Author: Gaurav Sood
Date: 2026-04-12

# Using virustotal

#### Gaurav Sood

#### 2026-04-12

## Using virustotal

The virustotal package provides access to the VirusTotal API v3, allowing you to scan files and URLs for malware, get domain and IP intelligence, and retrieve comprehensive threat analysis reports.

### Installation

To get the current development version from GitHub:

    install.packages("virustotal")

Or install the development version:

    library(devtools)
    install_github("themains/virustotal")

#### Load the library:

    library(virustotal)

#### Authentication

1. Get your free API key from VirusTotal
2. Set the API key in your R session:

    set_key("your_api_key_here")

### Core Functions

#### File Analysis

Scan a file for malware:

    # Submit a file for analysis
    result <- scan_file("path/to/suspicious_file.exe")
    analysis_id <- result$data$id

Get file analysis report:

    # Get analysis results using file hash
    report <- file_report("99017f6eebbac24f351415dd410d522d")

    # Access scan results
    scan_results <- report$data$attributes$last_analysis_results
    total_engines <- length(scan_results)
    detections <- sum(sapply(scan_results, function(x) x$category == "malicious"))

Request file rescan:

    # Request new analysis of existing file
    rescan_result <- rescan_file("99017f6eebbac24f351415dd410d522d")
    new_analysis_id <- rescan_result$data$id

#### URL Analysis

Scan a URL:

    # Submit URL for analysis
    url_result <- scan_url("http://suspicious-site.com")
    analysis_id <- url_result$data$id

Get URL analysis report:

    # Get analysis results using URL
    report <- url_report("http://www.google.com")

    # Access scan results
    scan_results <- report$data$attributes$last_analysis_results
    threat_score <- report$data$attributes$stats

#### Domain Intelligence

Get domain information:

    # Get comprehensive domain analysis
    domain_info <- domain_report("google.com")

    # Access various data points
    categories <- domain_info$data$attributes$categories
    whois_data <- domain_info$data$attributes$whois
    dns_records <- domain_info$data$attributes$dns_records

#### IP Address Intelligence

Get IP address information:

    # Get IP analysis including geolocation and ASN
    ip_info <- ip_report("8.8.8.8")

    # Access geo and network information
    country <- ip_info$data$attributes$country
    asn <- ip_info$data$attributes$asn
    network <- ip_info$data$attributes$network

### Rate Limiting

The package automatically handles VirusTotal’s rate limits (4 requests per minute for free accounts). You don’t need to implement your own rate limiting.

### Error Handling

All functions include comprehensive input validation and will provide clear error messages for common issues like missing API keys or invalid parameters.