Struct iocutil::virustotal::VirusTotalClient

pub struct VirusTotalClient { /* fields omitted */ }

Methods

impl VirusTotalClient

pub fn new(apikey: impl AsRef<str>) -> Self

new client with apikey

pub fn query_filereport_allinfo<T>(
    &self,
    resource: impl AsRef<str>
) -> Result<T, Error> where
    T: DeserializeOwned, 

get file report of VirusTotal (with allinfo option)

Example

use iocutil::prelude::*;
use serde::Deserialize;

#[derive(Deserialize)]
struct FieldsWhatYouNeed {
    response_code: i32,
    // fields you want to retrieve
}

let client = VirusTotalClient::default();
let sample = SampleHash::new("d41d8cd98f00b204e9800998ecf8427e").expect("failed to parse hash");
let report: FieldsWhatYouNeed = client.query_filereport_allinfo(sample).expect("failed to retrieve hash");
assert_eq!(report.response_code, 1);

pub fn get_raw_filereport_json(
    &self,
    resource: impl AsRef<str>,
    allinfo: bool
) -> Result<String, Error>

get raw filereport as text

Example

use iocutil::prelude::*;

let client = VirusTotalClient::default();
let json_text = client.get_raw_filereport_json(
        "d41d8cd98f00b204e9800998ecf8427e",
        false,
    ).expect("failed to get report");

pub fn get_raw_filereport_json_at(
    &self,
    hash: impl TryInto<SampleHash>,
    allinfo: bool,
    datetime: DateTime<Utc>
) -> Result<String, Error>

get raw filereport json at specified datetime

Example

use iocutil::prelude::*;

let client = VirusTotalClient::default();
let json_text = client.get_raw_filereport_json_at(
        "d41d8cd98f00b204e9800998ecf8427e",
        false,
        days_ago(7)
    ).expect("failed to get report");

pub fn query_filereport_at(
    &self,
    hash: impl TryInto<SampleHash>,
    datetime: DateTime<Utc>
) -> Result<FileReport, Error>

query_filereport_at

Example

use iocutil::prelude::*;
let client = VirusTotalClient::default();

let report = client.query_filereport_at(
        "d41d8cd98f00b204e9800998ecf8427e",
        days_ago(7)
    ).expect("failed to query");

pub fn query_filereport(
    &self,
    resource: impl AsRef<str>
) -> Result<FileReport, Error>

query file report (without allinfo)

pub fn batch_query_allinfo<T>(
    &self,
    resources: impl IntoIterator<Item = impl AsRef<str>>
) -> Vec<Result<T, Error>> where
    T: DeserializeOwned, 

batch query file report

Example

use iocutil::prelude::*;
use serde::Deserialize;

#[derive(Deserialize)]
struct FieldsWhatYouNeed {
    response_code: i32,
    // fields you want to retrieve
}

let vtclient = VirusTotalClient::default();
let hashes = &["d41d8cd98f00b204e9800998ecf8427e"];
let items: Vec<Result<FieldsWhatYouNeed, failure::Error>> = vtclient.batch_query_allinfo(hashes);
for item in items {
    item.expect("failed to retrieve");
}

pub fn batch_query(
    &self,
    resources: impl IntoIterator<Item = impl AsRef<str>>,
    public_api: bool
) -> Vec<Result<FileReport, Error>>

batch query file report

Example

use iocutil::prelude::*;

let vtclient = VirusTotalClient::default();
let hashes = &["e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"];
let items = vtclient.batch_query(hashes, true);
for item in items {
    item.expect("failed to retrieve");
}

pub fn download(
    &self,
    hash: impl TryInto<SampleHash>,
    into: impl AsRef<Path>
) -> Result<(), Error>

download a file from hash

Example

use iocutil::prelude::*;

let client = VirusTotalClient::default();
client.download(
        "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "./e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    ).expect("failed to download file");

std::fs::remove_file("./e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855")
    .expect("failed to remove file");

Important traits for Search

impl Iterator for Search type Item = Vec<SampleHash>;

pub fn search_by_pages(
    &self,
    query: impl AsRef<str>,
    goal: Option<usize>
) -> Search

search by page (Private API required) https://www.virustotal.com/intelligence/help/file-search/#search-modifiers

Example

use iocutil::prelude::*;

let client = VirusTotalClient::default();
let mut pages = client.search_by_pages("p:5+ AND submitter:CN", Some(600));

let samples: Vec<_> = pages.do_search().expect("failed to search");
assert_eq!(samples.len(), 300)

pub fn search<T>(&self, query: impl AsRef<str>, goal: Option<usize>) -> T where
    T: FromIterator<SampleHash>, 

search samples (Private API required) https://www.virustotal.com/intelligence/help/file-search/#search-modifiers

Example

use iocutil::prelude::*;

let client = VirusTotalClient::default();

let samples: Vec<_> = client.search("p:5+ AND submitter:CN", Some(600));
assert_eq!(samples.len(), 600)

Trait Implementations

impl Default for VirusTotalClient

fn default() -> Self

Returns the "default value" for a type.