#!/usr/bin/env python
import json
import urllib
import urllib2
import sys

apikey = ''

def usage():
  print '''Submit hash to virtus-total
Usage: %s <hash>''' % sys.argv[0]
  exit(0)

def collect(data):
  retrieve             = data[0]
  sha1                 = retrieve['sha1']
  filenames            = retrieve['filenames']
  first_seen           = retrieve['first-seen']
  last_seen            = retrieve['last-seen']
  last_scan_permalink  = retrieve['last-scan-permalink']
  return sha1, filenames, first_seen, last_seen, last_scan_permalink

def msg(sha1, filenames, first_seen, last_seen, last_scan_permalink):
  print '''===Suspected Malware Item===
  SHA1: %s
  Filenames: %s
  First Seen: %s
  Last Seen: %s
  Link: %s''' % (sha1, filenames, first_seen, last_seen, last_scan_permalink)

def in_database(data, mhash):
  result = data[0]['result']
  if result == 0: 
    return False
  return True

def arguments():
  if len(sys.argv) < 2:
    usage()
  if '-h' in sys.argv[1]:
    usage()
  if not apikey:
    print "Set apikey in %s to value of your Virus Total key" % sys.argv[0]
    exit(1)

  mhash = sys.argv[1]
  return mhash

def query_api(mhash, apikey):
  url = "http://api.vtapi.net/vtapi/get_file_infos.json"
  parameters = {"resources": mhash, "apikey": apikey}
  encoded = urllib.urlencode(parameters)
  req = urllib2.Request(url, encoded)
  response = urllib2.urlopen(req)
  response_string = response.read()
  data = json.loads(response_string)
  return data

mhash = arguments()
data = query_api(mhash, apikey)

if not in_database(data, mhash):
  print 'No entry for %s in database' % mhash
  exit(1)

# Positive match found
sha1, filenames, first_seen, last_seen, last_scan_permalink = collect(data)
msg(sha1, filenames, first_seen, last_seen, last_scan_permalink)
exit(1)

@@ -82,10 +82,74 @@
  = '
+843fa2012b619be746ead785b933d59820a2e357c7c186e581e8fcadbe2e550e
 '%0A
-
 %0Adef
@@ -197,16 +197,62 @@
 s-total%0A
+(Place your VirusTotal apikey in this script)%0A
 Usage: %25
@@ -581,16 +581,70 @@
 alink'%5D%0A
+  last_scan_report     = retrieve%5B'last-scan-report'%5D%0A
   return
@@ -703,16 +703,34 @@
 ermalink
+, last_scan_report
 %0A%0Adef ms
@@ -972,16 +972,160 @@
 alink)%0A%0A
+def is_malware(last_scan_report):%0A  for av, scan in last_scan_report.iteritems():%0A    if scan%5B0%5D is not None:%0A      return True%0A  return False%0A%0A
 def in_d
@@ -2032,25 +2032,78 @@
 link
- = collect(data)%0A
+, last_scan_report = collect(data)%0Aif is_malware(last_scan_report):%0A  
 msg(
@@ -2163,16 +2163,78 @@
 malink)%0A
+  exit(0)%0Aelse:%0A  print 'Entry %25s is not malicious' %25 mhash%0A  
 exit(1)%0A

test for AV match