Posh-VirusTotal
PowerShell V3.0 or higher module for interacting with the VirtusTotal service to analize suspicious files and URLs using either the Public or Private Version 2 API provided by VirusTotal.
Cmdlets Available
| Cmdlet | Synopsis |
|---|---|
| Get-PoshVTVersion | Checks the version of the module installed versus the version on GitHub |
| Get-VTAPIKeyInfo | Get information on the Virus Total API key. |
| Get-VTDomainReport | Get a VirusTotal Report for a given Domain |
| Get-VTFileBehaviourReport | Get a report about the behavior of the file when executed in a sandboxed environment. |
| Get-VTFileComment | Retrieve a list of VirusTotal Community comments for a given file or URL |
| Get-VTFileNetworkTraffic | Get a dump of the network traffic generated by the file when executed. |
| Get-VTFileReport | Get a VirusTotal Report for a given File |
| Get-VTFileSample | Download a file by its hash. |
| Get-VTFileScanReport | Get the scan results for a file. |
| Get-VTIPReport | Get a VirusTotal Report for a given IPv4 Address |
| Get-VTSpecialURL | Get a special URL to upload files bigger than 32MB in size. |
| Get-VTURLReport | Get a VirusTotal Report for a given URL |
| Remove-VTFileRescan | Delete a previously scheduled scan. |
| Search-VTAdvancedReversed | Search for samples that match certain binary/metadata/detection criteria. |
| Set-VTAPIKey | Sets the VirusTotal API Key as a Global Variable |
| Set-VTFileComment | Post a comment on a file or URL. |
| Set-VTFileRescan | Rescan a previously submitted file or schedule a scan to be performed in the future. |
| Submit-VTFile | Submit a File for scanning by VirusTotal |
| Submit-VTURL | Submit a URL for scanning by VirusTotal |
#Install To install the module including all source code you can just run in a PowerShell v3 or higher session the following command:
iex (New-Object Net.WebClient).DownloadString("https://gist.githubusercontent.com/darkoperator/9138373/raw/22fb97c07a21139a398c2a3d6ca7e3e710e476bc/PoshVTInstall.ps1")
The process should look like:
PS C:\Windows\system32> iex (New-Object Net.WebClient).DownloadString("https://gist.githubusercontent.com/darkoperator/9
138373/raw/22fb97c07a21139a398c2a3d6ca7e3e710e476bc/PoshVTInstall.ps1")
Downloading latest version of Posh-VirusTotal from https://github.com/darkoperator/Posh-VirusTotal/archive/master.zip
File saved to C:\Users\Carlos\AppData\Local\Temp\Posh-VirusTotal.zip
Uncompressing the Zip file to C:\Users\Carlos\Documents\WindowsPowerShell\Modules
Renaming folder
Module has been installed
CommandType Name ModuleName
----------- ---- ----------
Function Get-PoshVTVersion Posh-VirusTotal
Function Get-VTAPIKeyInfo Posh-VirusTotal
Function Get-VTDomainReport Posh-VirusTotal
Function Get-VTFileBehaviourReport Posh-VirusTotal
Function Get-VTFileComment Posh-VirusTotal
Function Get-VTFileNetworkTraffic Posh-VirusTotal
Function Get-VTFileReport Posh-VirusTotal
Function Get-VTFileSample Posh-VirusTotal
Function Get-VTFileScanReport Posh-VirusTotal
Function Get-VTIPReport Posh-VirusTotal
Function Get-VTSpecialURL Posh-VirusTotal
Function Get-VTURLReport Posh-VirusTotal
Function Remove-VTFileRescan Posh-VirusTotal
Function Search-VTAdvancedReversed Posh-VirusTotal
Function Set-VTAPIKey Posh-VirusTotal
Function Set-VTFileComment Posh-VirusTotal
Function Set-VTFileRescan Posh-VirusTotal
Function Submit-VTFile Posh-VirusTotal
Function Submit-VTURL Posh-VirusTotal
Change Log
Version 1.2
- API key is now encrypted on disk when set.
- Module in Synopsis mention if they are using Private or Public API.
Version 1.1
- Added support for connecting thru a HTTP Proxy and provide credentials for the proxy if necessary.
- Certificate pinning using the Certificate Thumbprint.
Version 1.0
- First public version of the module supporting PowerShell v3.0 and v4.0