Scan a file using VirusTotal.

For files smaller than 32MB, uploads the file directly. For larger files, calculates hash and checks VirusTotal database.

Get VirusTotal analysis report for a file by its hash.

Get behavior summary for a file analyzed in VirusTotal's sandbox.

Submit a URL to VirusTotal for scanning.

Get VirusTotal analysis report for a URL.

Get VirusTotal intelligence report for a domain.

Includes: WHOIS data, DNS records, SSL certificates, reputation score, and related files/URLs.

Get VirusTotal intelligence report for an IP address.

Includes: Geolocation, ASN information, reputation score, related files, URLs, and domains.

Search for files using VirusTotal Intelligence.

Supports advanced search syntax:

• tag:peexe (PE executables)

• positives:5+ (files with 5+ detections)

• fs:2023-01-01+ (first seen after date)

• content:{ "magic": "PE32" } (YARA-style content search)

Get community comments for a VirusTotal object.

Analyze a file using Detect It Easy (DIE) with deep scan mode.

Uses flags: -a (all types), -u (heuristic scan), --verbose, -j (JSON output)

Returns detailed analysis including:

• Packer/Compiler detection

• Entropy analysis

• Section details

• Import/Export tables

• Resources info

• Signature matches

• Heuristic detections

Calculate multiple hash values for a file.

Calculates: MD5, SHA1, SHA256, SHA512, and SSDEEP (if available)

Extract EXIF and metadata from a file using ExifTool.

Supports images, documents, media files, and many other formats. Extracts: camera info, GPS coordinates, timestamps, software versions, author information, and hundreds of other metadata fields.

Extract readable strings from a binary file.

Useful for analyzing malware, finding embedded URLs, file paths, error messages, and other interesting artifacts.

Scan a file for embedded signatures using binwalk.

Detects file signatures, archives, compressed data, and other embedded file types within binary data. Useful for firmware analysis, memory dumps, and packed executables.

Extract embedded files from a binary using binwalk.

Automatically extracts known file types (ZIP, ELF, etc.) found within the binary. Uses recursive extraction to handle nested archives.

Summarize basic Firefox artifacts available in a browser profile. Typical Firefox profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". Extract with disk-forensics first, then point this tool at the extracted directory.

Detects whether history, bookmarks, downloads, cookies, sessions, favicons, extensions, preferences, and login metadata artifacts are present.

Parse Firefox browsing history records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

Parse Firefox bookmark entries from a browser profile. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

Parse Firefox download candidates from a browser profile.

Parse Firefox cookies from a browser profile. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

Return Firefox cookies as already-decrypted plaintext values. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

Firefox stores cookies plaintext in cookies.sqlite, so this tool provides parity with Chromium-style decrypt flows by normalizing plaintext values into a decrypt-oriented response.

Parse Firefox session restore files from a browser profile. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

Parse Firefox session storage records when sessionstore contains them. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

Parse Firefox favicons from the favicons database. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

Parse Firefox installed extension metadata. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

Parse Firefox preferences from prefs.js. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

Parse Firefox saved-login metadata from logins.json. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

Parse Firefox web-data-like artifacts such as form history, permissions, Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". content preferences, and search engines.

Parse Firefox local storage records from webappsstore and storage/default/ls. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

Parse Firefox IndexedDB records from storage/default/*/idb. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

Parse Firefox cache records from storage/default/*/cache. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

Attempt to decrypt Firefox saved passwords via firefox_decrypt. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". Requires NSS libs and optional primary_password.

Summarize deep Chromium artifacts available in a browser profile. Typical Chromium profile paths: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default" (Chrome) or "C:\Users<user>\AppData\Local\Microsoft\Edge\User Data\Default" (Edge). Extract with disk-forensics first, then point this tool at the extracted directory.

Detects whether Local Storage, Session Storage, IndexedDB, and Cache are present and returns a small sample of the content identifiers for each.

Parse Chromium Local Storage records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Parse Chromium Session Storage records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Parse Chromium IndexedDB records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Parse Chromium HTTP cache records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Parse Chromium browsing history records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Parse Chromium download records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Reads downloads from both the History database and shared_proto_db when present.

Parse Chromium session restore files from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Parse Chromium favicons from the Favicons database. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Parse common Chromium Web Data tables.

Supports categories such as autofill, keywords, and profiles when present.

Parse Chromium installed extension metadata. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Parse Chromium Preferences and Secure Preferences data. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Parse Chromium bookmark URL entries from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Parse Chromium cookies from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Supports both legacy Cookies and modern Network/Cookies SQLite locations.

Attempt to decrypt Chromium cookies from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Supports two modes:

• Windows current-user context using Local State + DPAPI

• Offline decryption when a decrypted Chromium master key is supplied via master_key_b64

Parse Chromium saved-login metadata from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default" (or Edge). On Windows the Local State file is required for v10/v11 decryption.

Reads the Login Data database and returns login metadata without decrypting passwords.

Attempt to decrypt Chromium saved passwords from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Supports two modes:

• Windows current-user context using Local State + DPAPI

• Offline decryption when a decrypted Chromium master key is supplied via master_key_b64

Get cache statistics.

Returns: JSON object with cache stats including size and entry count

Clear all cache entries.

Returns: JSON object with operation status