VirusTotal_Folder_Monitor.ps1

# Function to calculate multiple hashes of a file
function Get-MultipleFileHashes {
    param (
        [string]$FilePath,
        [string[]]$Algorithms = @("MD5", "SHA1", "SHA256", "SHA384", "SHA512")
    )
    
    $hashes = @{}
    foreach ($Algorithm in $Algorithms) {
        $hash = [System.Security.Cryptography.HashAlgorithm]::Create($Algorithm)
        $stream = [System.IO.File]::OpenRead($FilePath)
        $fileHash = $hash.ComputeHash($stream)
        $stream.Close()
        $hashes[$Algorithm] = [BitConverter]::ToString($fileHash) -replace '-', ''
    }
    
    return $hashes
}

# Function to check hash on VirusTotal
function Check-VirusTotal {
    param (
        [string]$Hash,
        [string]$ApiKey
    )

    $url = "https://www.virustotal.com/api/v3/files/$Hash"
    $headers = @{
        "x-apikey" = $ApiKey
    }

    try {
        $response = Invoke-RestMethod -Uri $url -Headers $headers -Method Get
        return $response
    }
    catch {
        return $null
    }
}

# Function to upload file to VirusTotal
function Upload-To-VirusTotal {
    param (
        [string]$FilePath,
        [string]$ApiKey
    )

    $url = "https://www.virustotal.com/api/v3/files"
    $headers = @{
        "x-apikey" = $ApiKey
    }
    $fileContent = Get-Content -Path $FilePath -Raw -Encoding Byte
    $body = @{
        file = [System.IO.File]::OpenRead($FilePath)
    }

    try {
        $response = Invoke-RestMethod -Uri $url -Headers $headers -Method Post -Body $body
        return $response
    }
    catch {
        return $null
    }
}

# Function to get additional file information from VirusTotal
function Get-AdditionalFileInfo {
    param (
        [string]$Hash,
        [string]$ApiKey
    )

    $url = "https://www.virustotal.com/api/v3/files/$Hash"
    $headers = @{
        "x-apikey" = $ApiKey
    }

    try {
        $response = Invoke-RestMethod -Uri $url -Headers $headers -Method Get
        $attributes = $response.data.attributes

        $additionalInfo = @{
            TrID = $attributes.trid
            DetectItEasy = $attributes.detectiteasy
            Magic = $attributes.magic
            Magika = $attributes.magika
            PEiDPacker = $attributes.packers.peid
            ImpHash = $attributes.pe_info.imphash
        }

        return $additionalInfo
    }
    catch {
        return $null
    }
}

# Function to process files in a folder
function Process-Files {
    param (
        [string]$Path,
        [string[]]$Algorithms,
        [string]$ApiKey,
        [bool]$Verbose
    )

    $dateTime = Get-Date -Format 'yyyyMMdd_HHmmss'
    $hashLogFile = Join-Path ([Environment]::GetFolderPath("Desktop")) "HashLog_$dateTime.txt"
    $vtLogFile = Join-Path ([Environment]::GetFolderPath("Desktop")) "VirusTotalLog_$dateTime.txt"

    $hashLogContent = "Date: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')`r`n"
    $hashLogContent += "Path: $Path`r`n"
    $hashLogContent += "Algorithms: $($Algorithms -join ', ')`r`n`r`n"

    $vtLogContent = "Date: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')`r`n"
    $vtLogContent += "Path: $Path`r`n"
    $vtLogContent += "Algorithms: $($Algorithms -join ', ')`r`n`r`n"

    if (Test-Path -Path $Path -PathType Leaf) {
        $files = @(Get-Item -Path $Path)
    }
    elseif (Test-Path -Path $Path -PathType Container) {
        $files = Get-ChildItem -Path $Path -Recurse -File
    }
    else {
        Write-Host "Invalid path. Please enter a valid file or folder path."
        return
    }

    $fileCount = $files.Count
    $currentFile = 0
    $filesToUpload = @()

    foreach ($file in $files) {
        $currentFile++
        $percentComplete = [math]::Round(($currentFile / $fileCount) * 100, 2)
        Write-Progress -Activity "Processing files" -Status "$percentComplete% Complete" -PercentComplete $percentComplete

        $hashes = Get-MultipleFileHashes -FilePath $file.FullName -Algorithms $Algorithms
        
        $hashLogContent += "File: $($file.FullName)`r`n"
        foreach ($algo in $Algorithms) {
            $hashLogContent += "{0}: {1}`r`n" -f $algo, $hashes[$algo]
        }
        $hashLogContent += "`r`n"

        $vtResult = Check-VirusTotal -Hash $hashes["SHA256"] -ApiKey $ApiKey

        $vtLogContent += "File: $($file.FullName)`r`n"
        $vtLogContent += "SHA256: $($hashes["SHA256"])`r`n"

        if ($vtResult -ne $null) {
            $detectionCount = $vtResult.data.attributes.last_analysis_stats.malicious
            $totalEngines = $vtResult.data.attributes.last_analysis_stats.malicious + $vtResult.data.attributes.last_analysis_stats.undetected
            $fileType = $vtResult.data.attributes.type_description
            
            $vtLogContent += "Detection: $detectionCount / $totalEngines`r`n"
            $vtLogContent += "File Type: $fileType`r`n"
            $vtLogContent += "First Seen: $($vtResult.data.attributes.first_submission_date)`r`n"
            $vtLogContent += "Last Seen: $($vtResult.data.attributes.last_submission_date)`r`n"

            if ($Verbose) {
                $additionalInfo = Get-AdditionalFileInfo -Hash $hashes["SHA256"] -ApiKey $ApiKey
                if ($additionalInfo -ne $null) {
                    $vtLogContent += "TrID: $($additionalInfo.TrID)`r`n"
                    $vtLogContent += "Detect It Easy: $($additionalInfo.DetectItEasy)`r`n"
                    $vtLogContent += "Magic: $($additionalInfo.Magic)`r`n"
                    $vtLogContent += "Magika: $($additionalInfo.Magika)`r`n"
                    $vtLogContent += "PEiD Packer: $($additionalInfo.PEiDPacker)`r`n"
                    $vtLogContent += "ImpHash: $($additionalInfo.ImpHash)`r`n"
                }
            }
        }
        else {
            $vtLogContent += "VirusTotal: No results found or API error`r`n"
            $filesToUpload += $file.FullName
        }

        $vtLogContent += "`r`n"
    }

    # Save initial log files
    $hashLogContent | Out-File -FilePath $hashLogFile -Encoding utf8
    $vtLogContent | Out-File -FilePath $vtLogFile -Encoding utf8

    Write-Host "Hash log file saved to: $hashLogFile"
    Write-Host "VirusTotal log file saved to: $vtLogFile"

    if ($filesToUpload.Count -gt 0) {
        Write-Host "Some files are not available on VirusTotal:"
        $filesToUpload | ForEach-Object { Write-Host $_ }

        $userChoice = Read-Host "Do you want to upload these files to VirusTotal? (yes/no/all/exit)"

        if ($userChoice -eq "yes") {
            $fileToUpload = Read-Host "Enter the full path of the file you want to upload"
            if ($filesToUpload -contains $fileToUpload) {
                $uploadResult = Upload-To-VirusTotal -FilePath $fileToUpload -ApiKey $ApiKey
                if ($uploadResult -ne $null) {
                    $vtLogContent += "File: $fileToUpload`r`n"
                    $vtLogContent += "Upload Status: Uploaded successfully`r`n"
                    $vtLogContent += "`r`n"
                } else {
                    $vtLogContent += "File: $fileToUpload`r`n"
                    $vtLogContent += "Upload Status: Failed to upload`r`n"
                    $vtLogContent += "`r`n"
                }
            } else {
                Write-Host "Invalid file path."
            }
        } elseif ($userChoice -eq "all") {
            foreach ($fileToUpload in $filesToUpload) {
                $uploadResult = Upload-To-VirusTotal -FilePath $fileToUpload -ApiKey $ApiKey
                if ($uploadResult -ne $null) {
                    $vtLogContent += "File: $fileToUpload`r`n"
                    $vtLogContent += "Upload Status: Uploaded successfully`r`n"
                    $vtLogContent += "`r`n"
                } else {
                    $vtLogContent += "File: $fileToUpload`r`n"
                    $vtLogContent += "Upload Status: Failed to upload`r`n"
                    $vtLogContent += "`r`n"
                }
            }
        } elseif ($userChoice -eq "exit") {
            Write-Host "Exiting the process."
            return
        }
    }

    # Save final VirusTotal log file with upload results
    $vtLogContent | Out-File -FilePath $vtLogFile -Encoding utf8
    Write-Host "Updated VirusTotal log file saved to: $vtLogFile"
}

# Function to monitor a folder for new files
function Monitor-Folder {
    param (
        [string]$Path,
        [string[]]$Algorithms,
        [string]$ApiKey,
        [bool]$Verbose
    )

    Write-Host "Monitoring folder: $Path"
    $fileHashes = @{}
    $newFiles = @()

    while ($true) {
        $files = Get-ChildItem -Path $Path -Recurse -File
        $newFilesDetected = $false

        foreach ($file in $files) {
            if (-not $fileHashes.ContainsKey($file.FullName)) {
                $fileHashes[$file.FullName] = $true
                $newFiles += $file.FullName
                $newFilesDetected = $true
            }
        }

        if ($newFilesDetected) {
            Write-Host "`nNew files detected:"
            $newFiles | ForEach-Object { Write-Host $_ }

            $mergeChoice = Read-Host "`nDo you want to merge all log files before processing new files? (yes/no)"
            if ($mergeChoice -eq "yes") {
                $formatChoice = Read-Host "In which format do you want to combine the logs? (json/text)"
                Combine-LogFiles -Format $formatChoice
            }

            $processChoice = Read-Host "`nDo you want to process these files? (yes/no)"
            if ($processChoice -eq "yes") {
                foreach ($newFile in $newFiles) {
                    Process-Files -Path $newFile -Algorithms $Algorithms -ApiKey $ApiKey -Verbose $Verbose
                }
            }

            $newFiles = @()
        }

        Start-Sleep -Seconds 10
        Write-Host "`nChecking for new files..."
    }
}

# Function to combine log files
function Combine-LogFiles {
    param (
        [string]$Format = "text"
    )

    $desktopPath = [Environment]::GetFolderPath("Desktop")
    $combinedLogFile = Join-Path $desktopPath "VTHashLog.$Format"
    $logFiles = Get-ChildItem -Path $desktopPath -Filter "*Log_*.txt"

    if ($Format -eq "json") {
        $combinedContent = @{
            CreatedOn = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
            Logs = @()
        }

        foreach ($file in $logFiles) {
            $fileContent = Get-Content -Path $file.FullName -Raw
            $combinedContent.Logs += @{
                FileName = $file.Name
                Content = $fileContent
            }
        }

        $combinedContent | ConvertTo-Json -Depth 10 | Out-File -FilePath $combinedLogFile -Encoding utf8
    }
    else {
        $combinedContent = "Combined Log File`r`n"
        $combinedContent += "Created on: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')`r`n`r`n"

        foreach ($file in $logFiles) {
            $combinedContent += "=== Contents of $($file.Name) ===`r`n"
            $combinedContent += Get-Content -Path $file.FullName -Raw
            $combinedContent += "`r`n`r`n"
        }

        $combinedContent | Out-File -FilePath $combinedLogFile -Encoding utf8
    }

    Write-Host "Combined log file saved to: $combinedLogFile"

    # Ask if user wants to delete individual log files
    $deleteChoice = Read-Host "Do you want to delete the individual log files? (yes/no)"
    if ($deleteChoice -eq "yes") {
        $logFiles | ForEach-Object { Remove-Item -Path $_.FullName -Force }
        Write-Host "Individual log files have been deleted."
    }
}

# Main script loop
# [All previous functions remain unchanged]

# Main script loop
while ($true) {
    $path = Read-Host "Enter the path of the file or folder"
    $algorithmChoice = Read-Host "Which hash algorithms do you want to use? (all/md5/sha1/sha256/sha384/sha512, separate multiple choices with commas)"
    $vtApiKey = Read-Host "Enter your VirusTotal API key"
    $verboseChoice = Read-Host "Do you want verbose information from VirusTotal? (yes/no)"

    $verbose = $verboseChoice -eq "yes"

    if ($algorithmChoice -eq "all" -or $algorithmChoice -eq "") {
        $algorithms = @("MD5", "SHA1", "SHA256", "SHA384", "SHA512")
    }
    else {
        $algorithms = $algorithmChoice.Split(',') | ForEach-Object { $_.Trim().ToUpper() }
    }

    if (Test-Path -Path $path -PathType Leaf) {
        Process-Files -Path $path -Algorithms $algorithms -ApiKey $vtApiKey -Verbose $verbose
    }
    elseif (Test-Path -Path $path -PathType Container) {
        $initialFiles = Get-ChildItem -Path $path -Recurse -File
        Process-Files -Path $path -Algorithms $algorithms -ApiKey $vtApiKey -Verbose $verbose

        $monitorChoice = Read-Host "Do you want to monitor this folder for new files? (yes/no)"
        if ($monitorChoice -eq "yes") {
            Monitor-Folder -Path $path -Algorithms $algorithms -ApiKey $vtApiKey -Verbose $verbose
        }
    }
    else {
        Write-Host "Invalid path. Please enter a valid file or folder path."
        continue
    }

    $userChoice = Read-Host "Do you want to scan another folder or exit? (scan/exit)"

    if ($userChoice -eq "exit") {
        $combineChoice = Read-Host "Do you want to combine all log files? (yes/no)"
        if ($combineChoice -eq "yes") {
            $formatChoice = Read-Host "In which format do you want to combine the logs? (json/text)"
            Combine-LogFiles -Format $formatChoice
        }
        Write-Host "Exiting the process."
        break
    }
}