have them checked before anyone executes them. I also hope to prevent false positives from some antivirus vendors that may tag my modules as malware because they haven't seen the DLL or PowerShell module in this form before. I've seen it happen to DBATools, so why not try and push my modules before users even use them?

I've created a small PowerShell module, VirusTotalAnalyzer, which provides two simple commands that connect Virus Total using their Rest API v3. This is the newest API that is available. The module should work fine on PowerShell 5.1 and PowerShell 7+ and should work cross-platform, but I've not checked that yet.

Querying Virus Total for existing data with PowerShell

VirusTotalAnalyzer provides the Get-VirusReport function, which has five ways of requesting data from Virus Total. Those are by Hash, File, DomainName, IPAddress, or Search string. An important parameter of Get-VirusReport is the ApiKey parameter. You will need to have APIKey before you can use this module. Fortunately, ApiKey is available for free once you register to Virus Total. Once you have it the usage is as shown below

$VTApi = "APIKey"

$T1 = Get-VirusReport -ApiKey $VTApi -Hash 'BFF77EECBB2F7DA25ECBC9D9673E5DC1DB68DCC68FD76D006E836F9AC61C547E'
$T2 = Get-VirusReport -ApiKey $VTApi -File "$PSScriptRoot\Submisions\TestFile.txt"
$T3 = Get-VirusReport -ApiKey $VTApi -DomainName 'evotec.xyz'
$T4 = Get-VirusReport -ApiKey $VTApi -IPAddress '1.1.1.1'
$T5 = Get-VirusReport -ApiKey $VTApi -Search "https://evotec.xyz"

Each query returns similar data. It returns it the way Rest API returns it, and I'm not making any changes to the output. Data has multiple levels with different attributes available to you.

The reports are very detailed and deep. You are given many details depending on what has been scanned. For example, when scanning the PSM1 file, the object returns powershell_info attributes.

While the module is small, it provides enough functionality to help automate some of the processes I want my modules to go through. While other PowerShell modules deal with Virus Total, they don't use v3 API (AFYIK), and I always like to reinvent the wheel – why not?

Sending file / url to Virus Total using PowerShell

Using the New-VirusScan function, you can send files or URLs to be verified by Virus Total. Keep in mind that this is not an immediate process, and it takes 60 seconds to get information back from Virus Total. So you can either submit and verify your scan by using a hash or analysis ID provided as part of the New-VirusScan function.

Import-Module VirusTotalAnalyzer -Force

$VTApi = "APIKey"

# Submit file to scan
$Output = New-VirusScan -ApiKey $VTApi -File "$PSScriptRoot\Submisions\TestFile.txt"
$Output | Format-List

Start-Sleep -Seconds 120

# Since the output will return scan ID we can use it to get the report
$OutputScan = Get-VirusReport -ApiKey $VTApi -AnalysisId $Output.data.id
$OutputScan | Format-List
$OutputScan.Meta | Format-List
$OutputScan.Data | Format-List

New-VirusScan also provides an option to rescan file/hash. I didn't want to create a separate function for this functionality. You can rescan content that is already existing in Virus Total, forcing Virus Total to reassess whatever it has one more time with current definitions.

Import-Module VirusTotalAnalyzer -Force

$VTApi = "APIKey"

# Submit file hash to rescan from existing file (doesn't sends the file)
$Output = New-VirusScan -ApiKey $VTApi -FileHash "$PSScriptRoot\Submisions\TestFile.txt"
$Output | Format-List

# Submit hash to rescan
$Output = New-VirusScan -ApiKey $VTApi -Hash "ThisHashHasToExistsOnVirusTotal"
$Output | Format-List

Installing VirusTotalAnalyzer

Those functions are part of the VirusTotalAnalyzer module and all you need to do to install it is:

Install-Module VirusTotalAnalyzer -Force -Verbose

The module can also be installed without administrative privileges on the workstation using the Scope parameter.

Install-Module VirusTotalAnalyzer -Scope CurrentUser

For sources, reporting issues, or feature requests, as always, visit GitHub. All my projects are hosted on it, and it's the preferred method of providing support.

Przemyslaw Klys

System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.

Share
Published by
Przemyslaw Klys
Tags: apipowershellrestapisecurityvirusvirus total
2 years ago

Recent Posts

Active Directory Replication Summary to your Email or Microsoft Teams

Active Directory replication is a critical process that ensures the consistent and up-to-date state of…

1 day ago

Syncing Global Address List (GAL) to personal contacts and between Office 365 tenants with PowerShell

Hey there! Today, I wanted to introduce you to one of the small but excellent…

5 months ago

Active Directory Health Check using Microsoft Entra Connect Health Service

Active Directory (AD) is crucial in managing identities and resources within an organization. Ensuring its…

6 months ago

Seamless HTML Report Creation: Harness the Power of Markdown with PSWriteHTML PowerShell Module

In today's digital age, the ability to create compelling and informative HTML reports and documents…

8 months ago

How to Efficiently Remove Comments from Your PowerShell Script

As part of my daily development, I create lots of code that I subsequently comment…

8 months ago

Unlocking PowerShell Magic: Different Approach to Creating ‘Empty’ PSCustomObjects

Today I saw an article from Christian Ritter, "PowerShell: Creating an "empty" PSCustomObject" on X…

8 months ago