malware-hash

What this skill does

Accepts a file hash (MD5/SHA1/SHA256) or file path and queries the VirusTotal API v3 for malware reputation. Parses detection ratio, per-vendor results, tags, and first-seen date to summarize the threat level.

When to use

• Quickly checking whether a suspicious file is a known malware sample
• Assessing the threat level of hashes collected during incident response
• Bulk-querying hashes from an IOC list
• Prioritizing files before forensic analysis

Prerequisites

• curl (HTTP requests)
• python3 (JSON parsing)
• VirusTotal API key: environment variable SECSKILL_VT_API_KEY

API key setup (in priority order)