R Client for the 'VirusTotal' API

Provides a comprehensive R interface to the 'VirusTotal' API v3.0 < https://docs.virustotal.com/>, a Google service that analyzes files and URLs for viruses, worms, trojans and other malware. Features include file/URL scanning, domain categorization, passive DNS information, IP reputation analysis, IoC relationships, sandbox analysis, and comment/voting systems. Implements rate limiting, error handling, and response validation for robust security analysis workflows.

virustotal: R Client for the VirusTotal API v3

Use VirusTotal, a Google service that analyzes files and URLs for viruses, worms, trojans and other malware, categorizes the content hosted by a domain using a variety of prominent services, and provides passive DNS information, among other things.

The package covers the VirusTotal API v3: file, URL, domain and IP reports; scanning and rescanning; IoC relationships; sandbox behaviour artifacts; comments and votes. Requests are paced to the public API’s 4-per-minute allowance automatically, transient failures are retried honoring the server’s Retry-After, and API failures surface as typed R conditions you can tryCatch on.

Installation

From CRAN:

install.packages("virustotal")

Development version from GitHub:

# install.packages("pak")
pak::pak("themains/virustotal")

Quick start

Get a key from your VirusTotal API key page, then:

library(virustotal)
set_key("your_api_key") # or set VIRUSTOTAL_API_KEY in .Renviron

# What does VirusTotal know about a domain, an IP, a file hash, a URL?
domain_report("google.com")
ip_report("8.8.8.8")
file_report("99017f6eebbac24f351415dd410d522d")
url_report("http://www.google.com")

# Submit new things for analysis
scan_url("https://example.org")
scan_file("suspicious.exe")

# Errors are typed conditions
tryCatch(
  file_report("0123456789abcdef0123456789abcdef"),
  virustotal_error = function(e) message("VT said: ", conditionMessage(e))
)
#> VT said: Resource not found.

Public API keys are limited to 4 requests/minute and 500/day; the package throttles itself to match. Premium keys can raise the pace:

options(virustotal.requests_per_minute = 1000)

The vignette walks through the full surface:

vignette("using_virustotal", package = "virustotal")

License

Released under the MIT License.