We have been asked many time, how to check URLs against our (cyscon SIRT) dataset. The answer is simple: We offer a free to use webservice. 
The only thing you have to do is simply throwing the URL – base64 encoded – against it. Sample:
echo “http://ftp.icq.com/pub/ICQ7/install_icq7_f.exe” |openssl enc -base64
aHR0cDovL2Z0cC5pY3EuY29tL3B1Yi9JQ1E3L2luc3RhbGxfaWNxN19mLmV4ZQo=
Once queried (sample from above), the webservice responds in a JSON format, like follows:
{“code”:”200″,”message”:”actively malicious”,”signature”:”ADWARE\/Adware.Gen”}
Possible answers are:
- $response['code'] = ’403′; $response['message'] = ‘parameter value missing’;
- $response['code'] = ’402′; $response['message'] = ‘parameter must be base64 encoded’;
- $response['code'] = ’404′; $response['message'] = ‘no incident known’;
- $response['code'] = ’200′; $response['message'] = ‘actively malicious’; $response['signature'] = $row->info;
- $response['code'] = ’201′; $response['message'] = ‘previously malicious but solved within the last 24 hours’; $response['signature'] = $row->info;
- $response['code'] = ’202′; $response['message'] = ‘previously malicious but solved within the last 7 days’; $response['signature'] = $row->info;
- $response['code'] = ’203′; $response['message'] = ‘previously malicious but solved within the last 30 days’; $response['signature'] = $row->info;
Please note: The webservice itself caches the answer of each previously requested URL for 15 minutes.
