VirusTotal

Announcements of new plug-ins. Plug-ins are discussed in a forum below.
Post Reply
pepak
Posts: 444
Joined: Sun 13 Jul, 2008 11:18
Has thanked: 9 times
Been thanked: 25 times

VirusTotal

Post by pepak » Sun 24 Nov, 2019 18:34

This plugin allows FAR Manager users to easily verify the status of an executable file at VirusTotal.com. When executed, the plugin will communicate with the server and if there is a report for that file, display it; otherwise it will upload the file to VirusTotal and wait for a new report to be generated, then display that report.

The plugin can be discussed in the discussion thread.

Download - version 0.01 (2019-11-24) Installation

Before you can use the plugin, two prerequisites need to be met:
  1. The plugin requires that OpenSSL version 1.0 must be available in a directory from which DLL files are loaded. That generally means either the FAR Manager's root directory (%FARHOME%), Windows system directory (C:\WINDOWS\SYSTEM32, C:\WINDOWS\SYSWOW64) or a directory with the system's PATH. I recommend the FAR directory. Note that the plugin's directory will not work, unless it's in the PATH! If this prerequisite is not satisfied, you will get an error message "SSL/TLS support is not compiled!".
  2. You will need to obtain a VirusTotal API key. This can be done for free at https://www.virustotal.com/gui/join-us. This is a requirement of VirusTotal, without the key no VirusTotal API services can be used. The API key can be entered in the plugin's configuration where you can also set various limits on the use of the service. The predefined values are tailored to the free API key according to the current documentation (as of November 2019, may need changing if the terms of service change). You may obtain a private API key with lower limits, possibly.
Usage

In order to verify a file at VirusTotal, select that file on a regular file panel and activate the plugin. A hash of the file will be calculated and sent to VirusTotal servers. If a report exists for that hash, it will be displayed. If there is no such report, the file will get uploaded to the VirusTotal servers and put into the analysis queue; once processed, the new report will be displayed. Note that this process can take quite a long time, in my tests, two or three minutes were not unusual.

In the report view, antimalware which detected a problem are listed first, alphabetically, followed by the non-detecting antimalware. You can search in the list by the name of the antivirus or the name of the malware. You can also request a re-scan by pressing the Re-scan button (or F5). By default, the file will get uploaded again, but you can attempt to enable the rescan API in the configuration; unfortunately, I was never able to get it to work, my API key was always refused as not having sufficient privileges.
Last edited by pepak on Sun 24 Nov, 2019 18:36, edited 1 time in total.

Post Reply

Return to “Announcements of new Plug-Ins”