VirusTotal API
Malware Analysis

🎯 Project Overview

This micro-project focused on conducting automated malware analysis using the VirusTotal API v3. Python scripts were written to submit malware samples and file hashes sourced from MalwareBazaar and VirusShare to VirusTotal, and then parse the resulting behavioural reports.

The goal was to gain practical experience with threat intelligence APIs and to develop the ability to rapidly triage malware indicators at scale — a core competency in Security Operations and Incident Response.

🔍 Objectives

• Automate the submission of malware samples and hashes to VirusTotal using Python.
• Analyse behavioural activities from reports — including file modifications, API calls, and scores.
• Extract and interpret antivirus vendor verdicts and command-and-control (C2) IP addresses.

📊 Data Points Extracted

Data Point	Description
Files Modified / Dropped	Changes made by malware to the file system during execution
API Calls	System calls made by the sample revealing its behaviour patterns
Base Score	Overall risk score assigned by VirusTotal's aggregation engine
Community Score	Crowd-sourced rating and comments from the VirusTotal community
AV Vendor Verdicts	Detection results from 70+ antivirus engines
C2 IP Addresses	Command-and-control server IPs associated with each sample

🛠️ Setup & Usage

1. Obtain a VirusTotal API key — register at virustotal.com for a free or premium key.
2. Install Python dependencies — the requests library is used for API interaction.
3. Configure VS Code — set up the Python environment and store the API key securely.
4. Collect sample hashes from MalwareBazaar or VirusShare.
5. Run the script — submit hashes and parse the JSON response for indicators.

# Install required library
pip install requests

# Example: Submit a file hash to VirusTotal API
import requests

API_KEY = "your_api_key_here"
hash_value = "abc123..."

url = f"https://www.virustotal.com/api/v3/files/{hash_value}"
headers = {"x-apikey": API_KEY}

response = requests.get(url, headers=headers)
data = response.json()

# Extract AV verdicts
verdicts = data["data"]["attributes"]["last_analysis_results"]
print(verdicts)