Skip to main content
Scans a file and returns the analysis. If the file is uploaded to a URL, it is preferred that you use the Scan URL action instead. Note:: If the analysis is taking too long, this action may return it in a queued state. You can use the Get Analysis action to retrieve it’s completed result later or increase the step timeout.
External DocumentationTo learn more, visit the VirusTotal documentation.

​
Parameters

ParameterDescription
File DataContents of the file to upload.
File HashThe SHA-256, SHA-1 or MD5 identifying the file.
File IdentifierThe identifier of the file. You can create a file identifier using the Set File Variable action.
Scan TypeThe type of scan you would like to perform.
Time IntervalThe duration (seconds) between analysis checks.

​
Example Output

{
	"data": {
		"id": "mock_analysis_id_12345",
		"type": "analysis",
		"links": {
			"self": "https://www.virustotal.com/v3/analyses/mock_analysis_id_12345",
			"item": "https://www.virustotal.com/v3/files/mock_file_hash_abcdef123456"
		},
		"attributes": {
			"date": 1672531200,
			"stats": {
				"malicious": 0,
				"suspicious": 1,
				"undetected": 58,
				"harmless": 2,
				"timeout": 0,
				"confirmed-timeout": 0,
				"failure": 1,
				"type-unsupported": 10
			},
			"status": "completed",
			"results": {
				"MockAV": {
					"method": "signature",
					"engine_name": "MockAV",
					"engine_version": "3.1.2",
					"engine_update": "20240801",
					"category": "undetected",
					"result": null
				},
				"ExampleScanner": {
					"method": "heuristic",
					"engine_name": "ExampleScanner",
					"engine_version": "1.5.7",
					"engine_update": "20240805",
					"category": "suspicious",
					"result": "PUA.Generic.Suspicious"
				},
				"TestEngine": {
					"method": "behavioral",
					"engine_name": "TestEngine",
					"engine_version": "2.8.1",
					"engine_update": "20240804",
					"category": "harmless",
					"result": null
				}
			}
		}
	},
	"meta": {
		"file_info": {
			"sha256": "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
			"md5": "12345678901234567890123456789012",
			"sha1": "1234567890123456789012345678901234567890",
			"size": 1024
		}
	}
}

​
Workflow Library Example

Detect and Respond to Gmail Email Phishing
Workflow LibraryPreview this Workflow on desktop
⌘I