VTReportObject Raising Error if Hash not Previously Seen
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 491
- Forks
- 290
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 3
Description
Hi,
When querying for a VirusTotal Report with the line:
VTReportObject(apikey=vt_apikey, indicator=file_md5)
I have noticed that the if the indicator input (file_md5) has no matches found on VirusTotal, then the line will raise the exception:
pymisp.exceptions.InvalidMISPObject: [this is the file_md5 hash]: The requested resource is not among the finished, queued or pending scans
I am wondering:
-
Is it possible for the VTReportObject to nevertheless return some kind of report (stating that the indicator has no match on VirusTotal), such that my program does not break at that particular line due to the exception raised.
-
In the case that the file have nver been scanned by VirusTotal, is there a way to "upload" the file directly (as bytes?) through PyMISP for direct analysis by the vendor analyzers in VirusTotal?
Thanks
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing VTReportObject(apikey=vt_apikey, indicator=file_md5) and the InvalidMISPObject path for indicators with no VirusTotal matches. Review the VirusTotal response handling and determine the expected behavior for an unscanned hash and for uploading file bytes; done means the requested behavior is defined and covered without the current exception breaking the caller.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100