hackedteam/test-av

# Copyright (C) 2010-2012 Cuckoo Sandbox Developers.
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# See the file 'docs/LICENSE' for copying permission.

import os
import json
import urllib
import urllib2

from lib.cuckoo.common.utils import File
from lib.cuckoo.common.abstracts import Processing
from lib.cuckoo.common.exceptions import CuckooProcessingError

VIRUSTOTAL_URL = "https://www.virustotal.com/vtapi/v2/file/report"
VIRUSTOTAL_KEY = ""

class VirusTotal(Processing):
    """Gets antivirus signatures from VirusTotal.com"""

    def run(self):
        """Runs VirusTotal processing
        @return: full VirusTotal report.
        """

        self.key = "virustotal"
        virustotal = []

        if not os.path.exists(self.file_path):
            raise CuckooProcessingError("File %s not found, skip" % self.file_path)

        if not VIRUSTOTAL_KEY:
            raise CuckooProcessingError("VirusTotal API key not configured, skip")

        try:
            md5 = File(self.file_path).get_md5()
        except IOError as e:
            raise CuckooProcessingError("Unable to open \"%s\": %s" % (self.file_path, e))

        data = urllib.urlencode({"resource" : md5, "apikey" : VIRUSTOTAL_KEY})

        try:
            req = urllib2.Request(VIRUSTOTAL_URL, data)
            response = urllib2.urlopen(req)
            virustotal = json.loads(response.read())
        except urllib2.URLError as e:
            raise CuckooProcessingError("Unable to establish connection to VirusTotal: %s" % e)
        except urllib2.HTTPError as e:
            raise CuckooProcessingError("Unable to perform HTTP request to VirusTotal (http code=%s)" % e.code)

        return virustotal