Virus Total API to check File before Upload via PHP

If you are looking for a FREE virus scanner (A Powerful Virus / Malware scanner) you may want to consider Virus Total. Virus Total is owned by Google and it helps to tell you whether the URL and files you scan contain malware, or suspicious virus and malware. One of the cool things about Virus Total is its ability to provide up to 70  results from different engines. Please check up yourself the engines from Virus Total.  Oh not to forget they are FREE for PUBLIC USE. It allows you to scan up to 500 times daily. Crazy yea!!!!

Virus Total Integration to your website using API.
Most of the software developers would like to use Virus Total API to help them with scanning specific files before uploading to the server. Note* Just use this Virus Total if you are not submitting something that is sensitive.

How to implmenent the API

1. First Sign up for free
2. Get the API Keys
3. To Upload the file to Virus Total via API
4. To generate a report from Virus Total via API

Sign up for FREE
Let’s sign up using the link. Super Easy I am NOT going to walk through this step because this is damn easy. Follow the link  https://www.virustotal.com/

Get the API Keys
Just find in the profile the API keys

Upload a file to Virus Total Via  then  get the Report from API

You may need to use VS code to use Composer to download the necessary Vendor Files. Go to Terminal and download via Composer composer require guzzlehttp/guzzle

<?php

$file_name_with_full_path = realpath(‘sample.json’); // I just use  sample.json for illustration purposes

$api_key = getenv(‘VT_API_KEY’) ? getenv(‘VT_API_KEY’) :’API KEYS‘;

$cfile = curl_file_create($file_name_with_full_path);

$post = array(‘apikey’ => $api_key,’file’=> $cfile);

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, ‘https://www.virustotal.com/vtapi/v2/file/scan’);

curl_setopt($ch, CURLOPT_POST, True);

curl_setopt($ch, CURLOPT_VERBOSE, 1); // remove this if your not debugging

curl_setopt($ch, CURLOPT_ENCODING, ‘gzip,deflate’); // please compress data

curl_setopt($ch, CURLOPT_USERAGENT, “gzip, My php curl client”);

curl_setopt($ch, CURLOPT_RETURNTRANSFER ,True);

curl_setopt($ch, CURLOPT_POSTFIELDS, $post);

$result=curl_exec ($ch);

$status_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

print(“status = $status_code\n”);

if ($status_code == 200) { // OK

  $js = json_decode($result, true);

  //getting the result

  result($js[‘resource’]);

} else {  // Error occured

  print($result);

}

curl_close ($ch);

// The get report function.

function result( $resource){

$post = array(‘apikey’ => ‘API KEY‘,’resource’=>$resource);

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, ‘https://www.virustotal.com/vtapi/v2/file/report’);

curl_setopt($ch, CURLOPT_POST,1);

curl_setopt($ch, CURLOPT_VERBOSE, 1); // remove this if your not debugging

curl_setopt($ch, CURLOPT_ENCODING, ‘gzip,deflate’); // please compress data

curl_setopt($ch, CURLOPT_USERAGENT, “gzip, My php curl client”);

curl_setopt($ch, CURLOPT_RETURNTRANSFER ,true);

curl_setopt($ch, CURLOPT_POSTFIELDS, $post);

$result=curl_exec ($ch);

$status_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

print(“status = $status_code\n”);

if ($status_code == 200) { // OK

  $js = json_decode($result, true);

  echo ‘<pre>’;

  print_r($js);

  echo $js[‘positives’];

} else {  // Error occured

  print($result);

}

curl_close ($ch);

}

?>

To Generate Report

Report Result from Virus API

    [scan_id] => 3d8ea947e2117a46a30d028f61608ab8e38c40ca1666119a5bf837c7cc519f65-1697119982
    [sha1] => c71936218af77def46d3d40b5ea438523f6c824b
    [resource] => 3d8ea947e2117a46a30d028f61608ab8e38c40ca1666119a5bf837c7cc519f65
    [response_code] => 1
    [scan_date] => 2023-10-12 14:13:02
    [permalink] => https://www.virustotal.com/gui/file/3d8ea947e2117a46a30d028f61608ab8e38c40ca1666119a5bf837c7cc519f65/detection/f-3d8ea947e2117a46a30d028f61608ab8e38c40ca1666119a5bf837c7cc519f65-1697119982
    [verbose_msg] => Scan finished, information embedded
    [total] => 60
    [positives] => 0
    [sha256] => 3d8ea947e2117a46a30d028f61608ab8e38c40ca1666119a5bf837c7cc519f65
    [md5] => 1cbb78c6b3089de3a2ae28e009903801

positives ‘0’ means there are no malicious or viruses in the file.