Title: R Client for the VirusTotal API
Version: 0.5.0
Author: Gaurav Sood [aut, cre]
Maintainer: Gaurav Sood <gsood07@gmail.com>
Description: Provides a comprehensive R interface to the VirusTotal API (v2 and v3), a Google service that analyzes files and URLs for viruses, worms, trojans and other malware. Features include file/URL scanning, domain categorization, passive DNS information, IP reputation analysis, and comment/voting systems. Implements rate limiting, error handling, and response validation for robust security analysis workflows.
URL: https://github.com/themains/virustotal, https://themains.github.io/virustotal/, http://themains.github.io/virustotal/
BugReports: https://github.com/themains/virustotal/issues
Depends: R (≥ 4.0.0)
License: MIT + file LICENSE
VignetteBuilder: knitr
Encoding: UTF-8
Language: en-US
Imports: httr (≥ 1.4.0), dplyr (≥ 1.0.0), base64enc (≥ 0.1-3), jsonlite (≥ 1.7.0), checkmate (≥ 2.0.0), rlang (≥ 1.0.0)
Suggests: knitr (≥ 1.30), rmarkdown (≥ 2.0), testthat (≥ 3.0.0), lintr (≥ 3.0.0), httptest (≥ 4.0.0), covr, pkgdown, spelling
RoxygenNote: 7.3.3
Config/testthat/edition: 3
Config/Needs/website: pkgdown
NeedsCompilation: no
Packaged: 2025-12-15 19:15:08 UTC; soodoku
Repository: CRAN
Date/Publication: 2025-12-16 06:10:12 UTC

virustotal: Access Virustotal API

Description

Access virustotal API. See https://www.virustotal.com/. Details about results of calls to the API can be found at https://docs.virustotal.com/reference.

You will need credentials to use this application. If you haven't already, get the API Key at https://www.virustotal.com/.

Author(s)

Gaurav Sood

See Also

Useful links:


Add comments on Files and URLs

Description

Add comments on files and URLs. For instance, flagging false positives, adding details about malware, instructions for cleaning malware, etc.

Usage

add_comments(hash = NULL, comment = NULL, ...)

Arguments

hash

hash for the resource you want to comment on; Required; String

comment

review; Required; String

...

Additional arguments passed to virustotal2_POST.

Value

data.frame with 2 columns: response_code, verbose_msg

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')
  
add_comments(hash='99017f6eebbac24f351415dd410d522d', comment="This is great.")



## End(Not run)

Convert VirusTotal response to data.frame

Description

Convert VirusTotal response to data.frame

Usage

## S3 method for class 'virustotal_response'
as.data.frame(x, ...)

Arguments

x

A virustotal_response object

...

Additional arguments (unused)

Value

A data.frame representation of the response


Clean up temporary files and directories

Description

Safely removes temporary files and directories created during VirusTotal operations.

Usage

cleanup_temp_files(paths)

Arguments

paths

Character vector of file/directory paths to clean up

Value

Logical indicating success

See Also

Other utilities: create_safe_temp_dir(), format_file_size(), is_safe_environment(), utilities, validate_vt_response(), virustotal_info(), virustotal_version()


Create a safe temporary directory for file operations

Description

Creates a temporary directory with restricted permissions for secure file operations during malware analysis.

Usage

create_safe_temp_dir()

Value

Path to the temporary directory

See Also

Other utilities: cleanup_temp_files(), format_file_size(), is_safe_environment(), utilities, validate_vt_response(), virustotal_info(), virustotal_version()


Get Domain Report

Description

Retrieves comprehensive analysis report for a given domain, including WHOIS information, DNS resolutions, detected URLs, and threat intelligence data.

Usage

domain_report(domain, ...)

Arguments

domain

Domain name (character string). Required.

...

Additional arguments passed to virustotal_GET

Value

A virustotal_domain_report object containing domain analysis results including WHOIS data, DNS resolutions, detected URLs, categories, and threat intelligence

References

https://docs.virustotal.com/reference/domains

See Also

set_key for setting the API key

Examples

## Not run: 
# Set API key first
set_key('your_api_key_here')

# Get domain reports
report1 <- domain_report("google.com")
report2 <- domain_report("https://www.example.com/path")

print(report1)
summary(report1)

## End(Not run)

Download a file from VirusTotal

Description

Download a file from VirusTotal

Usage

download_file(hash = NULL, output_path = NULL, ...)

Arguments

hash

File hash (MD5, SHA1, or SHA256)

output_path

Local path to save the downloaded file. Optional.

...

Additional arguments passed to virustotal_GET.

Value

Raw file content or saves file to specified path

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

download_file(hash='99017f6eebbac24f351415dd410d522d', 
              output_path='/tmp/downloaded_file')

## End(Not run)

Get File Scan Report

Description

Retrieves detailed analysis results for a file from VirusTotal using the v3 API.

Usage

file_report(hash, ...)

Arguments

hash

File hash (MD5, SHA1, or SHA256) or analysis ID

...

Additional arguments passed to virustotal_GET

Value

A virustotal_file_report object containing file analysis results including antivirus scans, file metadata, and threat detection information

References

https://docs.virustotal.com/reference/files

See Also

set_key for setting the API key, scan_file for submitting files

Examples

## Not run: 
# Set API key first
set_key('your_api_key_here')

# Get file report using hash
report <- file_report(hash = '99017f6eebbac24f351415dd410d522d')
print(report)
summary(report)

# Convert to data.frame if needed
df <- as.data.frame(report)

## End(Not run)

Convert file size to human readable format

Description

Convert file size to human readable format

Usage

format_file_size(size_bytes)

Arguments

size_bytes

File size in bytes

Value

Character string with human-readable size

See Also

Other utilities: cleanup_temp_files(), create_safe_temp_dir(), is_safe_environment(), utilities, validate_vt_response(), virustotal_info(), virustotal_version()


Retrieve comments for an Internet domain

Description

Retrieve comments for an Internet domain

Usage

get_domain_comments(domain = NULL, limit = limit, cursor = cursor, ...)

Arguments

domain

domain name. String. Required.

limit

Number of entries. Integer. Optional. Default is 10.

cursor

String. Optional.

...

Additional arguments passed to virustotal_GET.

Value

named list with the following possible items: `BitDefender category`, undetected_referrer_samples, whois_timestamp, detected_downloaded_samples, detected_referrer_samples, `Webutation domain info`, `Alexa category`, undetected_downloaded_samples, resolutions, detected_communicating_samples, `Opera domain info`, `TrendMicro category`, categories, domain_siblings, `BitDefender domain info`, whois, `Alexa domain info`, response_code, verbose_msg, `Websense ThreatSeeker category`, subdomains, `WOT domain info`, detected_urls, `Alexa rank`, undetected_communicating_samples, `Dr.Web category`, pcaps

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')
   
get_domain_comments("http://www.google.com")
get_domain_comments("http://www.goodsfwrfw.com") # Domain not found

## End(Not run)

Retrieve information about an Internet domain

Description

Retrieve information about an Internet domain

Usage

get_domain_info(domain = NULL, limit = NULL, cursor = NULL, ...)

Arguments

domain

domain name. String. Required.

limit

Number of entries. Integer. Optional. Default is 10.

cursor

String. Optional.

...

Additional arguments passed to virustotal_GET.

Value

named list

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')
   
get_domain_info("http://www.google.com")
get_domain_info("http://www.goodsfwrfw.com") # Domain not found

## End(Not run)

Retrieve related objects to an Internet domain

Description

Retrieve related objects to an Internet domain

Usage

get_domain_relationship(
  domain = NULL,
  relationship = "subdomains",
  limit = NULL,
  cursor = NULL,
  ...
)

Arguments

domain

domain name. String. Required.

relationship

relationship name. String. Required. Default is subdomains. For all the options see https://docs.virustotal.com/reference

limit

Number of entries. Integer. Optional. Default is 10.

cursor

String. Optional.

...

Additional arguments passed to virustotal_GET.

Value

named list

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')
   
get_domain_relationship("https://www.google.com")
get_domain_relationship("https://www.goodsfwrfw.com") # Domain not found

## End(Not run)

Retrieve votes for an Internet domain

Description

Retrieve votes for an Internet domain

Usage

get_domain_votes(domain = NULL, limit = NULL, cursor = NULL, ...)

Arguments

domain

domain name. String. Required.

limit

Number of entries. Integer. Optional. Default is 10.

cursor

String. Optional.

...

Additional arguments passed to virustotal_GET.

Value

named list

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')
   
get_domain_votes("http://www.google.com")
get_domain_votes("http://www.goodsfwrfw.com") # Domain not found

## End(Not run)

Retrieve comments for a file

Description

Retrieve comments for a file

Usage

get_file_comments(hash = NULL, limit = NULL, cursor = NULL, ...)

Arguments

hash

File hash (MD5, SHA1, or SHA256)

limit

Number of comments to retrieve. Integer. Optional. Default is 10.

cursor

String for pagination. Optional.

...

Additional arguments passed to virustotal_GET.

Value

list containing file comments

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

get_file_comments(hash='99017f6eebbac24f351415dd410d522d')

## End(Not run)

Get download URL for a file

Description

Get download URL for a file

Usage

get_file_download_url(hash = NULL, ...)

Arguments

hash

File hash (MD5, SHA1, or SHA256)

...

Additional arguments passed to virustotal_GET.

Value

list containing download URL and metadata

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

get_file_download_url(hash='99017f6eebbac24f351415dd410d522d')

## End(Not run)

Retrieve relationships for a file

Description

Retrieve relationships for a file

Usage

get_file_relationships(
  hash = NULL,
  relationship = NULL,
  limit = NULL,
  cursor = NULL,
  ...
)

Arguments

hash

File hash (MD5, SHA1, or SHA256)

relationship

Type of relationship: "behaviours", "bundled_files", "compression_parents", "contacted_domains", "contacted_ips", "contacted_urls", "dropped_files", "execution_parents", "itw_domains", "itw_ips", "itw_urls", "overlay_parents", "pcap_parents", "pe_resource_parents", "similar_files", "submissions"

limit

Number of relationships to retrieve. Integer. Optional. Default is 10.

cursor

String for pagination. Optional.

...

Additional arguments passed to virustotal_GET.

Value

list containing file relationships

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

get_file_relationships(hash='99017f6eebbac24f351415dd410d522d', 
                       relationship='contacted_domains')

## End(Not run)

Get file upload URL for large files

Description

Get a special URL for uploading files larger than 32MB to VirusTotal for analysis.

Usage

get_file_upload_url(...)

Arguments

...

Additional arguments passed to virustotal_GET.

Value

list containing upload URL and other metadata

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key, scan_file for regular file uploads

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

get_file_upload_url()

## End(Not run)

Retrieve votes for a file

Description

Retrieve votes for a file

Usage

get_file_votes(hash = NULL, limit = NULL, cursor = NULL, ...)

Arguments

hash

File hash (MD5, SHA1, or SHA256)

limit

Number of votes to retrieve. Integer. Optional. Default is 10.

cursor

String for pagination. Optional.

...

Additional arguments passed to virustotal_GET.

Value

list containing file votes

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

get_file_votes(hash='99017f6eebbac24f351415dd410d522d')

## End(Not run)

Retrieve comments for an IP address

Description

Retrieve comments for an IP address

Usage

get_ip_comments(ip = NULL, limit = NULL, cursor = NULL, ...)

Arguments

ip

IP Address. String. Required.

limit

Number of entries. Integer. Optional. Default is 10.

cursor

String. Optional.

...

Additional arguments passed to virustotal_GET.

Value

named list

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')
   
get_ip_comments("64.233.160.0")

## End(Not run)

Retrieve information about an IP address

Description

Retrieves report on a given domain, including passive DNS, urls detected by at least one url scanner. Gives category of the domain from bitdefender.

Usage

get_ip_info(ip = NULL, limit = NULL, cursor = NULL, ...)

Arguments

ip

IP address. String. Required.

limit

Number of entries. Integer. Optional. Default is 10.

cursor

String. Optional.

...

Additional arguments passed to virustotal_GET.

Value

named list

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')
   
get_ip_info("64.233.160.0")

## End(Not run)

Retrieve votes for an IP address

Description

Retrieve votes for an IP address

Usage

get_ip_votes(ip = NULL, limit = NULL, cursor = NULL, ...)

Arguments

ip

IP address. String. Required.

limit

Number of entries. Integer. Optional. Default is 10.

cursor

String. Optional.

...

Additional arguments passed to virustotal_GET.

Value

named list

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')
   
get_ip_votes("64.233.160.0")

## End(Not run)

Get current rate limit status

Description

Get current rate limit status

Usage

get_rate_limit_status()

Value

List with current status information

See Also

Other rate limiting: rate-limiting, rate_limit(), reset_rate_limit()


Retrieve comments for a URL

Description

Retrieve comments for a URL

Usage

get_url_comments(url_id = NULL, limit = NULL, cursor = NULL, ...)

Arguments

url_id

URL or URL ID from VirusTotal

limit

Number of comments to retrieve. Integer. Optional. Default is 10.

cursor

String for pagination. Optional.

...

Additional arguments passed to virustotal_GET.

Value

list containing URL comments

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

get_url_comments(url_id='http://www.google.com')

## End(Not run)

Retrieve relationships for a URL

Description

Retrieve relationships for a URL

Usage

get_url_relationships(
  url_id = NULL,
  relationship = NULL,
  limit = NULL,
  cursor = NULL,
  ...
)

Arguments

url_id

URL or URL ID from VirusTotal

relationship

Type of relationship: "communicating_files", "downloaded_files", "graphs", "last_serving_ip_address", "network_location", "redirecting_urls", "redirects_to", "referrer_urls", "submissions"

limit

Number of relationships to retrieve. Integer. Optional. Default is 10.

cursor

String for pagination. Optional.

...

Additional arguments passed to virustotal_GET.

Value

list containing URL relationships

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

get_url_relationships(url_id='http://www.google.com', 
                      relationship='communicating_files')

## End(Not run)

Retrieve votes for a URL

Description

Retrieve votes for a URL

Usage

get_url_votes(url_id = NULL, limit = NULL, cursor = NULL, ...)

Arguments

url_id

URL or URL ID from VirusTotal

limit

Number of votes to retrieve. Integer. Optional. Default is 10.

cursor

String for pagination. Optional.

...

Additional arguments passed to virustotal_GET.

Value

list containing URL votes

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

get_url_votes(url_id='http://www.google.com')

## End(Not run)

Initialize rate limiting state

Description

Initialize rate limiting state

Usage

init_rate_limit()

Get IP Address Report

Description

Retrieves comprehensive analysis report for an IP address, including geolocation, ASN information, DNS resolutions, and detected URLs.

Usage

ip_report(ip = NULL, ...)

Arguments

ip

a valid IPv4 or IPv6 address; String; Required

...

Additional arguments passed to virustotal_GET.

Value

list containing IP analysis results including geolocation, ASN information, DNS resolutions, detected URLs, and threat intelligence

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

ip_report(ip="8.8.8.8")
ip_report(ip="2001:4860:4860::8888")  # IPv6 example

## End(Not run)

Check if API key is properly configured

Description

Verifies that the API key is set and appears to be valid format.

Usage

is_api_key_configured()

Value

Logical indicating if API key is configured

See Also

Other security: sanitize_domain(), sanitize_file_path(), sanitize_hash(), sanitize_ip(), sanitize_url(), security-utilities


Check if rate limiting is properly initialized

Description

Check if rate limiting is properly initialized

Usage

is_rate_limit_initialized()

Check if running in a safe environment

Description

Verifies that the package is running in an appropriate environment for security analysis work.

Usage

is_safe_environment()

Value

Logical indicating if environment is considered safe

See Also

Other utilities: cleanup_temp_files(), create_safe_temp_dir(), format_file_size(), utilities, validate_vt_response(), virustotal_info(), virustotal_version()


Add a comment to an Internet domain

Description

Add a comment to an Internet domain

Usage

post_domain_comments(domain = NULL, comment = NULL, ...)

Arguments

domain

domain name. String. Required.

comment

vote. String. Required. Any word starting with # in your comment's text will be considered a tag, and added to the comment's tag attribute.

...

Additional arguments passed to virustotal_POST.

Value

named list

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')
   
post_domain_comments(domain = "https://google.com", comment = "Great!")

## End(Not run)

Add a vote for a hostname or domain

Description

Add a vote for a hostname or domain

Usage

post_domain_votes(domain = NULL, vote = NULL, ...)

Arguments

domain

domain name. String. Required.

vote

vote. String. Required.

...

Additional arguments passed to virustotal_POST.

Value

named list

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')
   
post_domain_votes("http://google.com", vote = "malicious")

## End(Not run)

Add a comment to a file

Description

Add a comment to a file

Usage

post_file_comments(hash = NULL, comment = NULL, ...)

Arguments

hash

File hash (MD5, SHA1, or SHA256)

comment

Comment text to add

...

Additional arguments passed to virustotal_POST.

Value

list containing response data

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

post_file_comments(hash='99017f6eebbac24f351415dd410d522d', 
                   comment='This file appears to be suspicious')

## End(Not run)

Add a vote to a file

Description

Add a vote to a file

Usage

post_file_votes(hash = NULL, verdict = NULL, ...)

Arguments

hash

File hash (MD5, SHA1, or SHA256)

verdict

Vote verdict: "harmless" or "malicious"

...

Additional arguments passed to virustotal_POST.

Value

list containing response data

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

post_file_votes(hash='99017f6eebbac24f351415dd410d522d', verdict='malicious')

## End(Not run)

Add a comment to an IP address

Description

Add a comment to an IP address

Usage

post_ip_comments(ip = NULL, comment = NULL, ...)

Arguments

ip

IP address. String. Required.

comment

Comment. String. Required.

...

Additional arguments passed to virustotal_POST.

Value

named list

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')
   
post_ip_comments(ip = "64.233.160.0", comment = "test")

## End(Not run)

Add a vote for a IP address

Description

Add a vote for a IP address

Usage

post_ip_votes(ip = NULL, vote = NULL, ...)

Arguments

ip

IP address. String. Required.

vote

vote. String. Required.

...

Additional arguments passed to virustotal_POST.

Value

named list

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')
   
post_ip_votes(ip = "64.233.160.0", vote = "malicious")

## End(Not run)

Add a comment to a URL

Description

Add a comment to a URL

Usage

post_url_comments(url_id = NULL, comment = NULL, ...)

Arguments

url_id

URL or URL ID from VirusTotal

comment

Comment text to add

...

Additional arguments passed to virustotal_POST.

Value

list containing response data

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

post_url_comments(url_id='http://www.google.com', 
                  comment='This URL appears suspicious')

## End(Not run)

Add a vote to a URL

Description

Add a vote to a URL

Usage

post_url_votes(url_id = NULL, verdict = NULL, ...)

Arguments

url_id

URL or URL ID from VirusTotal

verdict

Vote verdict: "harmless" or "malicious"

...

Additional arguments passed to virustotal_POST.

Value

list containing response data

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

post_url_votes(url_id='http://www.google.com', verdict='harmless')

## End(Not run)

Print method for domain reports

Description

Print method for domain reports

Usage

## S3 method for class 'virustotal_domain_report'
print(x, ...)

Arguments

x

A virustotal_domain_report object

...

Additional arguments (unused)


Print method for VirusTotal errors

Description

Print method for VirusTotal errors

Usage

## S3 method for class 'virustotal_error'
print(x, ...)

Arguments

x

A virustotal_error object

...

Additional arguments (unused)


Print method for file reports

Description

Print method for file reports

Usage

## S3 method for class 'virustotal_file_report'
print(x, ...)

Arguments

x

A virustotal_file_report object

...

Additional arguments (unused)


Print method for VirusTotal responses

Description

Print method for VirusTotal responses

Usage

## S3 method for class 'virustotal_response'
print(x, ...)

Arguments

x

A virustotal_response object

...

Additional arguments (unused)


Rate Limiting for VirusTotal API

Description

Modern rate limiting implementation that properly manages API request limits. VirusTotal public API allows 4 requests per minute.

See Also

Other rate limiting: get_rate_limit_status(), rate_limit(), reset_rate_limit()


Modern rate limiting implementation

Description

Uses a sliding window approach to track requests and enforce limits. This replaces the old environment variable-based approach.

Usage

rate_limit(force_wait = FALSE)

Arguments

force_wait

Logical. If TRUE, will wait even if under limit

Value

Invisible TRUE

See Also

Other rate limiting: get_rate_limit_status(), rate-limiting, reset_rate_limit()


Legacy rate limiting function

Description

Legacy rate limiting function

Usage

rate_limit_legacy()

Request rescan of a file

Description

Request a new analysis of a file already present in VirusTotal's database. Returns an analysis ID that can be used to retrieve the report using file_report.

Usage

rescan_file(hash = NULL, ...)

Arguments

hash

File hash (MD5, SHA1, or SHA256) or file ID. String. Required.

...

Additional arguments passed to virustotal_POST.

Value

list containing analysis details and ID

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

rescan_file(hash='99017f6eebbac24f351415dd410d522d')

## End(Not run)

Reset rate limiting state

Description

Clears all rate limiting history. Useful for testing.

Usage

reset_rate_limit()

See Also

Other rate limiting: get_rate_limit_status(), rate-limiting, rate_limit()


Sanitize domain input

Description

Validates and sanitizes domain names to prevent injection attacks while allowing legitimate domain analysis.

Usage

sanitize_domain(domain)

Arguments

domain

Character string representing a domain name

Value

Sanitized domain or throws error if invalid

See Also

Other security: is_api_key_configured(), sanitize_file_path(), sanitize_hash(), sanitize_ip(), sanitize_url(), security-utilities


Sanitize file path input

Description

Validates and sanitizes file paths to prevent directory traversal attacks and ensure safe file operations.

Usage

sanitize_file_path(file_path, allow_relative = FALSE)

Arguments

file_path

Character string representing a file path

allow_relative

Logical. Whether to allow relative paths (default: FALSE)

Value

Sanitized file path or throws error if invalid

See Also

Other security: is_api_key_configured(), sanitize_domain(), sanitize_hash(), sanitize_ip(), sanitize_url(), security-utilities


Sanitize hash input

Description

Validates hash inputs to ensure they conform to expected formats (MD5, SHA1, SHA256) and contain only valid hexadecimal characters.

Usage

sanitize_hash(hash)

Arguments

hash

Character string representing a file hash

Value

Sanitized hash or throws error if invalid

See Also

Other security: is_api_key_configured(), sanitize_domain(), sanitize_file_path(), sanitize_ip(), sanitize_url(), security-utilities


Sanitize IP address input

Description

Validates IP addresses (IPv4 and IPv6) and checks for private ranges that shouldn't be submitted to VirusTotal.

Usage

sanitize_ip(ip)

Arguments

ip

Character string representing an IP address

Value

Sanitized IP address or throws error if invalid

See Also

Other security: is_api_key_configured(), sanitize_domain(), sanitize_file_path(), sanitize_hash(), sanitize_url(), security-utilities


Sanitize URL input

Description

Validates and sanitizes URLs to prevent malicious inputs while preserving legitimate URLs for analysis.

Usage

sanitize_url(url)

Arguments

url

Character string representing a URL

Value

Sanitized URL or throws error if invalid

See Also

Other security: is_api_key_configured(), sanitize_domain(), sanitize_file_path(), sanitize_hash(), sanitize_ip(), security-utilities


Submit a file for scanning

Description

Uploads a file to VirusTotal for malware analysis using the v3 API.

Usage

scan_file(file_path, ...)

Arguments

file_path

Required; Path to the file to be scanned

...

Additional arguments passed to virustotal_POST

Value

A virustotal_file_scan object containing scan submission results with analysis ID and links for tracking the scan progress

References

https://docs.virustotal.com/reference/files-scan

See Also

set_key for setting the API key, file_report for retrieving scan results

Examples

## Not run: 
# Set API key first
set_key('your_api_key_here')

# Scan a file
result <- scan_file(file_path = 'suspicious_file.exe')
print(result)

## End(Not run)

Submit URL for scanning

Description

Submit a URL for analysis. Returns analysis details including an ID that can be used to retrieve the report using url_report

Usage

scan_url(url = NULL, ...)

Arguments

url

URL to scan; string; required

...

Additional arguments passed to virustotal_POST.

Value

list containing analysis details and ID

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

scan_url("http://www.google.com")

## End(Not run)

Security Utilities for VirusTotal Package

Description

Security functions for input sanitization and validation to prevent common security issues when working with potentially malicious inputs.

See Also

Other security: is_api_key_configured(), sanitize_domain(), sanitize_file_path(), sanitize_hash(), sanitize_ip(), sanitize_url()


Set VirusTotal API Key

Description

Stores your VirusTotal API key in an environment variable for use by other package functions. Get your API key from https://www.virustotal.com/.

Usage

set_key(api_key)

Arguments

api_key

VirusTotal API key (character string). Required.

Value

Invisibly returns TRUE on success

References

https://docs.virustotal.com/reference

Examples

## Not run: 
# Set your API key
set_key('your_64_character_api_key_here')

# Verify it's set
Sys.getenv("VirustotalToken")

## End(Not run)

Summary method for VirusTotal responses

Description

Summary method for VirusTotal responses

Usage

## S3 method for class 'virustotal_response'
summary(object, ...)

Arguments

object

A virustotal_response object

...

Additional arguments (unused)


Get URL Report

Description

Retrieve a scan report for a given URL or URL ID from VirusTotal.

Usage

url_report(url_id = NULL, ...)

Arguments

url_id

URL or URL ID from VirusTotal. String. Required.

...

Additional arguments passed to virustotal_GET.

Value

list containing URL analysis results including scan details, detection information, and metadata

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key, scan_url for submitting URLs

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

# Get report using URL
url_report("http://www.google.com")

# Get report using URL ID (base64 encoded URL without padding)
url_report("687474703a2f2f7777772e676f6f676c652e636f6d2f")

## End(Not run)

Utility Functions for VirusTotal Package

Description

Helper functions and utilities for the VirusTotal package.

See Also

Other utilities: cleanup_temp_files(), create_safe_temp_dir(), format_file_size(), is_safe_environment(), validate_vt_response(), virustotal_info(), virustotal_version()


Validate VirusTotal response structure

Description

Checks if a response from VirusTotal API has the expected structure.

Usage

validate_vt_response(response)

Arguments

response

Response object from VirusTotal API

Value

Logical indicating if response structure is valid

See Also

Other utilities: cleanup_temp_files(), create_safe_temp_dir(), format_file_size(), is_safe_environment(), utilities, virustotal_info(), virustotal_version()


S3 Classes for VirusTotal Responses

Description

S3 classes to provide structured responses and better user experience when working with VirusTotal API results.

See Also

Other response classes: virustotal_domain_report(), virustotal_file_report(), virustotal_file_scan(), virustotal_ip_report(), virustotal_url_scan()


VirusTotal API Error Classes

Description

Custom error classes for structured error handling in the virustotal package.

See Also

Other error handling: virustotal_auth_error(), virustotal_check(), virustotal_error(), virustotal_rate_limit_error(), virustotal_validation_error()


Base POST AND GET functions. Not exported.

Description

GET for the v2 API

Usage

virustotal2_GET(
  query = list(),
  path = path,
  key = Sys.getenv("VirustotalToken"),
  ...
)

Arguments

query

query list

path

path to the specific API service url

key

A character string containing Virustotal API Key. The default is retrieved from Sys.getenv("VirustotalToken").

...

Additional arguments passed to GET.

Value

list


POST for V2 API

Description

POST for V2 API

Usage

virustotal2_POST(
  query = list(),
  path = path,
  body = NULL,
  key = Sys.getenv("VirustotalToken"),
  ...
)

Arguments

query

query list

path

path to the specific API service url

body

file

key

A character string containing Virustotal API Key. The default is retrieved from Sys.getenv("VirustotalToken").

...

Additional arguments passed to POST.

Value

list


GET for the Current V3 API

Description

GET for the Current V3 API

Usage

virustotal_GET(path, query = list(), key = Sys.getenv("VirustotalToken"), ...)

Arguments

path

path to the specific API service url

query

query list

key

A character string containing Virustotal API Key. The default is retrieved from Sys.getenv("VirustotalToken").

...

Additional arguments passed to GET.

Value

list


POST for the Current V3 API

Description

POST for the Current V3 API

Usage

virustotal_POST(
  path,
  body = NULL,
  query = list(),
  key = Sys.getenv("VirustotalToken"),
  ...
)

Arguments

path

path to the specific API service url

body

request body (file upload or JSON data)

query

query list

key

A character string containing Virustotal API Key. The default is retrieved from Sys.getenv("VirustotalToken").

...

Additional arguments passed to POST.

Value

list


Create an authentication error

Description

Create an authentication error

Usage

virustotal_auth_error(
  message = "Invalid or missing API key",
  call = sys.call(-1)
)

Arguments

message

Error message

call

The calling function (automatically detected)

Value

An error object of class virustotal_auth_error

See Also

Other error handling: virustotal-errors, virustotal_check(), virustotal_error(), virustotal_rate_limit_error(), virustotal_validation_error()


Request Response Verification

Description

Enhanced error checking with structured error classes

Usage

virustotal_check(req)

Arguments

req

HTTP response object from httr

Value

Invisible NULL on success, throws structured errors on failure

See Also

Other error handling: virustotal-errors, virustotal_auth_error(), virustotal_error(), virustotal_rate_limit_error(), virustotal_validation_error()


Create a VirusTotal domain report

Description

Create a VirusTotal domain report

Usage

virustotal_domain_report(data)

Arguments

data

Raw API response data

Value

Object of class virustotal_domain_report

See Also

Other response classes: virustotal-classes, virustotal_file_report(), virustotal_file_scan(), virustotal_ip_report(), virustotal_url_scan()


Create a VirusTotal API error

Description

Create a VirusTotal API error

Usage

virustotal_error(
  message,
  status_code = NULL,
  response = NULL,
  call = sys.call(-1)
)

Arguments

message

Error message

status_code

HTTP status code

response

Full HTTP response object

call

The calling function (automatically detected)

Value

An error object of class virustotal_error

See Also

Other error handling: virustotal-errors, virustotal_auth_error(), virustotal_check(), virustotal_rate_limit_error(), virustotal_validation_error()


Create a VirusTotal file report

Description

Create a VirusTotal file report

Usage

virustotal_file_report(data)

Arguments

data

Raw API response data

Value

Object of class virustotal_file_report

See Also

Other response classes: virustotal-classes, virustotal_domain_report(), virustotal_file_scan(), virustotal_ip_report(), virustotal_url_scan()


Create a VirusTotal file scan result

Description

Create a VirusTotal file scan result

Usage

virustotal_file_scan(data)

Arguments

data

Raw API response data

Value

Object of class virustotal_file_scan

See Also

Other response classes: virustotal-classes, virustotal_domain_report(), virustotal_file_report(), virustotal_ip_report(), virustotal_url_scan()


Print package information and configuration status

Description

Print package information and configuration status

Usage

virustotal_info()

Value

Invisible NULL

See Also

Other utilities: cleanup_temp_files(), create_safe_temp_dir(), format_file_size(), is_safe_environment(), utilities, validate_vt_response(), virustotal_version()


Create a VirusTotal IP report

Description

Create a VirusTotal IP report

Usage

virustotal_ip_report(data)

Arguments

data

Raw API response data

Value

Object of class virustotal_ip_report

See Also

Other response classes: virustotal-classes, virustotal_domain_report(), virustotal_file_report(), virustotal_file_scan(), virustotal_url_scan()


Create a rate limit error

Description

Create a rate limit error

Usage

virustotal_rate_limit_error(
  message = "Rate limit exceeded",
  retry_after = 60,
  call = sys.call(-1)
)

Arguments

message

Error message

retry_after

Number of seconds to wait before retry

call

The calling function (automatically detected)

Value

An error object of class virustotal_rate_limit_error

See Also

Other error handling: virustotal-errors, virustotal_auth_error(), virustotal_check(), virustotal_error(), virustotal_validation_error()


Create a VirusTotal URL scan result

Description

Create a VirusTotal URL scan result

Usage

virustotal_url_scan(data)

Arguments

data

Raw API response data

Value

Object of class virustotal_url_scan

See Also

Other response classes: virustotal-classes, virustotal_domain_report(), virustotal_file_report(), virustotal_file_scan(), virustotal_ip_report()


Create a validation error

Description

Create a validation error

Usage

virustotal_validation_error(
  message,
  parameter = NULL,
  value = NULL,
  call = sys.call(-1)
)

Arguments

message

Error message

parameter

The parameter that failed validation

value

The invalid value

call

The calling function (automatically detected)

Value

An error object of class virustotal_validation_error

See Also

Other error handling: virustotal-errors, virustotal_auth_error(), virustotal_check(), virustotal_error(), virustotal_rate_limit_error()


Get package version information

Description

Get package version information

Usage

virustotal_version()

Value

Character string with package version

See Also

Other utilities: cleanup_temp_files(), create_safe_temp_dir(), format_file_size(), is_safe_environment(), utilities, validate_vt_response(), virustotal_info()

mirror server hosted at Truenetwork, Russian Federation.