public static async Task <string> FindVirusTotalInfoAsync(string url)
{
string returnString = "";
VirusTotal virusTotal = new VirusTotal("de0a5c113302967ab7d535c84e8a6ce49eacbd2952397c43dc99c13a26df423e");
virusTotal.UseTLS = true;
UrlReport urlReport = await virusTotal.GetUrlReportAsync(url);
bool hasUrlBeenScannedBefore = urlReport.ResponseCode == UrlReportResponseCode.Present;
//do something return string with info about the url
Console.WriteLine("URL has been scanned before: " + (hasUrlBeenScannedBefore ? "Yes" : "No"));
//If the url has been scanned before, the results are embedded inside the report.
if (hasUrlBeenScannedBefore)
{
PrintScan(urlReport);
}
else
{
UrlScanResult urlResult = await virusTotal.ScanUrlAsync(url);
PrintScan(urlResult);
}
returnString = returnString + urlReport.Permalink + "***" + urlReport.Positives + "/" + urlReport.Total;
return(returnString);
//repeat varius api interaction methods for the other analysis sites with each irl
}
public static async Task RunScan()
{
VirusTotal virusTotal = new VirusTotal("YOUR VT API KEY HERE");
virusTotal.UseTLS = true;
using (StreamReader scanHosts = new StreamReader(@"address.txt"))
{
string line;
while ((line = scanHosts.ReadLine()) != null)
{
try
{
Console.WriteLine("Hostname: " + line);
UrlReport urlreport = await virusTotal.GetUrlReportAsync(line);
PrintScan(urlreport);
}
catch (VirusTotalNET.Exceptions.RateLimitException)
{
Thread.Sleep(60000);
continue;
}
catch (VirusTotalNET.Exceptions.InvalidResourceException)
{
Console.WriteLine("-- Blank Entry --");
Console.WriteLine();
continue;
}
}
}
}
public async Task GetReportKnownUrl()
{
IgnoreMissingJson("scans.ADMINUSLabs / Detail", "scans.AlienVault / Detail", "scans.Antiy-AVL / Detail", "scans.AutoShun / Detail", "scans.Avira / Detail", "scans.Baidu-International / Detail", "scans.BitDefender / Detail", "scans.Blueliv / Detail", "scans.Certly / Detail", "scans.C-SIRT / Detail", "scans.CyberCrime / Detail", "scans.Emsisoft / Detail", "scans.ESET / Detail", "scans.Fortinet / Detail", "scans.FraudScore / Detail", "scans.FraudSense / Detail", "scans.G-Data / Detail", "scans.K7AntiVirus / Detail", "scans.Kaspersky / Detail", "scans.Malekal / Detail", "scans.Malwared / Detail", "scans.MalwarePatrol / Detail", "scans.Netcraft / Detail", "scans.Nucleon / Detail", "scans.OpenPhish / Detail", "scans.Opera / Detail", "scans.PhishLabs / Detail", "scans.Phishtank / Detail", "scans.Quttera / Detail", "scans.Rising / Detail", "scans.SecureBrain / Detail", "scans.securolytics / Detail", "scans.Sophos / Detail", "scans.Spam404 / Detail", "scans.StopBadware / Detail", "scans.Tencent / Detail", "scans.ThreatHive / Detail", "scans.Trustwave / Detail", "scans.URLQuery / Detail", "scans.Webutation / Detail", "scans.ZCloudsec / Detail", "scans.ZeroCERT / Detail", "scans.Zerofox / Detail", "scans.zvelo / Detail", "scans['AegisLab WebGuard'] / Detail", "scans['CLEAN MX'] / Detail", "scans['Comodo Site Inspector'] / Detail", "scans['desenmascara.me'] / Detail", "scans['Dr.Web'] / Detail", "scans['Forcepoint ThreatSeeker'] / Detail", "scans['Google Safebrowsing'] / Detail", "scans['Malware Domain Blocklist'] / Detail", "scans['Malwarebytes hpHosts'] / Detail", "scans['malwares.com URL checker'] / Detail", "scans['SCUMWARE.org'] / Detail", "scans['Sucuri SiteCheck'] / Detail", "scans['Virusdie External Site Scan'] / Detail", "scans['VX Vault'] / Detail", "scans['Web Security Guard'] / Detail", "scans['ZDB Zeus'] / Detail");
UrlReport urlReport = await VirusTotal.GetUrlReportAsync(TestData.KnownUrls.First());
Assert.Equal(UrlReportResponseCode.Present, urlReport.ResponseCode);
}
public async Task ExecuteVirusTotalScan(ScanRequest request)
{
try
{
VirusTotal virusTotal = new VirusTotal(_possibleScans.VirusTotalApiKey);
UrlReport urlReport = await virusTotal.GetUrlReportAsync(request.WebsiteUrl);
bool hasUrlBeenScannedBefore = urlReport.ResponseCode == UrlReportResponseCode.Present;
//_logger.LogInformation("URL has been scanned before: " + (hasUrlBeenScannedBefore ? "Yes" : "No"));
//If the url has been scanned before, the results are embedded inside the report.
if (hasUrlBeenScannedBefore)
{
ParseVirusTotalScanResult(urlReport, request);
}
else
{
UrlScanResult urlResult = await virusTotal.ScanUrlAsync(request.WebsiteUrl);
int tryCount = 0;
while (tryCount < 1000)
{
UrlReport urlCurrentReport = await virusTotal.GetUrlReportAsync(request.WebsiteUrl);
hasUrlBeenScannedBefore = urlCurrentReport.ResponseCode == UrlReportResponseCode.Present;
if (hasUrlBeenScannedBefore)
{
ParseVirusTotalScanResult(urlReport, request);
break;
}
_logger.LogDebug("SKIPPING");
await Task.Delay(2000);
tryCount++;
}
}
}
catch (Exception e)
{
_logger.LogError(e, "Error at ExecuteVirusTotalScan, Error: ");
}
}
public async Task GetReportUnknownUrl()
{
IgnoreMissingJson(" / filescan_id", " / Permalink", " / Positives", " / scan_date", " / scan_id", " / Scans", " / Total", " / URL");
UrlReport urlReport = await VirusTotal.GetUrlReportAsync(TestData.GetUnknownUrls(1).First());
Assert.Equal(UrlReportResponseCode.NotPresent, urlReport.ResponseCode);
//We are not supposed to have a scan id
Assert.True(string.IsNullOrWhiteSpace(urlReport.ScanId));
}
public async Task GetReportForUnknownUrlAndScan()
{
IgnoreMissingJson(" / filescan_id", " / Positives", " / Scans", " / Total");
UrlReport urlReport = await VirusTotal.GetUrlReportAsync(TestData.GetUnknownUrls(1).First(), true);
//It return "present" because we told it to scan it
Assert.Equal(UrlReportResponseCode.Present, urlReport.ResponseCode);
//We are supposed to have a scan id because we scanned it
Assert.False(string.IsNullOrWhiteSpace(urlReport.ScanId));
}
private static async Task Main(string[] args)
{
VirusTotal virusTotal = new VirusTotal("YOUR API KEY HERE");
//Use HTTPS instead of HTTP
virusTotal.UseTLS = true;
//Create the EICAR test virus. See http://www.eicar.org/86-0-Intended-use.html
byte[] eicar = Encoding.ASCII.GetBytes(@"X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
//Check if the file has been scanned before.
FileReport fileReport = await virusTotal.GetFileReportAsync(eicar);
bool hasFileBeenScannedBefore = fileReport.ResponseCode == FileReportResponseCode.Present;
Console.WriteLine("File has been scanned before: " + (hasFileBeenScannedBefore ? "Yes" : "No"));
//If the file has been scanned before, the results are embedded inside the report.
if (hasFileBeenScannedBefore)
{
PrintScan(fileReport);
}
else
{
ScanResult fileResult = await virusTotal.ScanFileAsync(eicar, "EICAR.txt");
PrintScan(fileResult);
}
Console.WriteLine();
string scanUrl = "http://www.google.com/";
UrlReport urlReport = await virusTotal.GetUrlReportAsync(scanUrl);
bool hasUrlBeenScannedBefore = urlReport.ResponseCode == UrlReportResponseCode.Present;
Console.WriteLine("URL has been scanned before: " + (hasUrlBeenScannedBefore ? "Yes" : "No"));
//If the url has been scanned before, the results are embedded inside the report.
if (hasUrlBeenScannedBefore)
{
PrintScan(urlReport);
}
else
{
UrlScanResult urlResult = await virusTotal.ScanUrlAsync(scanUrl);
PrintScan(urlResult);
}
}
/// <summary>
/// The listBox1_DoubleClick
/// </summary>
/// <param name="sender">The sender<see cref="object"/></param>
/// <param name="e">The e<see cref="EventArgs"/></param>
private async void listBox1_DoubleClick(object sender, EventArgs e)
{
var ip = listBox1.SelectedItem.ToString();
VirusTotal virustotal =
new VirusTotal("a3f22a4baa6bfb80942e3aa9824c0673acab04140cb7825487590d587d70c485")
{
UseTLS = true
};
UrlReport report = await virustotal.GetUrlReportAsync(ip);
bool Scancheck = report.ResponseCode == UrlReportResponseCode.Present;
UrlScanResult fileResult = await virustotal.ScanUrlAsync(ip);
if (Scancheck)
{
linkLabel2.Text = fileResult.Permalink;
}
else
{
if (fileResult.Permalink.Contains("://"))
{
Process.Start(fileResult.Permalink);
}
}
if (report.ResponseCode == UrlReportResponseCode.Present)
{
foreach (KeyValuePair <string, UrlScanEngine> scan in report.Scans)
{
ListViewItem itm = new ListViewItem {
Text = scan.Key
};
itm.SubItems.Add(scan.Value.Result);
if (scan.Value.Result == "clean site")
{
itm.SubItems[1].ForeColor = Color.Green;
itm.UseItemStyleForSubItems = false;
}
else
{
itm.SubItems[1].ForeColor = Color.Red;
itm.UseItemStyleForSubItems = false;
}
itm.SubItems.Add(report.ScanDate.ToString(CultureInfo.CurrentCulture));
itm.SubItems.Add(report.ScanId);
listView1.Items.Add(itm);
}
}
}
public async Task processVirusTotal(string filepath, MailItem Items, string scanurl, MatchCollection matches)
{
VirusTotal virusTotal = new VirusTotal(ConfigurationSettings.AppSettings["Apikey"]);
virusTotal.UseTLS = true;
if (filepath != "") //For Attatchment
{
byte[] eicar = Encoding.ASCII.GetBytes(filepath);
FileReport fileReport = await virusTotal.GetFileReportAsync(eicar);
AttachmentScan(fileReport, filepath, Items, scanurl, matches);
Console.WriteLine();
}
else if (filepath == "" && scanurl != "") //For Url
{
Task <UrlReport> urlReport = virusTotal.GetUrlReportAsync(scanurl);
UrlScan(urlReport.Result, Items);
}
else
{
//To be Code for Body.
}
Console.WriteLine();
}
public async Task GetReportInvalidUrl()
{
await Assert.ThrowsAsync <InvalidResourceException>(async() => await VirusTotal.GetUrlReportAsync("."));
}
public async Task <ApiResponse> GetAsync(string host)
{
ApiResponse apiResponse = null;
UrlScanResult urlResult = null;
UrlReport scanReport = null;
try
{
VirusTotal virusTotal = new VirusTotal(ApiSettingHelper.ApiKey);
virusTotal.UseTLS = true;
urlResult = await virusTotal.ScanUrlAsync(host);
if (urlResult.ResponseCode == UrlScanResponseCode.Queued)
{
scanReport = await virusTotal.GetUrlReportAsync(host);
VirusTotalReport report = new VirusTotalReport()
{
Host = host,
ScanId = scanReport.ScanId,
ScanDate = scanReport.ScanDate,
Positives = scanReport.Positives,
Resource = scanReport.Resource,
Total = scanReport.Total
};
if (scanReport.ResponseCode == UrlReportResponseCode.Present)
{
scanReport.Scans.ToList().ForEach(scan =>
{
report.ReportDetails.Add(new ReportDetail()
{
Name = scan.Key,
Detail = scan.Value.Detail,
Detected = scan.Value.Detected,
Result = scan.Value.Result
});
});
apiResponse = new ApiResponse()
{
StatusCode = HttpStatusCode.OK,
Result = JObject.Parse(JsonConvert.SerializeObject(report))
};
}
else
{
apiResponse = new ApiResponse()
{
StatusCode = HttpStatusCode.BadRequest,
ErrorMessage = scanReport.VerboseMsg
};
}
}
else
{
apiResponse = new ApiResponse()
{
StatusCode = HttpStatusCode.BadRequest,
ErrorMessage = urlResult.VerboseMsg
};
}
}
catch (Exception ex)
{
logger.LogError(ex, "Exception occurred calling external API for '{lookup}'", host);
apiResponse = new ApiResponse()
{
StatusCode = HttpStatusCode.InternalServerError,
ErrorMessage = ex.Message,
};
}
return(apiResponse);
}
public async Task <UrlReport> GetUrlReport(string url)
{
return(await _virusTotal.GetUrlReportAsync(url));
}
private static async Task Main(string[] args)
{
Console.WriteLine("Hello, what do you want to scan?\n");
Console.WriteLine("for url press 1, for file presss 2, for ip press 3");
//int choice;
String temp = Console.ReadLine();
//choice=int.Parse(temp);
Console.WriteLine(temp);
VirusTotal virusTotal = new VirusTotal("50c1c91e9bfc7cb858022a0cbeaf1ba0f8782dbbd506be82f71b1e3f243000cf");
//Use HTTPS instead of HTTP
virusTotal.UseTLS = true;
//Create the EICAR test virus. See http://www.eicar.org/86-0-Intended-use.html
byte[] eicar = Encoding.ASCII.GetBytes(@"X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
//Check if the file has been scanned before.
FileReport fileReport = await virusTotal.GetFileReportAsync(eicar);
bool hasFileBeenScannedBefore = fileReport.ResponseCode == FileReportResponseCode.Present;
Console.WriteLine("File has been scanned before: " + (hasFileBeenScannedBefore ? "Yes" : "No"));
//If the file has been scanned before, the results are embedded inside the report.
if (hasFileBeenScannedBefore)
{
PrintScan(fileReport);
}
else
{
ScanResult fileResult = await virusTotal.ScanFileAsync(eicar, "EICAR.txt");
PrintScan(fileResult);
}
Console.WriteLine();
string scanUrl = "http://www.google.com/";
UrlReport urlReport = await virusTotal.GetUrlReportAsync(scanUrl);
bool hasUrlBeenScannedBefore = urlReport.ResponseCode == UrlReportResponseCode.Present;
Console.WriteLine("URL has been scanned before: " + (hasUrlBeenScannedBefore ? "Yes" : "No"));
//If the url has been scanned before, the results are embedded inside the report.
if (hasUrlBeenScannedBefore)
{
PrintScan(urlReport);
}
else
{
UrlScanResult urlResult = await virusTotal.ScanUrlAsync(scanUrl);
PrintScan(urlResult);
}
}