Scans a file and returns the analysis.

If the file is uploaded to a URL, it is preferred that you use the Scan URL action instead.

Note:: If the analysis is taking too long, this action may return it in a queued state. You can use the Get Analysis action to retrieve it’s completed result later or increase the step timeout.

External Documentation

To learn more, visit the VirusTotal documentation.

​
Parameters

ParameterDescription
File DataContents of the file to upload.
File HashThe SHA-256, SHA-1 or MD5 identifying the file.
File IdentifierThe identifier of the file. You can create a file identifier using the Set File Variable action.
Scan TypeThe type of scan you would like to perform.
Time IntervalThe duration (seconds) between analysis checks.

​
Example Output

{
	"meta": {
		"file_info": {
			"sha256": "9428f125287088fa3a2077dfa90e4d1463303e26f6b2da8cd01c0997153e9d01",
			"sha1": "ea7734f4ef6e1981fbabd3d0a1a7d197bec25642",
			"md5": "a578678d586be4a357c23dc0a8897a5c",
			"size": 9636
		}
	},
	"data": {
		"attributes": {
			"date": 1668590600,
			"status": "completed",
			"stats": {
				"harmless": 0,
				"type-unsupported": 14,
				"suspicious": 0,
				"confirmed-timeout": 0,
				"timeout": 1,
				"failure": 0,
				"malicious": 0,
				"undetected": 61
			},
			"results": {
				"Bkav": {
					"category": "undetected",
					"engine_name": "Bkav",
					"engine_version": "1.3.0.9899",
					"result": null,
					"method": "blacklist",
					"engine_update": "20221116"
				},
				"Lionic": {
					"category": "undetected",
					"engine_name": "Lionic",
					"engine_version": "7.5",
					"result": null,
					"method": "blacklist",
					"engine_update": "20221116"
				},
				"tehtris": {
					"category": "type-unsupported",
					"engine_name": "tehtris",
					"engine_version": "v0.1.4",
					"result": null,
					"method": "blacklist",
					"engine_update": "20221116"
				}
			}
		},
		"type": "analysis",
		"id": "YskjdaksasdaM6MTY2ODU5MDYwMA==",
		"links": {
			"item": "https://www.virustotal.com/api/v3/files/9428f125287088faasdjksahkdsadsa7153e9d01",
			"self": "https://www.virustotal.com/api/v3/analyses/YTU3ODY3OGQ1ODASFNJKHASKJDHJSAMDYwMA=="
		}
	}
}

​
Workflow Library Example

Detect and Respond to Gmail Email Phishing

Preview this Workflow on desktop

Was this page helpful?

Get IP Address ReportScan URL