malware-intel
VirusTotal
The canonical file-by-hash lookup: it aggregates antivirus verdicts and sandbox analyses for billions of files, URLs and domains. Paste a hash or URL into the website for a consolidated report, or use its JSON API with a free key for automated lookups. Archives researchers reach for it to identify a mystery file or check whether a hash matches known malware before handling it.
Por qué es útil y cómo funciona
VirusTotal is the first stop for most hash lookups because it runs your file's checksum against more than 70 antivirus engines simultaneously and shows you every vendor's verdict in one consolidated report. Beyond simple detection flags, you also see sandbox behavioral summaries, community comments and related file clusters. You paste an MD5, SHA-1 or SHA-256 into the search bar on the website and get results instantly; automated lookups can be done through its JSON API using a free API key.
Qué contiene
VirusTotal holds over 50 billion files, 6 billion URLs and 4 billion domains. This makes it by far the largest publicly accessible file-by-hash corpus, with new submissions arriving continuously from users and security vendors worldwide.
Acceso por API
https://www.virustotal.com/api/v3/files/ <sha256> (header x-apikey)
Se requiere una clave de API (normalmente gratuita); consulta los endpoints anteriores para saber dónde obtenerla.
Acceso
Programmatic API access (a key may be required, see the API tag).