8
import json
import urllib
import urllib2
url = "https://www.virustotal.com/vtapi/v2/file/report"
parameters = {"resource": "2aa837802b1c7867a65067525a843566029bd97e3ce99f6eb55217e219043ae1",
         "apikey": "123123123123123123"}
data = urllib.urlencode(parameters)
req = urllib2.Request(url, data)
response = urllib2.urlopen(req)

json_object = json.load(response)

print json_object['scans']

Could you guys help with with how to get a specific value in the JSON object that my code returns? The code connects to VirusTotal to get object scan results.

I tried to print it with the last line of code but it prints the whole output.

The JSON object looks like this:

{
    "scans": {
        "TotalDefense": {
            "detected": false,
            "version": "37.0.10022",
            "result": null,
            "update": "20120809"
        },
        "nProtect": {
            "detected": false,
            "version": "2012-08-09.02",
            "result": null,
            "update": "20120809"
        },
        "CAT-QuickHeal": {
            "detected": false,
            "version": "12.00",
            "result": null,
            "update": "20120809"
        },
        "McAfee": {
            "detected": false,
            "version": "5.400.0.1158",
            "result": null,
            "update": "20120809"
        },
        "K7AntiVirus": {
            "detected": false,
            "version": "9.145.7456",
            "result": null,
            "update": "20120808"
        },
        "TheHacker": {
            "detected": false,
            "version": "None",
            "result": null,
            "update": "20120808"
        },
        "VirusBuster": {
            "detected": false,
            "version": "15.0.138.0",
            "result": null,
            "update": "20120809"
        },
        "F-Prot": {
            "detected": false,
            "version": "4.6.5.141",
            "result": null,
            "update": "20120809"
        },
        "Symantec": {
            "detected": false,
            "version": "20121.1.0.298",
            "result": null,
            "update": "20120809"
        },
        "Norman": {
            "detected": false,
            "version": "6.08.06",
            "result": null,
            "update": "20120809"
        },
        "ByteHero": {
            "detected": false,
            "version": "1.0.0.1",
            "result": null,
            "update": "20120723"
        },
        "TrendMicro-HouseCall": {
            "detected": false,
            "version": "9.500.0.1008",
            "result": null,
            "update": "20120809"
        },
        "Avast": {
            "detected": false,
            "version": "6.0.1289.0",
            "result": null,
            "update": "20120809"
        },
        "eSafe": {
            "detected": false,
            "version": "7.0.17.0",
            "result": null,
            "update": "20120808"
        },
        "ClamAV": {
            "detected": false,
            "version": "0.97.3.0",
            "result": null,
            "update": "20120809"
        },
        "Kaspersky": {
            "detected": false,
            "version": "9.0.0.837",
            "result": null,
            "update": "20120809"
        },
        "BitDefender": {
            "detected": false,
            "version": "7.2",
            "result": null,
            "update": "20120809"
        },
        "ViRobot": {
            "detected": false,
            "version": "2011.4.7.4223",
            "result": null,
            "update": "20120809"
        },
        "Sophos": {
            "detected": false,
            "version": "4.80.0",
            "result": null,
            "update": "20120809"
        },
        "Comodo": {
            "detected": false,
            "version": "13190",
            "result": null,
            "update": "20120809"
        },
        "F-Secure": {
            "detected": false,
            "version": "9.0.16440.0",
            "result": null,
            "update": "20120809"
        },
        "DrWeb": {
            "detected": false,
            "version": "7.0.3.07130",
            "result": null,
            "update": "20120809"
        },
        "VIPRE": {
            "detected": false,
            "version": "12556",
            "result": null,
            "update": "20120809"
        },
        "AntiVir": {
            "detected": false,
            "version": "7.11.39.82",
            "result": null,
            "update": "20120809"
        },
        "TrendMicro": {
            "detected": false,
            "version": "9.561.0.1027",
            "result": null,
            "update": "20120809"
        },
        "McAfee-GW-Edition": {
            "detected": false,
            "version": "2012.1",
            "result": null,
            "update": "20120808"
        },
        "Emsisoft": {
            "detected": false,
            "version": "5.1.0.11",
            "result": null,
            "update": "20120809"
        },
        "Jiangmin": {
            "detected": false,
            "version": "13.0.900",
            "result": null,
            "update": "20120809"
        },
        "Antiy-AVL": {
            "detected": false,
            "version": "2.0.3.7",
            "result": null,
            "update": "20120808"
        },
        "Microsoft": {
            "detected": false,
            "version": "1.8601",
            "result": null,
            "update": "20120809"
        },
        "SUPERAntiSpyware": {
            "detected": false,
            "version": "4.40.0.1006",
            "result": null,
            "update": "20120809"
        },
        "GData": {
            "detected": false,
            "version": "22",
            "result": null,
            "update": "20120809"
        },
        "Commtouch": {
            "detected": false,
            "version": "5.3.2.6",
            "result": null,
            "update": "20120809"
        },
        "AhnLab-V3": {
            "detected": false,
            "version": "2012.08.09.00",
            "result": null,
            "update": "20120808"
        },
        "VBA32": {
            "detected": false,
            "version": "3.12.18.2",
            "result": null,
            "update": "20120809"
        },
        "PCTools": {
            "detected": false,
            "version": "8.0.0.5",
            "result": null,
            "update": "20120809"
        },
        "ESET-NOD32": {
            "detected": false,
            "version": "7370",
            "result": null,
            "update": "20120809"
        },
        "Rising": {
            "detected": false,
            "version": "24.22.02.05",
            "result": null,
            "update": "20120809"
        },
        "Ikarus": {
            "detected": false,
            "version": "T3.1.1.122.0",
            "result": null,
            "update": "20120809"
        },
        "Fortinet": {
            "detected": false,
            "version": "4.3.398.0",
            "result": null,
            "update": "20120809"
        },
        "AVG": {
            "detected": false,
            "version": "10.0.0.1190",
            "result": null,
            "update": "20120809"
        },
        "Panda": {
            "detected": false,
            "version": "10.0.3.5",
            "result": null,
            "update": "20120809"
        }
    },
    "scan_id": "2aa837802b1c7867a65067525a843566029bd97e3ce99f6eb55217e219043ae1-1344514045",
    "sha1": "1bebf3ff83636e19cb8e26b6d46472c614aac7ab",
    "resource": "2aa837802b1c7867a65067525a843566029bd97e3ce99f6eb55217e219043ae1",
    "response_code": 1,
    "scan_date": "2012-08-09 12:07:25",
    "permalink": "https://www.virustotal.com/file/2aa837802b1c7867a65067525a843566029bd97e3ce99f6eb55217e219043ae1/analysis/1344514045/",
    "verbose_msg": "Scan finished, scan information embedded in this object",
    "total": 42,
    "positives": 0,
    "sha256": "2aa837802b1c7867a65067525a843566029bd97e3ce99f6eb55217e219043ae1",
    "md5": "6aadd888170411af8aaa0bd8ebffeba4"
}
5
  • So print json_object['scans'] really outputs the scan_id, sha1 etc? Aug 9, 2012 at 14:15
  • If you're showing us the output of your code, it may be that the JSON object isn't how you expect it. Can you add a print json_object to your code and show us that output as well?
    – ernie
    Aug 9, 2012 at 14:23
  • 1
    The documentation is pretty clear and I think you actually get the content of scans, but it is not what you want. I recommend to read the Python documentation about how to work with dictionaries, lists, etc. Aug 9, 2012 at 14:26
  • I've solved the problem through the code of what VirusTotal provided. However, I still tried looking for a solution to my code above which is weird because when I tried the code now, it outputs a HTTP Error 403. Ill post the code below.
    – dkea
    Aug 9, 2012 at 14:49
  • @gwafito: 403 means that you are not allowed to access that resource. Check your API key and/or resource ID. Aug 9, 2012 at 14:56

2 Answers 2

9

Use json.loads it will convert the json string to a dict containing dicts, list, etc.

Edit 2: You can access each item like this: json_object['scans']['TotalDefense']['version'] contd. But you may also need to json.loads(json.load(response)) as I mentioned in my comment below.

Edit 1: In your example, we should not be seeing "scans" again for print json_object['scans'].


From http://docs.python.org/library/json.html:

>>> import json
>>> json.loads('["foo", {"bar":["baz", null, 1.0, 2]}]')
[u'foo', {u'bar': [u'baz', None, 1.0, 2]}]

That page also has info on how to do more complex decoding.

4
  • .loads expects a string, but urlopen returns a file-like object. Using .load is correct here. Aug 9, 2012 at 14:16
  • He's already done the loading yes but then why do we see "scans" again when he does print json_object['scans']? He could then do json.loads(json.load(response)) or print json.loads(json_object['scans']) to get a dict he can actually traverse.
    – aneroid
    Aug 9, 2012 at 14:22
  • 1
    Ah, so you think that json_object['scans'] is a string containing JSON... maybe but that seems to be strange. According to the documentation, it does not: virustotal.com/documentation/public-api/#getting-file-scans Aug 9, 2012 at 14:23
  • @FelixKling youre correct with the .load to be used. I've solved the problem through the code of what VirusTotal provided. However, I still tried looking for a solution to my code above which is weird because when I tried the code now, it outputs a HTTP Error 403.
    – dkea
    Aug 9, 2012 at 14:50
6
import json
import urllib
import urllib2
url = "https://www.virustotal.com/vtapi/v2/file/report"
parameters = {"resource": "2aa837802b1c7867a65067525a843566029bd97e3ce99f6eb55217e219043ae1",
         "apikey": "12312312312312312"}
data = urllib.urlencode(parameters)
req = urllib2.Request(url, data)
response = urllib2.urlopen(req)
json_object = response.read()
print '\n '
response_dict = json.loads(json_object)
print response_dict.get("response_code",{})

This outputs the response_code's value in the object. To go with nested values, a response_dict.get("scans",{}).get("AVG",{}) could be done. THANK YOU EVERYONE!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.