A powerful Python tool for SOC analysts to check files, hashes, URLs, and IP addresses using VirusTotal API.
- File Scanning: Calculate and check file hashes (MD5, SHA1, SHA256)
- Hash Verification: Verify single or batch hashes against VirusTotal
- URL Checking: Analyze URLs for malicious content
- IP Reputation: Check IP addresses for threats
- Flexible Input: Scan folders recursively or check lists from files
- CSV Export: Generate detailed reports with threat analysis
- Color-coded Output: Visual risk indicators (🔴 malicious, 🟡 suspicious, 🟢 clean)
- Python 3.8+
- VirusTotal API key (free tier available at https://www.virustotal.com)
- Clone the repository:
git clone https://github.com/D1sCript/vt-complete-scanner.git cd vt-complete-scanner
- Install dependencies:
pip install -r requirements.txt
- Configure API key:
- Open
vt_scanner.py - Find line:
API_KEY = "INSERT_YOUR_API_KEY_HERE" - Replace with your actual VirusTotal API key
- Open
python vt_scanner.py --check-ips ips.txt -o report.csv
python vt_scanner.py --check-hashes hashes.txt -o report.csv
python vt_scanner.py --check-urls urls.txt -o report.csv
python vt_scanner.py --scan-folder ./suspicious_files/ -o report.csv
python vt_scanner.py --scan-folder ./files/ --check-ips ips.txt --check-urls urls.txt -o full_report.csv
python vt_scanner.py --help
IPs file (ips.txt):
8.8.8.8
1.1.1.1
185.220.101.1
Hashes file (hashes.txt):
5d41402abc4b2a76b9719d911017c592
098f6bcd4621d373cade4e832627b4f6
URLs file (urls.txt):
http://example.com
https://suspicious-site.xyz
- 🔴 MALICIOUS - 10+ detections (immediate action required)
- 🟡 SUSPICIOUS - 3-9 detections (further investigation needed)
- 🟢 CLEAN - 0-2 detections (likely safe)
- Incident Response: Quickly check reputation of indicators during incidents
- Threat Hunting: Batch analyze indicators of compromise (IOCs)
- Malware Analysis: Verify file hashes against threat intelligence
- Phishing Investigation: Check URLs and domains from suspicious emails
- Security Research: Analyze infrastructure associated with threats
Results are exported to CSV with the following columns:
- Type (HASH, URL, IP)
- Value (indicator)
- Risk (MALICIOUS, SUSPICIOUS, CLEAN)
- Detections (number of AV vendors detecting threat)
- Total (total number of vendors analyzed)
- Category (threat classification)
- Last Analysis (when last analyzed)
These tools are provided for educational and professional security purposes only. Always ensure you have proper authorization before checking indicators or analyzing systems.
MIT License - See LICENSE for details
D1sCript
For issues, suggestions, or questions, please open an issue on GitHub.
⭐ If you find this tool useful, please consider giving it a star!