Virus Total .. security community .. Analyze out-date ! . . 2da prueba . .
..
Por desgracia los de Virus Total se enojan si andas ingresando tanto al ir viendo sus reportes de resultados . . XD . . me dejaron fuera de su servicio y me arrollaron con recaptchas despues de unos cuantos analisis .. como 500 urls XD ..
{ "error": { "code": "RecaptchaRequiredError", "message": "Please re-send request with a valid
reCAPTCHA response in the \"x-recaptcha-response\" header" } } . . .
.
.
Por tal motivo solo hay que pedir ver resultados de VT a los que tengan positivos; perdiendo la opcion de los marcados como sospechozos; que no aparecen como positivos. . :C
.. .. como :...
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: s0.wp.com
Fecha: 2019-03-25 "detection-ratio">0/66<
2019-03-25 han transcurridos 3 dias desde el ultimo analisis
"CLEAN MX":
> "result": "suspicious"
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: secure.gravatar.com
Fecha: 2019-03-27 "detection-ratio">0/66<
2019-03-27 han transcurridos 1 dias desde el ultimo analisis
"Quttera":
> "result": "suspicious"
= = = = = = = = = = = = = = = = = = = = = = = = =
. ..
Tambien decido utilizar un buffer de ultimos urls analizados para bajar la carga de pedidos VT y evitar se me niegue el servicio.
. ..
En linea punteada como quedo el arreglo; aplicado al Privoxy-log (revise entradas anteriores al respecto) ..::
#----------------------------------------------------------------------
# Ejecutar Powershell en folder de Privoxy-log
#----------------------------------------------------------------------
#Tomar las ultimas 100 lineas de "privoxy.log" dejando solo los "Request:" (son los que cruzaron privoxy); y eliminar urls seguras
$urlss = @("\.google\.com", "\.googlevideo\.com", "\.googleapis\.com", "\.gstatic\.com", "\.youtube\.com", "\.virustotal\.com", "myip\.es", "\.yimg\.com")
Get-Content "privoxy.log" | Select-Object -Last 100 | Select-String -Pattern "Request:" | Foreach-Object {$_ -Replace('.+ Request: ', '')} | Foreach-Object {$_ -Replace('\/+.+$', '')} | Foreach-Object {$_ -Replace(':\d+\/$', '')} | Foreach-Object {$_ -Replace('\/$', '')} | Sort-Object -Unique | Select-String -notmatch $urlss | set-content "privoxy100.tmp"
#
# seccion Privoxy-VT-Buffer .. (1 de 2)
# vericar que exista el "Privoxy-VT-Buffer.log"; si no crearlo
if (!(Test-Path "Privoxy-VT-Buffer.log")) { New-Item "Privoxy-VT-Buffer.log" }
# descartar analisis recientes revisando el "Privoxy-VT-Buffer.log"
$AR = Get-Content "Privoxy-VT-Buffer.log" | Sort-Object -Unique
(Get-Content "privoxy100.tmp" -ErrorAction SilentlyContinue ) | Select-String -notmatch $AR | Out-File "privoxy100.tmp"
#
# evitar error de no producirce "privoxy100.tmp" if-else
if ( Test-Path "privoxy100.tmp" ) {
#
#Analizandolas en "VirusTotal"
$URLList = Get-Content "privoxy100.tmp" | ? {$_.trim() -ne "" }
Foreach($Urll in $URLList)
{
# Borrar temporales .tmp
Remove-Item "result-vt.tmp", "resultN-vt.tmp", "vt-vanalisis.tmp" -ErrorAction SilentlyContinue
#
Write-Host " = = = = = = = = = = = = = = = = = = = = = = = = = "
$counter = 1
while (($counter -lt 3) -and !(Test-Path "result-vt.tmp")) {
#
$Uri = $Urll | foreach {"https://www.virustotal.com/es/url/submission/?force=1&url=" + $_ }
$web = Invoke-WebRequest -Proxy 'http://127.0.0.1:8118' -Uri $Uri
$lines = @(".+last-analysis-date..\d+", "detection-ratio..\d+", ".+btn-url-reanalyse.", ".+btn-url-view-last-analysis.")
$web.tostring() -split "[`r`n]" | select-string -Pattern $lines | Foreach-Object {$_ -Replace('^.+id=','')} | Foreach-Object {$_ -Replace('\/span.+$','')} | Set-Content "result-vt.tmp"
Start-Sleep -Seconds 4
$path = "result-vt.tmp"
$counter++
}
# VT detection-ratio
$dr = get-content "result-vt.tmp" | select-string -Pattern '.detection-ratio..\d+'
# viendo fecha de analisis
$VTdate = get-content "result-vt.tmp" | select-string -Pattern 'last-analysis-date' | Foreach-Object {$_ -Replace('^.+date..','')} | Foreach-Object {$_ -Replace('\s\d+\:\d+\:\d+.$','')}
$Newdate = Get-Date -format yyyy-MM-dd
$VTdays = (New-TimeSpan -Start $VTdate -End $Newdate).Days
Write-Host " Url: $Urll "
Write-Host " Fecha: $VTdate $dr"
Write-Host " $VTdate dias transcurridos $VTdays desde el ultimo analisis"
#
# si el analisis es mas viejo de 120 dias se reanalizar de lo contrario solo se veran resultados
if ($VTdays -gt 120) {
# si el analisis es viejo Reanalizando
Write-Host " El analisis tiene mas de 4 meses; pidiendo a VT re-analize "
$VTreanalizar = get-content "result-vt.tmp" | select-string -Pattern '^.btn-url-reanalyse.' | Foreach-Object {$_ -Replace('^.+href=..','')} | Foreach-Object {$_ -Replace('..$','')}
$Urir = $VTreanalizar | foreach {"https://www.virustotal.com/" + $_ }
Invoke-WebRequest -Proxy 'http://127.0.0.1:8118' -Uri $Urir | Out-Null
# Refresh
Start-Sleep -Seconds 6
# ver nuevos resultados
$web = Invoke-WebRequest -Proxy 'http://127.0.0.1:8118' -Uri $Uri
$lines = @(".+last-analysis-date..\d+", "detection-ratio..\d+", ".+btn-url-view-last-analysis.")
$web.tostring() -split "[`r`n]" | select-string -Pattern $lines | Foreach-Object {$_ -Replace('^.+id=','')} | Foreach-Object {$_ -Replace('\/span.+$','')} | Set-Content "resultN-vt.tmp"
#
# esperando; recheck every 3 seconds; que aparesca el archivo o se cumpla la cuenta
$counter = 0
while (($counter -lt 4) -and !(Test-Path "resultN-vt.tmp")) {
$counter++
start-sleep 2 }
#
# VT detection-ratio
$Ndr = get-content "resultN-vt.tmp" | select-string -Pattern '.detection-ratio..\d+'
$VTdate = get-content "resultN-vt.tmp" | select-string -Pattern 'last-analysis-date' | Foreach-Object {$_ -Replace('^.+date..','')} | Foreach-Object {$_ -Replace('\s\d+\:\d+\:\d+.$','')}
Write-Host " Fecha: $VTdate $Ndr"
#
# "viendo analisis; Detecciones . . . . . . . . . . . . "
$Ndrr = $Ndr | Foreach-Object {$_ -Replace('^.+detection-ratio..','')} | Foreach-Object {$_ -Replace('\/.+$','')}
if ($Ndrr -gt 0) {
$VTVerA = get-content "resultN-vt.tmp" | select-string -Pattern 'btn-url-view-last-analysis' | Foreach-Object {$_ -Replace('^.+href=..es.url.','ui/urls/')} | Foreach-Object {$_ -Replace('\/analysis.+$','?relationships=last_serving_ip_address,network_location') }
$UriVerA = $VTVerA | foreach {"https://www.virustotal.com/" + $_ }
$web = Invoke-WebRequest -Proxy 'http://127.0.0.1:8118' -Uri $UriVerA
$web.tostring() -split "[`r`n]" | select-string -Pattern '.result.: .[abd-tvz].+' -Context 6,0 | Set-Content "vt-vanalisis.tmp"
#
get-content "vt-vanalisis.tmp" -ErrorAction SilentlyContinue | Where-Object {$_ -notmatch 'category'} | Where-Object {$_ -notmatch 'engine_'} | Where-Object {$_ -notmatch 'method'} | Foreach-Object {$_ -Replace('{$','') } | Write-Host
}
}
else {
# "viendo analisis; Detecciones . . . . . . . . . . . . "
$drr = $dr | Foreach-Object {$_ -Replace('^.+detection-ratio..','')} | Foreach-Object {$_ -Replace('\/.+$','')}
if ($drr -gt 0) {
$VTVerA = get-content "result-vt.tmp" | select-string -Pattern 'btn-url-view-last-analysis' | Foreach-Object {$_ -Replace('^.+href=..es.url.','ui/urls/')} | Foreach-Object {$_ -Replace('\/analysis.+$','?relationships=last_serving_ip_address,network_location') }
$UriVerA = $VTVerA | foreach {"https://www.virustotal.com/" + $_ }
$web = Invoke-WebRequest -Proxy 'http://127.0.0.1:8118' -Uri $UriVerA
$web.tostring() -split "[`r`n]" | select-string -Pattern '.result.: .[abd-tvz].+' -Context 6,0 | Set-Content "vt-vanalisis.tmp"
#
get-content "vt-vanalisis.tmp" -ErrorAction SilentlyContinue | Where-Object {$_ -notmatch 'category'} | Where-Object {$_ -notmatch 'engine_'} | Where-Object {$_ -notmatch 'method'} | Foreach-Object {$_ -Replace('{$','') } | Write-Host
}
}
Write-Host " = = = = = = = = = = = = = = = = = = = = = = = = = "
}
# seccion Privoxy-VT-Buffer .. (2 de 2)
# si se superan los 2 KB "Privoxy-VT-Buffer.log" eliminara las primeras-lineas 5 hasta que sea menor
# 2 KB aprox 50 lineas
$file = Get-Item "Privoxy-VT-Buffer.log"
$Size = $file.Length / 1KB
if($Size -gt 2) { (Get-Content "Privoxy-VT-Buffer.log") | Select-Object -Skip 2 | set-content "Privoxy-VT-Buffer.log" }
# agregar urls recien analizadas a "Privoxy-VT-Buffer.log"
Add-Content "Privoxy-VT-Buffer.log" -Value (Get-Content "privoxy100.tmp")
(Get-Content "Privoxy-VT-Buffer.log") | ? {$_.trim() -ne "" } | Out-File "Privoxy-VT-Buffer.log"
}
else {
# evitar error de no producirce "privoxy100.tmp" if-else
Write-Host ' Log Sin Cambios '
}
#
# - - -
#Resultados positivos añadirlos a la lista de bloqueo de "privoxy"
#- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Borrar temporales .tmp
Remove-Item *.tmp -ErrorAction SilentlyContinue
# Limpíar variables
Clear-variable -Name "Ipp", "IP", "Uri", "web", "Urii", "webb", "Urll", "URLList", "results", "VTList", "dt", "drr", "dr", "AR" -ErrorAction SilentlyContinue
#
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Imagen inferior como lucen los resultados.
.
. abajo mas resultados ..::
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: algarabia.com
Fecha: 2018-10-08 "detection-ratio">0/67<
2018-10-08 dias transcurridos 174 desde el ultimo analisis
El analisis tiene mas de 4 meses; pidiendo a VT re-analize
Fecha: 2019-03-31 "detection-ratio">0/66<
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: c.disquscdn.com
Fecha: 2019-03-22 "detection-ratio">1/69<
2019-03-22 dias transcurridos 9 desde el ultimo analisis
"CRDF":
> "result": "malicious"
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: s.ytimg.com
Fecha: 2019-03-29 "detection-ratio">1/66<
2019-03-29 dias transcurridos 2 desde el ultimo analisis
"AutoShun":
> "result": "malicious"
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: cocinaycomparte.com
Fecha: 2018-11-28 "detection-ratio">0/66<
2018-11-28 dias transcurridos 123 desde el ultimo analisis
El analisis tiene mas de 4 meses; pidiendo a VT re-analize
Fecha: 2019-03-31 "detection-ratio">0/66<
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: d19df3uvvqx3w2.cloudfront.net
Fecha: 2019-03-27 "detection-ratio">0/66<
2019-03-27 dias transcurridos 4 desde el ultimo analisis
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: disqus.com
Fecha: 2019-03-28 "detection-ratio">0/66<
2019-03-28 dias transcurridos 3 desde el ultimo analisis
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: graphql.api.dailymotion.com
Fecha: 2019-03-08 "detection-ratio">0/66<
2019-03-08 dias transcurridos 23 desde el ultimo analisis
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: lee-algarabia.disqus.com
Fecha: 2019-03-27 "detection-ratio">0/66<
2019-03-27 dias transcurridos 4 desde el ultimo analisis
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: proxy-13.sv6.dailymotion.com
Fecha: 2018-12-19 "detection-ratio">0/66<
2018-12-19 dias transcurridos 102 desde el ultimo analisis
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: s1-ssl.dmcdn.net
Fecha: 2019-03-11 "detection-ratio">0/66<
2019-03-11 dias transcurridos 20 desde el ultimo analisis
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: s2-ssl.dmcdn.net
Fecha: 2019-03-08 "detection-ratio">0/66<
2019-03-08 dias transcurridos 23 desde el ultimo analisis
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: static1.dmcdn.net
Fecha: 2019-03-14 "detection-ratio">0/66<
2019-03-14 dias transcurridos 17 desde el ultimo analisis
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: static2-ssl.dmcdn.net
Fecha: 2019-03-08 "detection-ratio">0/66<
2019-03-08 dias transcurridos 23 desde el ultimo analisis
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: www.abcradio.com.mx
Fecha: 2018-01-08 "detection-ratio">0/66<
2018-01-08 dias transcurridos 447 desde el ultimo analisis
El analisis tiene mas de 4 meses; pidiendo a VT re-analize
Fecha: 2019-03-31 "detection-ratio">0/66<
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: www.dailymotion.com
Fecha: 2019-03-30 "detection-ratio">0/66<
2019-03-30 dias transcurridos 1 desde el ultimo analisis
= = = = = = = = = = = = = = = = = = = = = = = = =
= = = = = = = = = = = = = = = = = = = = = = = = =
Url: cdn.hobbyconsolas.com
Fecha: 2018-01-10 "detection-ratio">0/66<
2018-01-10 dias transcurridos 445 desde el ultimo analisis
El analisis tiene mas de 4 meses; pidiendo a VT re-analize
Fecha: 2019-03-31 "detection-ratio">0/66<
= = = = = = = = = = = = = = = = = = = = = = = = =
..
..
La seccion de revision a VT es transferible a otras utilidades; abajo resultados con "Netstat"
.. abajo resultados
- - - - - - - - - - - - - - - - - - - - -
Direccion IP: 104.25.12.30
Registro PTR:
Organizacion: Cloudflare
ISP: Cloudflare
Ciudad:
Pais: United States
Estado:
Url: 104.25.12.30
Fecha: 2018-11-14 "detection-ratio">0/66<
2018-11-14 dias transcurridos 137 desde el ultimo analisis
El analisis tiene mas de 4 meses; pidiendo a VT re-analize
Fecha: 2019-03-31 "detection-ratio">0/66<
C:\Users\xxxxx\ProgramasPortab\privoxy.exe
. . . . . . . netstat . . . . . . .
Proto Dirección local Dirección remota Estado PID
TCP 192.168.0.109:8641 104.25.12.30:443 ESTABLISHED 5200
TCP 192.168.0.109:8642 104.25.12.30:443 ESTABLISHED 5200
TCP 192.168.0.109:8651 104.25.12.30:443 ESTABLISHED 5200
- - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - - - - -
Direccion IP: 172.217.11.78
Registro PTR: lax17s34-in-f14.1e100.net
Organizacion: Google
ISP: Google
Ciudad:
Pais: United States
Estado:
Url: 172.217.11.78
Fecha: 2019-02-25 "detection-ratio">0/66<
2019-02-25 dias transcurridos 34 desde el ultimo analisis
C:\Users\xxxxx\ProgramasPortab\privoxy.exe
. . . . . . . netstat . . . . . . .
Proto Dirección local Dirección remota Estado PID
TCP 192.168.0.109:8677 172.217.11.78:443 ESTABLISHED 5200
- - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - - - - -
Direccion IP: 178.154.131.216
Registro PTR: static.yandex.net
Organizacion: YANDEX LLC
ISP: YANDEX LLC
Ciudad:
Pais: Russia
Estado:
Url: 178.154.131.216
Fecha: 2019-01-23 "detection-ratio">0/66<
2019-01-23 dias transcurridos 67 desde el ultimo analisis
C:\Users\xxxxx\ProgramasPortab\privoxy.exe
. . . . . . . netstat . . . . . . .
Proto Dirección local Dirección remota Estado PID
TCP 192.168.0.109:8658 178.154.131.216:443 ESTABLISHED 5200
- - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - - - - -
Direccion IP: 2.18.175.181
Registro PTR: a2-18-175-181.deploy.static.akamaitechnologies.com
Organizacion: Akamai Technologies
ISP: Akamai Technologies
Ciudad:
Pais:
Estado:
Url: 2.18.175.181
Fecha: 2018-02-23 "detection-ratio">0/67<
2018-02-23 dias transcurridos 401 desde el ultimo analisis
El analisis tiene mas de 4 meses; pidiendo a VT re-analize
Fecha: 2019-03-31 "detection-ratio">0/66<
C:\Users\xxxxx\ProgramasPortab\privoxy.exe
. . . . . . . netstat . . . . . . .
Proto Dirección local Dirección remota Estado PID
TCP 192.168.0.109:8682 2.18.175.181:80 ESTABLISHED 5200
TCP 192.168.0.109:8684 2.18.175.181:443 ESTABLISHED 5200
- - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - - - - -
Direccion IP: 205.185.208.52
Registro PTR: vip052.ssl.hwcdn.net
Organizacion: Highwinds Network Group
ISP: Highwinds Network Group
Ciudad: Phoenix
Pais: United States
Estado: Arizona
Url: 205.185.208.52
Fecha: 2019-03-13 "detection-ratio">0/66<
2019-03-13 dias transcurridos 18 desde el ultimo analisis
C:\Users\xxxxx\ProgramasPortab\privoxy.exe
. . . . . . . netstat . . . . . . .
Proto Dirección local Dirección remota Estado PID
TCP 192.168.0.109:8640 205.185.208.52:443 ESTABLISHED 5200
TCP 192.168.0.109:8690 205.185.208.52:443 ESTABLISHED 5200
- - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - - - - -
Direccion IP: 207.244.80.182
Registro PTR:
Organizacion: Leaseweb USA
ISP: Leaseweb USA
Ciudad: Manassas
Pais: United States
Estado: Virginia
Url: 207.244.80.182
Fecha: 2018-10-15 "detection-ratio">0/67<
2018-10-15 dias transcurridos 167 desde el ultimo analisis
El analisis tiene mas de 4 meses; pidiendo a VT re-analize
Fecha: 2019-03-31 "detection-ratio">0/66<
C:\Users\xxxxx\ProgramasPortab\privoxy.exe
. . . . . . . netstat . . . . . . .
Proto Dirección local Dirección remota Estado PID
TCP 192.168.0.109:8654 207.244.80.182:443 ESTABLISHED 5200
TCP 192.168.0.109:8655 207.244.80.182:443 ESTABLISHED 5200
TCP 192.168.0.109:8668 207.244.80.182:443 ESTABLISHED 5200
TCP 192.168.0.109:8669 207.244.80.182:443 ESTABLISHED 5200
TCP 192.168.0.109:8672 207.244.80.182:443 ESTABLISHED 5200
TCP 192.168.0.109:8673 207.244.80.182:443 ESTABLISHED 5200
TCP 192.168.0.109:8679 207.244.80.182:443 ESTABLISHED 5200
- - - - - - - - - - - - - - - - - - - - -
..
..
Automatizado todo solo queda dar un par de teclazos . . :D
