# Virustotal

VirusTotal is a free online service that analyzes files and URLs for viruses, worms, trojans, and other kinds of malicious content using multiple antivirus engines and website scanners.

- **Category:** security & identity tools
- **Auth:** API_KEY
- **Composio Managed App Available?** N/A
- **Tools:** 16
- **Triggers:** 0
- **Slug:** `VIRUSTOTAL`
- **Version:** 20260323_00

## Tools

### Add VirusTotal Comment

**Slug:** `VIRUSTOTAL_ADD_COMMENT`

Tool to add a comment to a VirusTotal resource (file, URL, domain, or IP address). Use after analyzing a resource to leave contextual feedback. Provide exactly one identifier per call.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `url` | string | No | URL resource identifier to comment on. Mutually exclusive with file, domain, and ip_address. |
| `file` | string | No | SHA-256 hash of the file to comment on. Mutually exclusive with url, domain, and ip_address. |
| `text` | string | Yes | The comment text to add. |
| `domain` | string | No | Domain name to comment on. Mutually exclusive with file, url, and ip_address. |
| `ip_address` | string | No | IP address to comment on. Mutually exclusive with file, url, and domain. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Add Vote

**Slug:** `VIRUSTOTAL_ADD_VOTE`

Tool to add a vote (harmless/malicious) to a VirusTotal resource. Use after reviewing analysis results to submit your verdict.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | object | Yes | The vote data object to submit. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Analysis Report

**Slug:** `VIRUSTOTAL_GET_ANALYSIS`

Tool to retrieve the analysis report of a file or URL submission. Use after obtaining an analysis ID to fetch its detailed report. Analysis results may be incomplete immediately after submission; poll until the report status is 'completed' before treating results as final.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `id` | string | Yes | The identifier of the analysis to retrieve |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get comments

**Slug:** `VIRUSTOTAL_GET_COMMENTS`

Tool to retrieve the latest comments on a VirusTotal resource. Use when you need to review user-generated comments for a file, URL, domain, or IP after obtaining its identifier.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `sort` | string ("asc" | "desc") | No | Sort order by comment date ('asc' or 'desc') |
| `limit` | integer | No | Number of comments to return per page (default: 10, max: 40) |
| `cursor` | string | No | Pagination cursor for fetching next page |
| `filter_resource` | string | Yes | Resource identifier to get comments for (SHA-256, URL, domain, or IP address) |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Domain Relationships

**Slug:** `VIRUSTOTAL_GET_DOMAIN_RELATIONSHIPS`

Tool to retrieve relationship objects for a given domain. Use when you have a domain and need to explore its related entities.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `limit` | integer | No | Number of items to return per page (1-40). Defaults to server default if omitted. |
| `cursor` | string | No | Pagination cursor for fetching next page of results. |
| `domain` | string | Yes | The domain name to query (e.g., 'example.com'). |
| `relationship` | string ("communicating_files" | "referrer_files" | "downloaded_files" | "resolutions" | "subdomains" | "categories" | "whois" | "ssl_certificates" | "detected_downloaded_samples" | "detected_referrer_samples") | Yes | Type of relationship to retrieve. Allowed values:             communicating_files, referrer_files, downloaded_files, resolutions, subdomains,             categories, whois, ssl_certificates, detected_downloaded_samples, detected_referrer_samples. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Domain Report

**Slug:** `VIRUSTOTAL_GET_DOMAIN_REPORT`

Tool to retrieve the analysis report of a domain. Use when you need detailed insight on a domain's reputation and analysis stats. No malicious signals on obscure or low-traffic domains may indicate limited analysis history rather than safety — treat sparse results as 'unknown', not 'safe'. Covers external OSINT only (reputation, malware, SSL posture); cannot analyze internal/private assets.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `domain` | string | Yes | The domain name to retrieve the report for (e.g., 'example.com') |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get File Report

**Slug:** `VIRUSTOTAL_GET_FILE_REPORT`

Tool to retrieve the analysis report of a file. Use when you have a file's hash and need detailed scan metadata. Recently submitted files may return partial results; retry after a short delay before treating the report as final.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `id` | string | Yes | Unique file identifier (SHA-256, SHA-1, MD5 hash or scan_id) |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get IP Address Relationships

**Slug:** `VIRUSTOTAL_GET_IP_ADDRESS_RELATIONSHIPS`

Tool to retrieve objects related to a specific IP address by relationship type. Use when you have an IP and need to explore connected files, URLs, or other entities.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `ip` | string | Yes | The IPv4 or IPv6 address to query (e.g., '8.8.8.8'). |
| `limit` | integer | No | Number of items to return per page (1-40). Defaults to server default if omitted. |
| `cursor` | string | No | Pagination cursor for fetching next page of results. |
| `relationship` | string ("communicating_files" | "downloaded_files" | "communicating_urls") | Yes | Type of relationship to retrieve. Allowed values: communicating_files, downloaded_files, communicating_urls. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get IP Address Report

**Slug:** `VIRUSTOTAL_GET_IP_ADDRESS_REPORT`

Tool to retrieve the analysis report of an IP address. Use when you need detailed insight on an IP's reputation, ASN, country, and analysis stats. Low or zero detections indicate unknown risk, not safety — treat sparse data accordingly. Provides external OSINT only; insufficient as standalone compliance evidence.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `ip` | string | Yes | The IP address to retrieve the report for (IPv4 or IPv6) Note: this parameter is named `ip`, not `ipAddress` (used by ABUSEIPDB_CHECK_IP); using the wrong name causes validation failure. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get VirusTotal Metadata

**Slug:** `VIRUSTOTAL_GET_METADATA`

Tool to retrieve VirusTotal metadata. Use when you need information about available privileges, relationships between resources (like files, domains, IPs, URLs), and supported antivirus engines.

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get URL Report

**Slug:** `VIRUSTOTAL_GET_URL_REPORT`

Tool to retrieve the analysis report of a URL. Use when you have a URL identifier (base64-url without padding) and need detailed scan results, reputation, and metadata. Results may be incomplete immediately after submission; retry with short delays if scan engines are still processing before treating the report as final.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `id` | string | Yes | Base64 URL identifier (RFC 4648 without padding) of the URL |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Votes

**Slug:** `VIRUSTOTAL_GET_VOTES`

Tool to retrieve votes on files, URLs, domains, or IP addresses. Use when you need to view community votes for a given object.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `limit` | integer | No | Maximum number of votes to retrieve (default: 10, max: 40). |
| `cursor` | string | No | Pagination cursor for fetching subsequent pages of results. |
| `object_id` | string | Yes | Identifier of the object (e.g., file hash, URL-encoded URL, domain name, or IP address). |
| `object_type` | string ("files" | "urls" | "domains" | "ip_addresses") | Yes | Type of the object to retrieve votes for: 'files', 'urls', 'domains', or 'ip_addresses'. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Rescan File

**Slug:** `VIRUSTOTAL_RESCAN_FILE`

Tool to re-analyze a previously submitted file. Use when you need updated analysis results after an initial scan.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `id` | string | Yes | Unique file identifier (SHA-256, SHA-1, or MD5 hash of the file) to re-analyze. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Scan URL

**Slug:** `VIRUSTOTAL_SCAN_URL`

Tool to submit a URL for scanning. Use when you have a URL and need to submit it to VirusTotal to obtain an analysis ID for later retrieval. The returned analysis ID is preliminary — scanning engines may not have finished. Poll VIRUSTOTAL_GET_URL_REPORT with the ID using short delays to retrieve complete results.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `url` | string | Yes | The URL to be analyzed. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Search VirusTotal

**Slug:** `VIRUSTOTAL_SEARCH`

Tool to search for objects in the VirusTotal database. Use when locating files, URLs, domains, IPs, or comments matching a query. Supports pagination with limit and cursor.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `limit` | integer | No | Maximum number of items to return (1-40). Defaults to 10 if not specified. |
| `query` | string | Yes | Query string to search in the VirusTotal database. Can be a file hash, URL, domain, IP address, or an advanced search query. |
| `cursor` | string | No | Pagination cursor from a previous SEARCH response. Use to retrieve the next batch of results. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Upload File

**Slug:** `VIRUSTOTAL_UPLOAD_FILE`

Tool to upload a file for scanning. Use when you have binary file content ready to submit for VirusTotal analysis.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `file` | string | Yes | Binary content of the file to upload. |
| `filename` | string | No | Optional filename to use for the uploaded file. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |