The hardware and bandwidth for this mirror is donated by dogado GmbH, the Webhosting and Full Service-Cloud Provider. Check out our Wordpress Tutorial.
If you wish to report a bug, or if you are interested in having us mirror your free-software or open-source project, please feel free to contact us at mirror[@]dogado.de.

virustotal: R Client for the VirusTotal API v3

R-CMD-check lint codecov CRAN status lifecycle

Use VirusTotal, a Google service that analyzes files and URLs for viruses, worms, trojans and other malware, categorizes the content hosted by a domain using a variety of prominent services, and provides passive DNS information, among other things.

The package covers the VirusTotal API v3: file, URL, domain and IP reports; scanning and rescanning; IoC relationships; sandbox behaviour artifacts; comments and votes. Requests are paced to the public API’s 4-per-minute allowance automatically, transient failures are retried honoring the server’s Retry-After, and API failures surface as typed R conditions you can tryCatch on.

Installation

From CRAN:

install.packages("virustotal")

Development version from GitHub:

# install.packages("pak")
pak::pak("themains/virustotal")

Quick start

Get a key from your VirusTotal API key page, then:

library(virustotal)
set_key("your_api_key") # or set VIRUSTOTAL_API_KEY in .Renviron

# What does VirusTotal know about a domain, an IP, a file hash, a URL?
domain_report("google.com")
ip_report("8.8.8.8")
file_report("99017f6eebbac24f351415dd410d522d")
url_report("http://www.google.com")

# Submit new things for analysis
scan_url("https://example.org")
scan_file("suspicious.exe")

# Errors are typed conditions
tryCatch(
  file_report("0123456789abcdef0123456789abcdef"),
  virustotal_error = function(e) message("VT said: ", conditionMessage(e))
)
#> VT said: Resource not found.

Public API keys are limited to 4 requests/minute and 500/day; the package throttles itself to match. Premium keys can raise the pace:

options(virustotal.requests_per_minute = 1000)

The vignette walks through the full surface:

vignette("using_virustotal", package = "virustotal")

License

Released under the MIT License.

These binaries (installable software) and packages are in development.
They may not be fully stable and should be used with caution. We make no claims about them.
Health stats visible at Monitor.