ハッシュリストをVTに突っ込んで検知結果をリストで受け取る X-FORCE もあるよ

エモいやつのハッシュ値リストをまとめてVTでチェックするスクリプトです。
APIでまとめて取得します。クエリ量制限(4回/分)があるのでゆっくり待ちましょう

import requests
import json
import pandas as pd 
import time
import csv 


hashlist= [
'c9e17e63de9b882e820c829b415a4e13070453c8',
'dee5ff1d1910e27c2b6aed7ddffce3c3be6356d4']
url = 'https://www.virustotal.com/vtapi/v2/file/report'

apikey ='USE_YOUR_API_KEY'

f = open('vt_output.csv', 'w')
writer = csv.writer(f, lineterminator='\n')

for hash in hashlist:
    print(hash)
    params = {'apikey': apikey, 'resource': hash}
    response = requests.get(url, params=params)
    l = [hash]
    response_code =response.json()['response_code']
    l.append(response_code)
    if response_code == 1:
        df=pd.read_json( json.dumps(response.json()))
        for x in range(df.index.size):
            l.append(df['scans'][x]['result'])
    writer.writerow(l)
	time.sleep(25)
f.close()

結果はリストで取得できます。

1	Trojan.Downloader.DOC.Gen	Other:Malware-gen [Trj]	W97m.Downloader.IQU	Trojan.MSWord.Generic.4!c	VBA/Downloader.S70	W97m.Downloader.IQU	Other:Malware-gen [Trj]		VBA/Dldr.Agent.zzlmg		W97m.Downloader.IQU			W97M.Emotet.36301		Doc.Dropper.Emotet-7399725-0		W97M/Downldr.HB.gen!Eldorado	W97M.DownLoader.4186	VBA/TrojanDownloader.Agent.QMI		malicious (high confidence)		Malware.VBA/Dldr.Agent.zzlmg	W97m.Downloader.IQU	VBA/Agent.QLT!tr.dldr	Macro.Trojan.Kryptik.NK@susp	Trojan-Downloader.VBA.Emotet				HEUR:Trojan.MSOffice.SAgent.gen		malware (ai score=89)			W97M/Downloader.xx	BehavesLike.Downloader.cg	W97m.Downloader.IQU	TrojanDownloader:O97M/Emotet.GF!MTB	Trojan.Script.Downloader.ghylsa	O97M/Downloader	virus.office.obfuscated.1			DFI - Malicious OLE	Mal/DocDl-K	Trojan.Gen.2	Suspicious/W97M.Obfus.Gen.8	Heur.Macro.Generic.Gen.f		Trojan.W97M.EMOTET.JKBG	Trojan.W97M.EMOTET.JKBG				Trojan.AvsMofer.bSGLro		HEUR:Trojan.MSOffice.SAgent.gen	Probably W97Obfuscated	

X-FORCEでIPをチェックしてスコアを取得するやつも作りました

import requests
import json
import pandas as pd 
import time
import csv 

iplist =[
'8.8.8.8',
'7.7.7.7'
]


url = 'https://api.xforce.ibmcloud.com/ipr/' 

apikey ='Basic YOURKEY'

f = open('x_output.csv', 'w')
writer = csv.writer(f, lineterminator='\n')


for ip in iplist:
    print(ip)
    headers = {'Authorization': apikey}
    full = url + ip
    response = requests.get(full, headers=headers)
    l = [ip]
    l.append(response.json()["score"])
    l.append(response.json()["cats"])
    l.append(response.json()["categoryDescriptions"])
    writer.writerow(l)
    time.sleep(5)
f.close()