import virustotal_python
from pprint import pprint
import json
import requests
import hashlib
import os
import argparse
from datetime import datetime
 
 
def read_text(file_name):
    file_data = []
    text_file = open(file_name,"r")
 
    for word in text_file.read().split():
        file_data.append(word)
 
    text_file.close()
    return file_data  
 
 
def vt_lookup(hashValue, apiKey):
    """
    Perform API lookup on hash value and return json data results
    """
 
    url = f'https://www.virustotal.com/api/v3/files/{hashValue}'
    headers = {
        'x-apikey': apiKey,
        'Accept': 'application/json',
    }
 
    try:
        response = requests.get(url, headers=headers)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.HTTPError as e:
        if "404" in str(e):
            print(
                '404 response returned likely meaning no file hash matches have been found.\n')
        else:
            print(f'API response: {e}')
            print(
                'For more information visit: https://developers.virustotal.com/reference/errors\n')
        exit(1)
 
the_list = read_text("IOC.txt")
not_det = []
 
print ("Following samples are covered under detection:")
for i in the_list:
    data = vt_lookup(i, "c6e0fd1954e15147516bb633827f3e8b16e26cf6560885671804509e8b41cf0c")
 
 
    if "data" in data:
 
        for k, v in data["data"]["attributes"]["last_analysis_results"].items():
            if (k == 'Sophos') and str(v["result"]) != "None":
                print("sha256:" + data["data"]["attributes"]["sha256"] + "  ->  " + str(v["result"]))
            elif(k == 'Sophos') and str(v["result"]) == "None":
                not_det.append(data["data"]["attributes"]["sha256"])
 
 
 
    else:
        print("ERROR: No data found in json data.")
print("We are working on following samples" + str(len(not_det)) )
for i in not_det:
    print(i)