performing-malware-hash-enrichment-with-virustotal

name	performing-malware-hash-enrichment-with-virustotal
description	Enrich malware file hashes using the VirusTotal API to retrieve detection rates, behavioral analysis, YARA matches, and contextual threat intelligence for incident triage and IOC validation.
domain	cybersecurity
subdomain	threat-intelligence
tags	["virustotal","malware-analysis","hash-enrichment","ioc","threat-intelligence","triage","api","detection"]
version	1.0
author	mahipal
license	Apache-2.0

Performing Malware Hash Enrichment with VirusTotal

Overview

VirusTotal is the world's largest crowdsourced malware corpus, scanning files with 70+ antivirus engines and providing behavioral analysis, YARA rule matches, network indicators, and community intelligence. This skill covers using the VirusTotal API v3 to enrich file hashes (MD5, SHA-1, SHA-256) with detection verdicts, sandbox reports, related indicators, and contextual intelligence for SOC triage, incident response, and threat intelligence enrichment workflows.

Prerequisites

• Python 3.9+ with vt-py (official VirusTotal Python client) or requests
• VirusTotal API key (free tier: 4 requests/minute, 500/day; premium for higher limits)
• Understanding of file hash types: MD5, SHA-1, SHA-256
• Familiarity with AV detection naming conventions
• STIX 2.1 knowledge for IOC representation

Key Concepts

VirusTotal API v3

The API provides RESTful endpoints for file reports (/files/{hash}), URL scanning, domain reports, IP address intelligence, and advanced hunting with VirusTotal Intelligence (VTI). Each file report includes detection results from 70+ AV engines, behavioral analysis from sandboxes, YARA rule matches, sigma rule matches, file metadata (PE headers, imports, sections), network indicators (contacted IPs, domains, URLs), and community votes and comments.

Hash Enrichment Workflow

The typical enrichment flow is: receive hash from alert/EDR -> query VT API -> parse detection ratio -> extract behavioral indicators -> correlate with existing intelligence -> make triage decision. The API returns a last_analysis_stats object with malicious, suspicious, undetected, and harmless counts.

Pivoting from Hashes

VirusTotal enables pivoting from a single hash to related intelligence: similar files (ITW/in-the-wild samples), contacted domains and IPs (C2 infrastructure), dropped files, embedded URLs, YARA rule matches, and threat actor attribution through crowdsourced intelligence.

Practical Steps

Step 1: Query VirusTotal for Hash Report

import vt
import json
import hashlib
from datetime import datetime

class VTEnricher:
    def __init__(self, api_key):
        self.client = vt.Client(api_key)

    def enrich_hash(self, file_hash):
        """Enrich a file hash with VirusTotal intelligence."""
        try:
            file_obj = self.client.get_object(f"/files/{file_hash}")
            stats = file_obj.last_analysis_stats
            report = {
                "hash": file_hash,
                "sha256": file_obj.sha256,
                "sha1": file_obj.sha1,
                "md5": file_obj.md5,
                "file_type": getattr(file_obj, "type_description", "Unknown"),
                "file_size": getattr(file_obj, "size", 0),
                "first_submission": str(getattr(file_obj, "first_submission_date", "")),
                "last_analysis_date": str(getattr(file_obj, "last_analysis_date", "")),
                "detection_stats": {
                    "malicious": stats.get("malicious", 0),
                    : stats.get(, ),
                    : stats.get(, ),
                    : stats.get(, ),
                },
                : ,
                : (file_obj, , {}),
                : (file_obj, , []),
                : (file_obj, , []),
            }
            total_engines = (stats.values())
            mal_count = stats.get(, )
            report[] = (
                  mal_count > total_engines * 
                   mal_count > total_engines * 
                   mal_count > total_engines * 
                   mal_count > 
                 
            )
            (
                  )
             report
         vt.error.APIError  e:
            ()
             

     ():
        
        :
            behaviors = .client.get_object()
            behavior_data = {
                : [],
                : [],
                : [],
                : [],
                : [],
                : [],
                : [],
            }
             sandbox  (behaviors, , []):
                attrs = sandbox.get(, {})
                behavior_data[].extend(
                    attrs.get(, []))
                behavior_data[].extend(
                    [f.get(, )  f  attrs.get(, [])])
                behavior_data[].extend(
                    [r.get(, )  r  attrs.get(, [])])
                behavior_data[].extend(
                    [d.get(, )  d  attrs.get(, [])])
                behavior_data[].extend(
                    attrs.get(, []))
             behavior_data
         Exception  e:
            ()
             {}

     ():
        .client.close()


enricher = VTEnricher()
report = enricher.enrich_hash()
(json.dumps(report, indent=, default=))
enricher.close()

Step 2: Batch Hash Enrichment with Rate Limiting

import time
import csv

def batch_enrich(api_key, hash_file, output_file, rate_limit=4):
    """Enrich a list of hashes from a file with rate limiting."""
    enricher = VTEnricher(api_key)
    results = []

    with open(hash_file, "r") as f:
        hashes = [line.strip() for line in f if line.strip()]

    print(f"[*] Enriching {len(hashes)} hashes (rate: {rate_limit}/min)")
    for i, file_hash in enumerate(hashes):
        report = enricher.enrich_hash(file_hash)
        if report:
            results.append(report)
        if (i + 1) % rate_limit == 0:
            print(f"  [{i+1}/{len(hashes)}] Rate limit pause (60s)...")
            time.sleep(60)

    # Export to CSV
    with open(output_file, "w", newline="") as f:
        if results:
            writer = csv.DictWriter(f, fieldnames=results[0].keys())
            writer.writeheader()
            for r in results:
                flat = {k: str(v) for k, v in r.items()}
                writer.writerow(flat)

    ()
    ()
    enricher.close()
     results

batch_enrich(, , )

Step 3: Extract Network Indicators for Pivoting

def extract_network_iocs(api_key, file_hash):
    """Extract network-based IOCs from VT for C2 identification."""
    client = vt.Client(api_key)
    network_iocs = {
        "contacted_ips": [],
        "contacted_domains": [],
        "contacted_urls": [],
        "embedded_urls": [],
    }

    try:
        # Get contacted IPs
        it = client.iterator(f"/files/{file_hash}/contacted_ips")
        for ip_obj in it:
            network_iocs["contacted_ips"].append({
                "ip": ip_obj.id,
                "country": getattr(ip_obj, "country", ""),
                "asn": getattr(ip_obj, "asn", 0),
                "as_owner": getattr(ip_obj, "as_owner", ""),
            })

        # Get contacted domains
        it = client.iterator(f"/files/{file_hash}/contacted_domains")
        for domain_obj in it:
            network_iocs["contacted_domains"].append({
                "domain": domain_obj.id,
                "registrar": getattr(domain_obj, "registrar", ""),
                "creation_date": str(getattr(domain_obj, "creation_date", )),
            })

        
        it = client.iterator()
         url_obj  it:
            network_iocs[].append({
                : url_obj.url,
                : (url_obj, , ),
            })

     Exception  e:
        ()
    :
        client.close()

    (
          
          )
     network_iocs

Step 4: YARA Rule Matching and Threat Classification

def get_yara_matches(api_key, file_hash):
    """Retrieve YARA rule matches for threat classification."""
    client = vt.Client(api_key)
    try:
        file_obj = client.get_object(f"/files/{file_hash}")
        crowdsourced_yara = getattr(file_obj, "crowdsourced_yara_results", [])

        matches = []
        for rule in crowdsourced_yara:
            matches.append({
                "rule_name": rule.get("rule_name", ""),
                "ruleset_name": rule.get("ruleset_name", ""),
                "author": rule.get("author", ""),
                "description": rule.get("description", ""),
                "source": rule.get("source", ""),
            })

        # Classify based on YARA matches
        classifications = set()
        for m in matches:
            rule_lower = m["rule_name"].lower()
            if any(k in rule_lower for k in ["apt", "nation", "state"]):
                classifications.add("apt")
            if any(k in rule_lower for k in ["ransom", ]):
                classifications.add()
             (k  rule_lower  k  [, , ]):
                classifications.add()
             (k  rule_lower  k  [, ]):
                classifications.add()

        ()
        ()
         {: matches, : (classifications)}
    :
        client.close()

Step 5: Generate Enrichment Report

def generate_enrichment_report(hash_report, behavior, network, yara_data):
    """Generate comprehensive enrichment report."""
    report = {
        "metadata": {
            "generated": datetime.now().isoformat(),
            "hash": hash_report.get("sha256", ""),
        },
        "verdict": {
            "threat_level": hash_report.get("threat_level", "unknown"),
            "detection_ratio": hash_report.get("detection_ratio", "0/0"),
            "classifications": yara_data.get("classifications", []),
            "threat_names": hash_report.get("popular_threat_names", {}),
        },
        "behavioral_indicators": {
            "processes": behavior.get("processes_created", [])[:10],
            "dns_queries": behavior.get("dns_lookups", [])[:10],
            "commands": behavior.get("commands_executed", [])[:10],
        },
        "network_indicators": {
            "c2_candidates": network.get("contacted_ips", [])[:10],
            "domains": network.get("contacted_domains", [])[:10],
        },
        "yara_matches": yara_data.get("matches", [])[:10],
        "recommendation": (
            "BLOCK and investigate" if hash_report.get()  (, )
               hash_report.get() == 
             
        ),
    }

     (, )  f:
        json.dump(report, f, indent=, default=)
     report

Validation Criteria

• VT API v3 queried successfully with proper authentication
• File hash enriched with detection stats, behavioral data, and network indicators
• Batch enrichment handles rate limiting correctly
• Network IOCs extracted for C2 identification
• YARA matches retrieved and used for classification
• Enrichment report generated with actionable verdict

References

• VirusTotal API v3 Documentation
• vt-py Official Python Client
• VirusTotal Intelligence
• Torq: VT Hash Enrichment Workflow
• Dynatrace: Enrich Observables with VT
• Penligent: VT in Incident Response