Malware_Analyzer_Python

import nest_asyncio
nest_asyncio.apply()
import vt

API_KEY = "..."
file_hash = "b6c8ea821d4ac1817d21c3d022b6c232faae7439f6ed263d9a52b41f4a889c8a"

MALWARE_LIBRARY = {
    "njrat": "Remote Access Trojan (RAT) - Provides full remote control, webcam spying, and keylogging.",
    "wannacry": "Ransomware - Encrypts files for ransom and spreads rapidly via network vulnerabilities.",
    "redline": "Infostealer - Targets browser passwords, Discord tokens, and crypto wallets.",
    "agenttesla": "Spyware - Monitors system activity, captures screenshots, and exfiltrates data.",
    "emotet": "Botnet/Loader - Primarily used to distribute other high-level malware variants.",
    "nanocore": "Remote Access Trojan (RAT) - Known for its persistence and ability to bypass security layers."
}

with vt.Client(API_KEY) as client:
    try:
        file_obj = client.get_object(f"/files/{file_hash}")
        stats = file_obj.last_analysis_stats
        malicious = stats['malicious']
        full_name = file_obj.get('meaningful_name', 'N/A')

        print(f"🕵️ MALWARE ANALYSIS REPORT ")
        print(f"● Sample Name: {full_name}")

        status_label = '🔴 HIGH RISK' if malicious > 5 else '🟡 SUSPICIOUS' if malicious > 0 else '🟢 CLEAN'
        print(f"● Status: {status_label} ({malicious} security vendors flagged this)")

        found_behavior = False
        name_lower = full_name.lower()
        for family, description in MALWARE_LIBRARY.items():
            if family in name_lower:
                print(f"● Classification: {description}")
                found_behavior = True
                break
        if not found_behavior:
            print(f"● Classification: New malware strain or unidentified variant.")

        tags = [t for t in file_obj.get("tags", []) if t not in ['peexe', 'exe', 'win32', 'windows']]
        if tags:
            print(f"● Behavior Tags: {', '.join(tags[:4])}")

        it = client.iterator(f"/files/{file_hash}/contacted_ips", limit=3)
        print(f"● Command & Control (C2) Infrastructure:")

        has_ip = False
        for ip in it:
            has_ip = True
            country = ip.get('country', '??')
            provider = ip.get('as_owner', 'Unknown Provider')
            print(f"  └─> {ip.id:<15} [{country}] - {provider}")

        if not has_ip:
            print("  └─> No public network connections detected.")

        print(f"~~~~~~~~~~~~~~~~~~~~~~~~")
        print(f"🔗 Detailed Behavior: https://www.virustotal.com/gui/file/{file_hash}/behavior")

    except Exception as e:
        print(f"❌ Error occurred: {e}")