Overview
VirusTotal provides a service to analyze files and URLs for viruses, worms, trojans, and other kinds of malicious content. It is one of the most renowned and best-rated data sources within the cybersecurity sphere, particularly when it comes to malware research.
Upon submitting a file or URL, basic results are shared with the submitter and between the examining partners who use results to improve their own systems. It inspects items with over 70 antivirus scanners and URL/domain blacklisting services in addition to a myriad of tools to extract signals from the studied content. This core analysis is also the basis for several other features, including the VirusTotal Community: A network that allows users to comment on files and URLs and share notes with each other. VirusTotal can be useful in detecting malicious content and also in identifying false positives—Normal and harmless items detected as malicious by one or more scanners.
Through collaboration between members of the antivirus industry, researchers, and end-users of all kinds, VirusTotal has built a database of over two billion analyzed files thus filling a gap for many companies which experience a lack of resources to collect their own malware samples and related indicators of compromise (IOCs).
The Premium API is a paid solution available for enterprise users. This is an extension of the VirusTotal Public API and can thus return more threat context, as well as expose advanced threat hunting, malware discovery endpoints, and functionality, such as the VirusTotal Intelligence Search queries. More information on the VirusTotal APIs can be found here .
The Premium API has many advantages over the Public API such as:
- A strict Service License Agreement (SLA) that guarantees availability and readiness of data
- Has more endpoints (similarity search, clustering, behavioral information, etc.), and returns richer information for the items looked up, exposes whitelisting, and trusted source information
- Allows you to choose a request rate and daily quota allowance that best suits your needs
You can read more about VirusTotal Premium API Transforms on Maltego's website here.
To Redirecting URLs [VirusTotal Premium API]
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Redirecting URLs [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Output Entities | maltego.URL |
Variants
| virustotalpremium.urlToRedirectingUrls | Returns URLs that redirected to the given URL | maltego.URL |
| virustotalpremium.dnsNameToRedirectingUrls | Returns URLs that redirected to the given DNS Name | maltego.DNSName |
| virustotalpremium.domainToRedirectingUrls | Returns URLs that redirected to the given domain | maltego.Domain |
To Contacted Domains [VirusTotal Premium API]
Description
Returns the domains contacted by the URL
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Contacted Domains [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.urlToContactedDomains |
| Short Description | Returns the domains contacted by the URL |
| Input Entities | maltego.URL |
| Output Entities | maltego.Domain |
To VirusTotal File [VirusTotal Premium API]
| antivirusLabelContains | Antivirus Label Contains | string | | True | True | False |
| apikey | VirusTotal API Key | string | | True | True | True |
| behaviourReportContains | Behaviour Report Contains | string | | True | True | False |
| downloadedFrom | Downloaded From | string | | True | True | False |
| fileMetadataContains | File Metadata Contains | string | | True | True | False |
| fileName | File Name | string | | True | True | False |
| fileSignatureContains | File Signature Contains | string | | True | True | False |
| fileType | File Type | string | | True | True | False |
| lastSeenAfter | Last Seen After | datetime | | True | True | False |
| lastSeenBefore | Last Seen Before | date | | True | True | False |
| maxFileSizeKb | Maximum File Size (KB) | string | | True | True | False |
| minDetections | Minimum Detections | string | | True | True | False |
| minFileSizeKb | Minimum File Size (KB) | string | | True | True | False |
| minimumTimesSubmitted | Minimum Times Submitted | string | | True | True | False |
| minimumUniqueSources | Minimum Unique Sources | string | | True | True | False |
| tags | Tags | string | | True | True | False |
| Display Name | To VirusTotal File [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Output Entities | maltego.virustotal.File |
Variants
| virustotalpremium.yaraRuleToVirusTotalFile | Returns the files that contain this YARA rule. | maltego.virustotal.YaraRule |
| virustotalpremium.sigmaRuleToVirusTotalFile | Returns the files that contain this Sigma rule. | maltego.virustotal.SigmaRule |
| virustotalpremium.idsRuleToVirusTotalFile | Returns the destination port that the IDS rule defines. | maltego.virustotal.IdsRule |
To Redirects [VirusTotal Premium API]
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Redirects [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Output Entities | maltego.URL |
Variants
| virustotalpremium.domainToRedirectsTo | Returns URLs a given domain redirects to | maltego.Domain |
| virustotalpremium.urlToRedirectsTo | Returns URLs a given URL redirects to | maltego.URL |
| virustotalpremium.dnsNameToRedirectsTo | Returns URLs a given DNS Name redirects to | maltego.DNSName |
To Carbon Black Children [VirusTotal Premium API]
Description
Returns files derived from the file according to Carbon Black
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Carbon Black Children [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToCarbonBlackChildren |
| Short Description | Returns files derived from the file according to Carbon Black |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.virustotal.File |
To Download URL [VirusTotal Premium API]
Description
Returns the URL to download the VirusTotal file. Warning, you might be possibly downloading Malware. The URL expires after a 1 hour
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Download URL [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToDownloadUrl |
| Short Description | Returns the URL to download the VirusTotal file. Warning, you might be possibly downloading Malware. The URL expires after a 1 hour |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.URL |
To Sigma Rules [VirusTotal Premium API]
Description
Returns sigma rules for a file.
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Sigma Rules [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToSigmaRules |
| Short Description | Returns sigma rules for a file. |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.virustotal.SigmaRule |
To DownloadedFiles [VirusTotal Premium API]
Description
Returns the files downloaded from the URL
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To DownloadedFiles [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.urlToDownloadedFiles |
| Short Description | Returns the files downloaded from the URL |
| Input Entities | maltego.URL |
| Output Entities | maltego.virustotal.File |
To Destination Port [VirusTotal Premium API]
Description
Returns the destination port that the IDS rule defines.
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Destination Port [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.idsRuleToDestinationPort |
| Short Description | Returns the destination port that the IDS rule defines. |
| Input Entities | maltego.virustotal.IdsRule |
| Output Entities | maltego.Port |
To Embedded Domains [VirusTotal Premium API]
Description
Returns domain names embedded in a given file
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Embedded Domains [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToEmbeddedDomains |
| Short Description | Returns domain names embedded in a given file |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.Domain |
To Files in Ciphered Bundle [VirusTotal Premium API]
Description
Returns files bundled inside a given file with a password
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Files in Ciphered Bundle [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToFilesInCipheredBundle |
| Short Description | Returns files bundled inside a given file with a password |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.virustotal.File |
To Overlay Parent Files [VirusTotal Premium API]
Description
Returns files containing a given file as an overlay
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Overlay Parent Files [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToOverlayParents |
| Short Description | Returns files containing a given file as an overlay |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.virustotal.File |
To Similar Domains [VirusTotal Premium API]
Description
Returns domains with similar names.
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Similar Domains [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.domainToFuzzyDomains |
| Short Description | Returns domains with similar names. |
| Input Entities | maltego.Domain |
| Output Entities | maltego.Domain |
To Downloaded Files [VirusTotal Premium API]
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Downloaded Files [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Output Entities | maltego.virustotal.File |
Variants
| virustotalpremium.domainToDownloadedFiles | Returns files downloaded from the Internet domain | maltego.Domain |
| virustotalpremium.ipv4AddressToDownloadedFiles | Returns files downloaded from the IP Address | maltego.IPv4Address |
| virustotalpremium.dnsNameToDownloadedFiles | Returns files downloaded from the DNS Name | maltego.DNSName |
To Embedded IP Addresses [VirusTotal Premium API]
Description
Returns IP addresses embedded in a given file
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Embedded IP Addresses [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToEmbeddedIpAddresses |
| Short Description | Returns IP addresses embedded in a given file |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.IPv4Address |
To Domains [VirusTotal Premium API]
Description
Returns similarly configured domains.
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Domains [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpublic.jarmFingerprintToDomains |
| Short Description | Returns similarly configured domains. |
| Input Entities | maltego.Hash |
| Output Entities | maltego.Domain |
To PCap Parent Files [VirusTotal Premium API]
Description
Returns PCap files containing a given file
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To PCap Parent Files [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToPcapParentFiles |
| Short Description | Returns PCap files containing a given file |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.virustotal.File |
Domains Analysed in Subnet [VirusTotal Premium API]
Description
Searches VirusTotal for domains analysed in the subnet using VirusTotal intelligence query syntax
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | Domains Analysed in Subnet [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.cidrToAnalysedDomain |
| Short Description | Searches VirusTotal for domains analysed in the subnet using VirusTotal intelligence query syntax |
| Input Entities | maltego.CIDR |
| Output Entities | maltego.Domain |
To YARA Rules [VirusTotal Premium API]
Description
Returns YARA rules for a file.
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To YARA Rules [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToYaraRules |
| Short Description | Returns YARA rules for a file. |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.virustotal.YaraRule |
To URLs [VirusTotal Premium API]
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To URLs [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Output Entities | maltego.URL |
Variants
| virustotalpremium.dnsNameToUrls | Returns URLs with the input DNS Name | maltego.DNSName |
| virustotalpremium.domainToUrls | Returns URLs with this Internet domain | maltego.Domain |
| virustotalpremium.ipv4AddressToUrls | Returns URLs related to the IP Address | maltego.IPv4Address |
To Compressed Parent Files [VirusTotal Premium API]
Description
Returns compressed files that contain the file
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Compressed Parent Files [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToCompressedParents |
| Short Description | Returns compressed files that contain the file |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.virustotal.File |
To Email Attachments [VirusTotal Premium API]
Description
Returns files contained in an email file as attachments
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Email Attachments [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToEmailAttachments |
| Short Description | Returns files contained in an email file as attachments |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.virustotal.File |
To URLs Sharing Tracking Code [VirusTotal Premium API]
Description
Returns URLs sharing the given tracking code
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To URLs Sharing Tracking Code [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.trackingCodeToURL |
| Short Description | Returns URLs sharing the given tracking code |
| Input Entities | maltego.UniqueIdentifier |
| Output Entities | maltego.URL |
To VirusTotal Files [VirusTotal Premium API]
Description
Searches VirusTotal for files tagged with a specific Common Vulnerability and Exposure (CVE).
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To VirusTotal Files [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.cveToVirustotalFiles |
| Short Description | Searches VirusTotal for files tagged with a specific Common Vulnerability and Exposure (CVE). |
| Input Entities | maltego.CVE |
| Output Entities | maltego.File |
To IDS Rules [VirusTotal Premium API]
Description
Returns IDS rules for a file.
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To IDS Rules [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToIdsRules |
| Short Description | Returns IDS rules for a file. |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.virustotal.IdsRule |
To Email Parents [VirusTotal Premium API]
Description
Returns the email files containing a given file
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Email Parents [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToEmailParents |
| Short Description | Returns the email files containing a given file |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.virustotal.File |
Raw Intelligence Search [VirusTotal Premium API]
Description
Searches VirusTotal for domains, IP addresses, files, URLs and comments using the VirusTotal Intelligence query syntax
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | Raw Intelligence Search [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.phraseToRawIntelligenceSearch |
| Short Description | Searches VirusTotal for domains, IP addresses, files, URLs and comments using the VirusTotal Intelligence query syntax |
| Input Entities | maltego.Phrase |
| Output Entities | maltego.IPv4Address,maltego.Domain,maltego.virustotal.File, maltego.virustotal.Comment,maltego.URL |
Description
Returns the IP Addresses contacted by the URL
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Contacted IP Addresses [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.urlToContactedIpAddresses |
| Short Description | Returns the IP Addresses contacted by the URL |
| Input Entities | maltego.URL |
| Output Entities | maltego.IPv4Address |
To Analysis Results [VirusTotal Premium API]
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Analysis Results [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Output Entities | maltego.virustotal.AnalysisResult |
Variants
| virustotalpremium.virustotalFileToAnalysisResults | Returns the results of analyses done on the file | maltego.virustotal.File |
| virustotalpremium.UrlToAnalysisResults | Returns the results of analyses done on the url | maltego.URL |
URLs Analysed in Subnet [VirusTotal Premium API]
Description
Searches VirusTotal for URLs analysed in the subnet using VirusTotal intelligence query syntax
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | URLs Analysed in Subnet [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.cidrToAnalysedUrl |
| Short Description | Searches VirusTotal for URLs analysed in the subnet using VirusTotal intelligence query syntax |
| Input Entities | maltego.CIDR |
| Output Entities | maltego.URL |
To JARM Fingerprint [VirusTotal Premium API]
Description
Returns the JARM fingerprint of the domain.
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To JARM Fingerprint [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.domainToJarmFingerprint |
| Short Description | Returns the JARM fingerprint of the domain. |
| Input Entities | maltego.Domain |
| Output Entities | maltego.Hash |
To URLs in the Wild [VirusTotal Premium API]
Description
Returns a list of in the wild URLs from which the file has been downloaded
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To URLs in the Wild [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToItwURLs |
| Short Description | Returns a list of in the wild URLs from which the file has been downloaded |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.URL |
To Similar Files [VirusTotal Premium API]
Description
Returns a list of similar files to a given one
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Similar Files [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToSimilarFiles |
| Short Description | Returns a list of similar files to a given one |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.virustotal.File |
To Carbon Black Parents [VirusTotal Premium API]
Description
Returns files from which a given file was derived according to Carbon Black
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Carbon Black Parents [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToCarbonBlackParents |
| Short Description | Returns files from which a given file was derived according to Carbon Black |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.virustotal.File |
To Domains in the Wild [VirusTotal Premium API]
Description
Returns a list of in the wild domain names from which the file has been downloaded
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Domains in the Wild [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.virustotalFileToItwDomains |
| Short Description | Returns a list of in the wild domain names from which the file has been downloaded |
| Input Entities | maltego.virustotal.File |
| Output Entities | maltego.Domain |
To Source Port [VirusTotal Premium API]
Description
Returns the source port that the IDS rule defines.
| apikey | VirusTotal API Key | string | | True | True | True |
| Display Name | To Source Port [VirusTotal Premium API] |
| Owner | |
| Author | Maltego |
| Data Source | VirusTotal Premium API |
| Transform Name | virustotalpremium.idsRuleToSourcePort |
| Short Description | Returns the source port that the IDS rule defines. |
| Input Entities | maltego.virustotal.IdsRule |
| Output Entities | maltego.Port |
