cd ~/projects
CASE STUDY2024

Malware Analysis Tool

Multi-Engine File Scanner

Multi-engine file reputation scanner that triages suspicious samples against 70+ antivirus engines.

PythonVirusTotal API
05 / 05

A Python triage tool for suspicious files: hash locally, cross-reference against 70+ AV engines via the VirusTotal API, and produce a clear malicious/clean verdict. Built to give fast, consensus-based answers during security assessments without uploading sensitive samples blindly.

01THE PROBLEM

During assessments, analysts constantly encounter unknown files. Checking one engine is unreliable; manually checking many is slow. Triage needs a single consensus view — fast, scriptable, and hash-first so samples stay local when needed.

02THE APPROACH
  • SHA-256 hashing lets the tool check file reputation without uploading the sample itself.
  • VirusTotal API aggregates verdicts from 70+ antivirus engines into one consensus report.
  • CLI-first Python design so it slots into existing investigation scripts and pipelines.
03THE OUTCOME
  • Flagged 43 malicious samples out of 80+ real submissions during evaluation.
  • 98% verdict accuracy against confirmed ground truth.
  • Hash-first workflow keeps sensitive files off third-party uploads.