Virustotal——上传样本保存扫描结果

使用场景：有恶意文件的sha256，需要上传到Virustotal查看扫描结果
语言：Python
准备：sha256值的文件psha.txt
      Virustotal的API KEY（申请一个账户，账户里面有【My API Key】）
注意：Virustotol.com的访问需要翻墙，我的Chrome浏览器安装了代理，所以headers参数的User-Agent是Chrome的版本。
Chrome浏览器版本的查看方式：输入chrome://version查看，用户代理即User-Agent

Virustotal查询结果的数据格式：

#coding : utf-8import requestsimport jsonimport timedef main():    headers = {          "Accept-Encoding" : "gzip, deflate",          "User-Agent" : "gzip,  your browser's User-Agent"      }    f = open('psha.txt', 'r') #sha256值的文件    f_result = open('pre.txt', 'w') #保存扫描结果    try:        while True:            line = f.readline().strip()            params = {                'apikey' : 'your API Key',                 'resource' : line            }            if line:                response = requests.get('https://www.virustotal.com/vtapi/v2/file/report', params=params, headers=headers)                if response.text != '':                    data = json.loads(response.text)                    if data['response_code']==0:                        print "nothing",line                        f_result.write("nothing" + line + '\n')                    else:                        scans_dict = data['scans']                        f_result.write(line+'\n')                        if data['positives']==0: #VT有样本，但是分析结果是OK                            f_result.write('ok\n')                        else:                            for anti_virus_company,virus_name in scans_dict.iteritems():                                if virus_name['detected']:                                    f_result.write(anti_virus_company+'\t'+virus_name['result']+'\t'+virus_name['update']+'\n')            else:                    break            if searchCount % 4 == 0: #1分钟查4个                time.sleep(60)    except IOError, error:        print "Caught error : "     finally:        f.close()        f_result.close()if __name__ == '__main__':    main()

参考：
https://www.virustotal.com/en/documentation/public-api
http://www.jb51.net/article/55923.htm
http://wangzhixian.org/PythonSpider/在VirusTotal上利用文件哈希批量搜索/article.html