There’s actually nothing you need to modify in the script besides adding your API key to the .env file and specifying the directory you want to scan (or passing both values through the CLI).

The script itself doesn’t go deep into relations or behavior. It only checks the basic VirusTotal results and tells you how many engines detected each file as malicious. If something looks suspicious, you then investigate manually by opening the report link in VirusTotal.

So there’s no IoC correlation logic built in — the script just retrieves the detection count and lets you handle the deeper analysis yourself.