从VirusTotal获取文件最新修改时间

当我们通过VirusTotal扫描一个文件或SHA256时，有时我们希望从结果中获得当前SHA256对应的文件的最终修改时间。

如果我们去看网页上提供的信息
https://www.virustotal.com/gui/file/3ee7067ce9ce70a9ad636d19121b915db190011a89d2aeb2b3f1e3c8d40fca02/details为例，会注意到这一部分

VirusTotal截图

图中有Creation Time、First Submission、Earliest Contents Modification、Latest Contents Modification、First Seen In The Wild（范例）等字段。

为了解释这些字段的含义，节选下VirusTotal的技术人员回复的邮件，

Thanks for reaching out to VirusTotal support.
"Creation Time": When the file was created according to the metadata. (文件被创建的时间)
"Earliest Contents Modification": When the file was edited for the first time according to the metadata. (文件首次被编辑的时间)
"Latest Contents Modification": When the file was edited for the last time according to the metadata. (文件最后一次被编辑的时间)
"First Seen In The Wild": the date that the file is being first being seen on the internet according to some metadata. (文件首次在互联网上被发现的时间)

Those details are related to the metadata of the version related to that SHA256, so let's say we have a file with 3 different versions:

1. Original version with sha256_version1, in this case in the details section there should not have different dates for the different fields mentioned previously.
2. First edition of the file with sha256_version2, in this case in the details section will have the same creation time as the previous file, but first edition time and last edition time should be the same,
3. Last edition of the file with sha256_version3, this is the file where all the fields should have different values.

最后我提出，如果想尽量精准地获取，特定SHA256对应的时间（可能属于上述任何一个阶段），使用哪个字段的优先级是否是："Latest Contents Modification" > "Creation Time" (有时缺失) > "First Submission"。
VirusTotal在回复中表示了同意。

注意，客服人员在邮件回复说，Latest Contents Modification和Creation Time都是从外部工具提取的，不会100%准确。比如我发现对于APK：Latest Contents Modification有时是1980/1981年（范例），有时是2008年（范例），这两个时间都不可能是准确的时间戳，需要额外判断。

最后，各位在使用时，这些字段对应到返回的JSON中的话：

• First Submission -> data.attributes.first_submission_date
• Creation Time(可能缺失) -> data.attributes.creation_date
• Earliest Contents Modification -> data.attributes.bundle_info.lowest_datetime
• Latest Contents Modification -> data.attributes.bundle_info.highest_datetime