diff --git a/public/arf.json b/public/arf.json index 54e061b..8d02eda 100644 --- a/public/arf.json +++ b/public/arf.json @@ -17945,32 +17945,122 @@ { "name": "Decalage Malware Search", "type": "url", - "url": "https://decalage.info/en/mwsearch" + "url": "https://decalage.info/en/mwsearch", + "description": "Custom metasearch engine that indexes malware analysis databases to find malware samples containing specific strings, filenames, hashes, or IOCs.", + "status": "live", + "pricing": "free", + "bestFor": "Quick metasearch across multiple malware analysis databases by hash, string, or filename", + "input": "IOC (hash, filename, string, yara rule, VT hash)", + "output": "Links to malware analysis reports from aggregated databases", + "opsec": "passive", + "opsecNote": "Search-only interface; no account required; queries are directed to indexed databases", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "VirusShare.com", "type": "url", - "url": "https://virusshare.com/" + "url": "https://virusshare.com/", + "description": "Repository of 111+ million live malware samples provided for security researchers, incident responders, forensic analysts, and researchers.", + "status": "live", + "pricing": "free", + "bestFor": "Bulk access to malware sample collections for research and analysis", + "input": "MD5 hash, account credentials", + "output": "Malware sample files (zip archives, password protected), related IOCs", + "opsec": "passive", + "opsecNote": "Registration required; no direct execution occurs; passive hash lookup available", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "#totalhash", "type": "url", - "url": "https://totalhash.cymru.com/" + "url": "https://totalhash.cymru.com/", + "description": "Malware Hash Registry that searches against 30+ antivirus databases to validate malware hashes with detection percentage results. Updated daily.", + "status": "live", + "pricing": "free", + "bestFor": "Hash validation against 30+ AV engines with detection percentages", + "input": "MD5 or SHA-1 hash", + "output": "Detection percentage, last seen timestamp, signature matches from AV databases", + "opsec": "passive", + "opsecNote": "No registration required; read-only hash lookups leave minimal traces", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "VX Vault", "type": "url", - "url": "https://vxvault.net/ViriList.php" + "url": "https://vxvault.net/ViriList.php", + "description": "Active collection of malware samples and related data shared among security researchers and malware analysts for threat intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Access to active malware sample collections", + "input": "Web interface browsing, malware sample queries", + "output": "Malware sample information, related indicators", + "opsec": "passive", + "opsecNote": "Web-based browsing interface; no registration typically required", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ID Ransomware", "type": "url", - "url": "https://id-ransomware.malwarehunterteam.com/" + "url": "https://id-ransomware.malwarehunterteam.com/", + "description": "Free ransomware identification tool that analyzes ransom notes and encrypted file samples to identify variants and provide decryption guidance. Detects 1181+ ransomware types.", + "status": "live", + "pricing": "free", + "bestFor": "Ransomware identification and victim support", + "input": "Ransom note file, encrypted file sample, ransom email address", + "output": "Ransomware variant identification, decryption status, victim resources", + "opsec": "passive", + "opsecNote": "File uploads provide victim privacy options to protect personal data exposure", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "National Software Reference Library", "type": "url", - "url": "https://nsrl.hashsets.com/national_software_reference_library1_search.php" + "url": "https://nsrl.hashsets.com/national_software_reference_library1_search.php", + "description": "NIST-maintained repository of cryptographic hash values for known, legitimate software to identify known-good files during digital forensics investigations.", + "status": "live", + "pricing": "free", + "bestFor": "Eliminating known-good files in forensic investigations and digital triage", + "input": "File hash (MD5, SHA-1, SHA-256), software query", + "output": "Hash matches to known software, file metadata, product versioning", + "opsec": "passive", + "opsecNote": "No registration required; lookup-only service; government maintained", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -17985,12 +18075,42 @@ { "name": "TYLabs QuickSand Framework", "type": "url", - "url": "https://scan.tylabs.com/" + "url": "https://scan.tylabs.com/", + "description": "Python-based malware analysis framework for analyzing Office documents and PDFs to identify exploits in decoded streams using YARA signatures.", + "status": "live", + "pricing": "freemium", + "bestFor": "Document and PDF malware analysis with exploit detection", + "input": "Office documents (.doc, .xls, .ppt), PDFs, emails, Postscript", + "output": "YARA signature matches, exploit detection, risk scoring, threat analysis", + "opsec": "active", + "opsecNote": "Hosted analysis requires file upload; local installation available for offline use", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "JoeSandbox Document Analyzer", "type": "url", - "url": "https://www.joesandbox.com/" + "url": "https://www.joesandbox.com/", + "description": "Hosted automated malware analysis service that performs dynamic and static analysis of files including Office documents, PDFs, and executables with comprehensive behavioral reporting.", + "status": "live", + "pricing": "freemium", + "bestFor": "Comprehensive malware analysis with behavioral insights and threat scoring", + "input": "Executable files, documents, PDFs, URLs, APKs (Max 30MB free tier)", + "output": "Behavioral analysis, network IOCs, detection verdicts, MITRE ATT&CK mappings, export formats (JSON, XML, HTML, PDF)", + "opsec": "active", + "opsecNote": "File uploads are processed on external sandbox; free tier limited to 30 submissions/month", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -18001,7 +18121,22 @@ { "name": "TYLabs QuickSand Framework", "type": "url", - "url": "https://scan.tylabs.com/" + "url": "https://scan.tylabs.com/", + "description": "Python-based malware analysis framework for analyzing Office documents and PDFs to identify exploits in decoded streams using YARA signatures.", + "status": "live", + "pricing": "freemium", + "bestFor": "Document and PDF malware analysis with exploit detection", + "input": "Office documents (.doc, .xls, .ppt), PDFs, emails, Postscript", + "output": "YARA signature matches, exploit detection, risk scoring, threat analysis", + "opsec": "active", + "opsecNote": "Hosted analysis requires file upload; local installation available for offline use", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -18012,12 +18147,42 @@ { "name": "Akana Android Malware", "type": "url", - "url": "https://akana.mobiseclab.org/" + "url": "https://akana.mobiseclab.org/", + "description": "Online Android Interactive Analysis Environment with plugins for analyzing malicious Android applications and APKs for suspicious behavior and malware characteristics.", + "status": "live", + "pricing": "free", + "bestFor": "Android app malware analysis and interactive examination", + "input": "Android APK files", + "output": "Malware detection results, behavioral analysis, plugin-based threat assessment", + "opsec": "active", + "opsecNote": "File uploads required; external analysis service", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Joe APK Analyzer", "type": "url", - "url": "https://www.apk-analyzer.net/" + "url": "https://www.apk-analyzer.net/", + "description": "Part of Joe Sandbox suite; performs dynamic and static analysis of Android Application Packages to detect malicious behavior and generate detailed analysis reports.", + "status": "live", + "pricing": "freemium", + "bestFor": "Android malware analysis with dynamic behavior monitoring", + "input": "Android APK files", + "output": "Malware detection, behavioral analysis, threat intelligence IOCs", + "opsec": "active", + "opsecNote": "File uploads to external sandbox; free tier has limitations", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -18044,67 +18209,262 @@ { "name": "OPSWAT Meta Defender", "type": "url", - "url": "https://metadefender.opswat.com/#!/" + "url": "https://metadefender.opswat.com/#!/", + "description": "Multi-engine malware scanning service using 20+ antivirus engines with advanced threat analysis, content disarm & reconstruction, and emulation-based detection for zero-day threats.", + "status": "live", + "pricing": "freemium", + "bestFor": "Multi-engine malware detection with advanced threat analysis", + "input": "Files (all types), URLs", + "output": "Multi-engine scan results, threat verdicts, IOC extraction, file behavior analysis", + "opsec": "active", + "opsecNote": "File uploads required; free community version available with API limits", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Hybrid Analysis", "type": "url", - "url": "https://hybrid-analysis.com/" + "url": "https://hybrid-analysis.com/", + "description": "Free automated malware analysis service powered by CrowdStrike Falcon Sandbox. Combines runtime data with memory dump analysis to extract execution pathways and IOCs for evasive malware.", + "status": "live", + "pricing": "freemium", + "bestFor": "Advanced malware behavior analysis and evasion detection", + "input": "Files (30MB max free tier), URLs, APKs (up to 30 per month free)", + "output": "Hybrid behavioral analysis, memory dumps, disassembly, IOC extraction, behavioral indicators", + "opsec": "active", + "opsecNote": "Free tier limited to 30 uploads/month; file uploads to external sandbox infrastructure", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Malware Config", "type": "url", - "url": "https://malwareconfig.com/" + "url": "https://malwareconfig.com/", + "description": "Database for searching and analyzing extracted malware configurations by hash, domain, or IP address to track C2 infrastructure and malware attributes.", + "status": "live", + "pricing": "free", + "bestFor": "Malware configuration extraction and C2 server tracking", + "input": "SHA256 hash, domain, IP address, malware family", + "output": "Extracted malware configurations, C2 infrastructure, encrypted keys, command data", + "opsec": "passive", + "opsecNote": "Search-only interface; no file uploads required; passive lookups", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MetaDefender", "type": "url", - "url": "https://metadefender.opswat.com/" + "url": "https://metadefender.opswat.com/", + "description": "OPSWAT's cloud-based multi-engine malware scanning platform with advanced threat detection using 30+ antivirus engines, CDR technology, and behavioral analysis.", + "status": "live", + "pricing": "freemium", + "bestFor": "Enterprise-grade multi-engine malware detection and advanced threat analysis", + "input": "Files, URLs, streams", + "output": "Multi-engine detection results, threat verdicts, behavioral analysis, IOC extraction", + "opsec": "active", + "opsecNote": "File uploads required; commercial and free tiers available", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Ether", "type": "url", - "url": "https://ether.gtisc.gatech.edu/web_unpack/" + "url": "https://ether.gtisc.gatech.edu/web_unpack/", + "description": "Georgia Tech malware analysis framework using Intel VT hardware virtualization for transparent, stealthy malware analysis resistant to anti-analysis techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Transparent malware analysis resistant to anti-analysis evasion", + "input": "Executable files, malware samples", + "output": "Fine-grained execution traces, instruction-level analysis, unpacking results, behavior extraction", + "opsec": "active", + "opsecNote": "Hosted analysis service; academic research project from Georgia Institute of Technology", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Jotti's Malware Scanner", "type": "url", - "url": "https://virusscan.jotti.org/en-US/scan-file" + "url": "https://virusscan.jotti.org/en-US/scan-file", + "description": "Free multi-scanner malware analysis service that submits files for analysis against 14+ antivirus engines. No installation or account setup required.", + "status": "live", + "pricing": "free", + "bestFor": "Quick multi-engine scan without installation or account setup", + "input": "Files (up to 5 concurrent, 250MB per file)", + "output": "Detection results from 14+ AV engines, file metadata, scan reports", + "opsec": "active", + "opsecNote": "No account required; file uploads to external scanning service", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Valkyrie File Analysis", "type": "url", - "url": "https://consumer.valkyrie.comodo.com/" + "url": "https://consumer.valkyrie.comodo.com/", + "description": "Cloud-based verdict-driven malware analysis platform from Comodo using static analysis (450+ unpackers), dynamic analysis, and optional human expert analysis for unknown files.", + "status": "live", + "pricing": "freemium", + "bestFor": "Advanced malware analysis with human expert review option", + "input": "Files (all types), URLs", + "output": "File verdict, behavioral analysis results, IOC extraction, confidence scores, expert analysis", + "opsec": "active", + "opsecNote": "File uploads required; expert analysis available for premium users", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "detux Linux Sandbox", "type": "url", - "url": "https://detux.org/" + "url": "https://detux.org/", + "description": "Open-source multiplatform Linux sandbox for analyzing Linux malware across multiple CPU architectures (x86, x86-64, ARM, MIPS) using QEMU emulation and traffic analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Linux malware analysis across multiple architectures", + "input": "Linux executable files, malware samples", + "output": "Static analysis strings, dynamic traffic capture, IOC extraction, architecture-specific analysis", + "opsec": "active", + "opsecNote": "Open-source tool; can be deployed locally or used as hosted service", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Joe File Analyzer", "type": "url", - "url": "https://www.file-analyzer.net/" + "url": "https://www.file-analyzer.net/", + "description": "Part of Joe Sandbox suite; performs hybrid code analysis of PE files on Windows with detailed behavioral and system interaction reporting.", + "status": "live", + "pricing": "freemium", + "bestFor": "PE file malware analysis with system interaction tracking", + "input": "PE executable files (.exe, .dll, etc.)", + "output": "Hybrid behavioral analysis, system calls, network IOCs, threat scores", + "opsec": "active", + "opsecNote": "File uploads to Joe Sandbox infrastructure; free tier has submission limits", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Pikker.ee Cuckoo Sandbox", "type": "url", - "url": "https://sandbox.pikker.ee/" + "url": "https://sandbox.pikker.ee/", + "description": "Public instance of Cuckoo Sandbox malware analysis system hosted in Estonia. Provides automated dynamic analysis with detailed result reporting for submitted files.", + "status": "live", + "pricing": "free", + "bestFor": "Free automated dynamic malware analysis with detailed behavioral reports", + "input": "Executable files, documents, archives", + "output": "Process monitoring, API calls, file system changes, network traffic, behavioral analysis", + "opsec": "active", + "opsecNote": "Public instance; files uploaded to external infrastructure; Estonian-hosted", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Koodous", "type": "url", - "url": "https://koodous.com" + "url": "https://koodous.com", + "description": "Collaborative platform for Android malware research and analysis with community-driven database of 70+ million Android applications with crowd-sourced malware detection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Android malware analysis with community collaboration and threat intelligence", + "input": "Android APK files, package names, hashes", + "output": "Malware detection results, community analysis, threat indicators, sample sharing", + "opsec": "active", + "opsecNote": "Registration available; community platform with shared threat intelligence", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Any Run", "type": "url", - "url": "https://app.any.run/" + "url": "https://app.any.run/", + "description": "Interactive malware analysis sandbox allowing real-time manual interaction with Windows, macOS, Linux, and Android environments. Fast report generation with MITRE ATT&CK mapping.", + "status": "live", + "pricing": "freemium", + "bestFor": "Interactive malware analysis with real-time system interaction", + "input": "Files, URLs, APKs, documents (platform-specific)", + "output": "Process graphs, behavioral analysis, MITRE ATT&CK TTPs, IOCs, customizable reports", + "opsec": "active", + "opsecNote": "Interactive analysis leaves traces; free tier limited to 3 public analyses/day; private mode in paid plans", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Uncover It", "type": "url", - "url": "https://www.uncoverit.org/" + "url": "https://www.uncoverit.org/", + "description": "Static malware configuration extractor that quickly analyzes files without execution to extract malware configurations, C2 infrastructure, and IOCs in under 5 seconds.", + "status": "live", + "pricing": "free", + "bestFor": "Fast static malware configuration extraction", + "input": "Malware samples, executable files", + "output": "Extracted configurations, C2 servers, encryption keys, behavioral indicators", + "opsec": "passive", + "opsecNote": "Static analysis only; no code execution; quick analysis without external dependencies", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -18115,12 +18475,42 @@ { "name": "Office Mal Scanner (T)", "type": "url", - "url": "https://www.reconstructer.org/" + "url": "https://www.reconstructer.org/", + "description": "Malicious Office document analysis tool for analyzing and reconstructing Office documents to identify exploits and malicious content.", + "status": "live", + "pricing": "free", + "bestFor": "Malicious Office document analysis and reconstruction", + "input": "Microsoft Office documents (.doc, .xls, .ppt)", + "output": "Document structure analysis, malicious content extraction, exploit identification", + "opsec": "active", + "opsecNote": "Document upload required; analysis service online", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OffVis (T)", "type": "url", - "url": "https://download.microsoft.com/download/1/2/7/127ba59a-4fe1-4acd-ba47-513ceef85a85/OffVis.zip" + "url": "https://download.microsoft.com/download/1/2/7/127ba59a-4fe1-4acd-ba47-513ceef85a85/OffVis.zip", + "description": "Microsoft Office Visualization Tool for analyzing Office binary files to identify exploits and malicious structures. Displays hex and object tree views.", + "status": "live", + "pricing": "free", + "bestFor": "Office binary file format analysis and exploit detection", + "input": "Office binary files (.doc, .xls, .ppt, .pps, .pot)", + "output": "File structure visualization, hex dump, object trees, vulnerability detection", + "opsec": "passive", + "opsecNote": "Local desktop application; no file uploads; Microsoft-provided tool", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -18131,12 +18521,42 @@ { "name": "PDF Tools (T)", "type": "url", - "url": "https://blog.didierstevens.com/programs/pdf-tools/" + "url": "https://blog.didierstevens.com/programs/pdf-tools/", + "description": "Free suite of PDF analysis tools by Didier Stevens including pdfid (keyword scanning) and pdf-parser.py for analyzing malicious PDF documents and extracting embedded objects.", + "status": "live", + "pricing": "free", + "bestFor": "PDF structure analysis and malicious object extraction", + "input": "PDF files", + "output": "PDF keyword identification, object parsing, embedded JavaScript detection, IOC extraction", + "opsec": "passive", + "opsecNote": "Command-line tools; local execution; open-source from reputable security researcher", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Origami Framework (T)", "type": "url", - "url": "https://code.google.com/archive/p/origami-pdf/" + "url": "https://code.google.com/archive/p/origami-pdf/", + "description": "Ruby framework for parsing, analyzing, and forging PDF documents. Includes PDF Walker GUI and PDFcop heuristic checker for detecting dangerous PDF content.", + "status": "live", + "pricing": "free", + "bestFor": "PDF parsing and manipulation for malicious PDF analysis", + "input": "PDF files, PDF objects, malicious content", + "output": "Parsed PDF structure, extracted objects, deobfuscated content, modified PDFs", + "opsec": "passive", + "opsecNote": "Open-source framework; local installation required; no file uploads", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -18147,24 +18567,84 @@ { "name": "Malware-Traffic-Analysis.net", "type": "url", - "url": "https://www.malware-traffic-analysis.net/index.html" + "url": "https://www.malware-traffic-analysis.net/index.html", + "description": "Training resource and PCAP repository providing network traffic captures from malware infections since 2013. Includes tutorials and exercises for malware traffic analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Malware network behavior analysis and training exercises", + "input": "PCAP files, network traffic captures", + "output": "Network indicators (IPs, domains, C2 servers), behavioral analysis, post-exploitation patterns", + "opsec": "passive", + "opsecNote": "PCAP analysis is passive; no live malware execution; educational resource", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, { "name": "Ghidra (T)", "type": "url", - "url": "https://github.com/NationalSecurityAgency/ghidra" + "url": "https://github.com/NationalSecurityAgency/ghidra", + "description": "Free and open-source reverse engineering framework from NSA for analyzing compiled software. Includes disassembly, decompilation, scripting, and interactive graphing for malware analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Reverse engineering and static malware analysis", + "input": "Executable files (ELF, PE, Mach-O, raw binaries), multiple architectures", + "output": "Disassembly, decompiled code, control flow graphs, function analysis, custom scripts", + "opsec": "passive", + "opsecNote": "Local desktop application; no file uploads; open-source from NSA", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Malware Analysis Tools", "type": "url", - "url": "https://malwareanalysis.tools/" + "url": "https://malwareanalysis.tools/", + "description": "Curated resource and reference guide for malware analysis tools with recommendations for virtualization, safety practices, and tool selection for analysis scenarios.", + "status": "live", + "pricing": "free", + "bestFor": "Malware analysis tool discovery and best practices reference", + "input": "Tool research, methodology guidance", + "output": "Tool recommendations, analysis methodologies, safety practices, learning resources", + "opsec": "passive", + "opsecNote": "Reference resource only; no file uploads or active analysis", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "virustotal", "type": "url", - "url": "https://www.virustotal.com/gui/home/upload" + "url": "https://www.virustotal.com/gui/home/upload", + "description": "Free online service that analyzes files and URLs for viruses, trojans and malicious content detected by 70+ antivirus engines and URL/domain reputation services.", + "status": "live", + "pricing": "freemium", + "bestFor": "Multi-engine malware scanning and URL reputation lookup", + "input": "Files, URLs, domains, IP addresses, file hashes", + "output": "Detection results from 70+ AV engines, behavioral analysis, file insights, related samples", + "opsec": "passive", + "opsecNote": "File uploads are indexed and visible to other users; hash-only queries are private", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] },