virustotal bulk search

VT_BulkSearch.py

import argparse
import requests
import json

VIRUSTOTAL_API_KEY = 'YOUR_API_KEY'

def perform_hash_search(hash_value):
    url = f'https://www.virustotal.com/api/v3/files/{hash_value}'
    headers = {'x-apikey': VIRUSTOTAL_API_KEY}

    response = requests.get(url, headers=headers)
    if response.status_code == 200:
        data = response.json()
        return data
    else:
        return None

def perform_bulk_search(file_path):
    with open(file_path, 'r') as file:
        hashes = file.read().splitlines()

    url = 'https://www.virustotal.com/api/v3/files'
    headers = {'x-apikey': VIRUSTOTAL_API_KEY}

    results = []
    for hash_value in hashes:
        url_params = {'hash': hash_value}
        response = requests.get(url, headers=headers, params=url_params)

        if response.status_code == 200:
            data = response.json()
            results.append(data)
        else:
            results.append(None)

    return results

def write_output(results, output_file):
    with open(output_file, 'w') as file:
        json.dump(results, file, indent=4)

def main():
    parser = argparse.ArgumentParser(description='VirusTotal Search')
    parser.add_argument('-f', '--file', help='Perform bulk search on hashes file')
    parser.add_argument('-s', '--hash', help='Perform search on a single hash')
    parser.add_argument('-o', '--output', help='Output file to save the results')

    args = parser.parse_args()

    if args.file:
        results = perform_bulk_search(args.file)
    elif args.hash:
        results = perform_hash_search(args.hash)
    else:
        print('Please provide either the hashes file or the hash for the search.')
        return

    if args.output:
        write_output(results, args.output)
        print(f'Results saved to {args.output}')
    else:
        print(json.dumps(results, indent=4))

if __name__ == '__main__':
    main()