Using PHP to Access the Public VirusTotal API

Updated script for VirusTotal API Version 2.0!

As there is nowadays many spyware and malware out there, it is important to make sure that your own server stays clean.

Therefore I often use the great VirusTotal service to check suspicious files.

For a certain project I wanted to automate this to be able to check some files and URLs in defined time intervals automatically. This can be easily done with the public VirusTotal API.

Unfortunately the link to the PHP implementation provided on the VirusTotal website is down. Therefore I decided to do my own PHP implementation of this API.

You can download a copy of my implementation. The download contains also a small example script explaining how to use it. You’re free to use the implementation in your own projects. Of course, I’d be happy about a small backlink. :-)

In my API implementation not only the default API functions are implemented that are well documented and therefore not explained here, but there are also several helper functions to make life easier which I will explain in the following:

  • getScanID($result): returns the scan ID of a scan result that you can use to query a scan report later on.
  • displayResult($result): displays a scan or submission result in a user readable way.
  • getSubmissionDate($report): returns the submission date of a scan report.
  • getTotalNumberOfChecks($report): returns the total number of anti-virus checks of a scan report.
  • getNumberHits($report): returns the number of anti-virus hits (malware) of a scan report.
  • getReportPermalink($report, $withDate = TRUE): returns the permalink of the scan report. If $withDate == TRUE, permalink returns exactly the current scan report, otherwise it returns always the most recent scan report.

These helper functions should make it much easier to work with the API results as you don’t need to care about the details of the returned JSON object anymore. Therefore here again the download of my free API implementation.

Updated script for VirusTotal API Version 2.0!

Did you use the VirusTotal service already yourself?

This post is also available in Deutsch.

5 thoughts on “Using PHP to Access the Public VirusTotal API

    • Hello Asho,

      of course not as VirusTotal is an online service. Therefore the files and URLs are submitted to VirusTotal and the checks are performed also on their servers.

      Best regards
      Andreas

  1. Pingback: PHP Script for Accessing VirusTotal API Version 2.0 | AB-WebLog.com

  2. Hi! In the first place I can only say you thank you very much for your work. It has saved me a lot of extra work.
    I would like to report a little bug I think I have found. In the function “getNumberHits”, $result->report[1] is obtained in lower case. It should be:
    if ($result != ” &&
    $result != ‘clean site’ &&
    $result != ‘unrated site’)
    $hits++;

Leave a Reply to Andreas Breitschopp Cancel reply

Your email address will not be published. Required fields are marked *

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>