Use VirusTotal, a Google service that analyzes files and URLs for viruses, worms, trojans and other malware, categorizes the content hosted by a domain using a variety of prominent services, and provides passive DNS information, among other things.
The package covers the VirusTotal API v3: file, URL, domain and IP
reports; scanning and rescanning; IoC relationships; sandbox behaviour
artifacts; comments and votes. Requests are paced to the public API’s
4-per-minute allowance automatically, transient failures are retried
honoring the server’s Retry-After, and API failures surface
as typed R conditions you can tryCatch on.
From CRAN:
install.packages("virustotal")Development version from GitHub:
# install.packages("pak")
pak::pak("themains/virustotal")Get a key from your VirusTotal API key page, then:
library(virustotal)
set_key("your_api_key") # or set VIRUSTOTAL_API_KEY in .Renviron
# What does VirusTotal know about a domain, an IP, a file hash, a URL?
domain_report("google.com")
ip_report("8.8.8.8")
file_report("99017f6eebbac24f351415dd410d522d")
url_report("http://www.google.com")
# Submit new things for analysis
scan_url("https://example.org")
scan_file("suspicious.exe")
# Errors are typed conditions
tryCatch(
file_report("0123456789abcdef0123456789abcdef"),
virustotal_error = function(e) message("VT said: ", conditionMessage(e))
)
#> VT said: Resource not found.Public API keys are limited to 4 requests/minute and 500/day; the package throttles itself to match. Premium keys can raise the pace:
options(virustotal.requests_per_minute = 1000)The vignette walks through the full surface:
vignette("using_virustotal", package = "virustotal")Released under the MIT License.