---
title: "Fetch sandbox reports for a given sha256 hash and query"
method: POST
path: "/v1/reports"
tags: ["Malware Intelligence"]
---

# Fetch sandbox reports for a given sha256 hash and query

`POST /v1/reports`

Retrieve detailed behavioral and static analysis reports for a specific sample, ranked by sandbox score.

## Request body

- object
  - `query` string, required — Query in custom query language to filter the Malware Intelligence data with
  - `sha256` string, required — The SHA256 hash of a file
  - `start_date` string, date, required — Earliest date to include in the query (cannot be before 2023-11-01)
  - `end_date` string, date — Latest date to include in the query, defaults to today in UTC
  - `my_enterprise` boolean — Only include samples submitted by your enterprise in the query (defaults to false)
  - `limit` integer — Maximum number of reports to return. (Defaults to 1, cannot be below 1 or above 10)
  - `sanitize` boolean — Whether to sanitize returned reports. When omitted the service will default to false.

## Response `200`

List of sandboxreports for the given sha256 hash

- ReportsResponse — Sandbox analysis reports for queried malware samples.
  - `reports` SandboxReport[], required — List of sandbox analysis reports of matching request query
    - `file` string, required — The SHA256 hash identifier of the sample.
    - `id` string, required — A unique report identifier, often a composite value (hash, timestamp, task, etc.).
    - `task` string, required — The analysis task or behavioral category that was performed.
    - `dynamic` Dynamic, required — Details regarding dynamic analysis, including runtime activity and behavioral indicators.
      - `dumped` Dumped[] — List of files dumped during the analysis.
        - `md5` string, nullable — MD5 hash of the dumped file.
        - `path` string, nullable — The original full file path on the analyzed system.
        - `sha1` string, nullable — SHA1 hash of the dumped file.
        - `sha256` string, nullable — SHA256 hash of the dumped file.
        - `sha512` string, nullable — SHA512 hash of the dumped file.
        - `size` integer, nullable — File size in bytes.
      - `dumped_count` integer, nullable — Total count of dumped files.
      - `extracted` Extracted[] — List of extracted artifacts (e.g. configurations or credentials).
        - `config` ExtractedMalwareConfig, nullable — Extracted malware configuration with C2 servers, encryption keys, and other settings.
          - `botnet` string, nullable
          - `c2` string[]
          - `campaign` string, nullable
          - `credentials` ExtractedMalwareCredentials[]
            - `host` string, nullable
            - `password` string, nullable
            - `port` integer, nullable
            - `username` string, nullable
          - `decoy` string[]
          - `dns` string[]
          - `extracted_pe` string, nullable
          - `family` string, nullable
          - `keys` ExtractedConfigKey[]
            - `key` string, nullable
            - `kind` string, nullable
            - `value` string, nullable
          - `listen_addr` string, nullable
          - `listen_for` string[]
          - `listen_port` integer, nullable
          - `mutex` string[]
          - `rule` string, nullable
          - `tags` string[]
          - `version` string, nullable
          - `webinject` string[]
        - `credentials` ExtractedMalwareCredentials — Credentials extracted from malware analysis (hardcoded passwords, API keys, etc.).
          - `host` string, nullable
          - `password` string, nullable
          - `port` integer, nullable
          - `username` string, nullable
        - `dropper` ExtractedMalwareDropper — Dropper/downloader URLs extracted from malware analysis.
          - `deobfuscated` string, nullable
          - `family` string, nullable
          - `language` string, nullable
          - `source` string, nullable
          - `urls` DropperUrl[]
            - `type` string, nullable
            - `url` string, nullable
        - `dumped_file` string
        - `path` string, nullable
        - `ransom_note` ExtractedMalwareRansomNote — Ransom note content extracted from ransomware analysis.
          - `contact` string[]
          - `emails` string[]
          - `family` string, nullable
          - `note` string, nullable
          - `target` string, nullable
          - `urls` string[]
          - `wallets` string[]
        - `resource` string, nullable
      - `network` Network, nullable — Network activity observed during dynamic analysis.
        - `dns` DnsRequest[] — List of DNS request/response details.
          - `flow_id` integer, nullable — Identifier linking this DNS request to a network flow.
          - `request_domain` string[] — Domains queried in the DNS request.
          - `request_domain_fld` string[] — The first-level domain (FLD) of the requested domain.
          - `request_domain_tld` string[] — The top-level domain (TLD) of the requested domain.
          - `request_type` string[] — The type of DNS query (e.g., IN A, IN CNAME).
          - `response_domain` string[] — Domains returned in the DNS response.
          - `response_domain_fld` string[] — First-level domains from the DNS response.
          - `response_domain_tld` string[] — Top-level domains from the DNS response.
          - `response_type` string[] — The DNS record types in the response.
          - `response_value` string[] — The values (IP addresses, canonical names, etc.) returned by the DNS query.
        - `dns_count` integer, nullable — Total number of DNS requests observed.
        - `flows` Flow[] — List of network flows (e.g., TCP, UDP sessions) observed.
          - `dst_ip` string, nullable — Destination IP address of the flow.
          - `dst_port` integer, nullable — Destination port number.
          - `id` integer, nullable — Unique identifier for the flow.
          - `layer_7` string[] — Application layer protocols identified (e.g., DNS, HTTP).
          - `procid` integer, nullable — Process ID associated with the network flow.
          - `proto` string, nullable — Underlying transport protocol (e.g., tcp, udp).
        - `flows_count` integer, nullable — Total count of network flows.
        - `http` HttpRequest[] — HTTP request/response sequences observed.
          - `flow` integer, nullable — The network flow ID associated with this HTTP session.
          - `sequence` HttpSequence[] — Ordered sequence of HTTP exchanges.
            - `index` integer — The order index of the exchange in the session.
            - `request` HttpSequenceRequest, nullable — Details of an HTTP request in a sequence.
              - …
            - `response` HttpSequenceResponse, nullable — Details of an HTTP response in a sequence.
              - …
        - `ips` Ip[] — List of IP addresses contacted during analysis.
          - `asn` string, nullable — Autonomous System Number associated with the IP.
          - `cc` string, nullable — Country code for the IP address.
          - `ip` string, nullable — The IP address.
        - `ips_count` integer, nullable — Total number of distinct IP addresses.
      - `processes` Process[] — List of processes observed during the analysis.
        - `cmd` string, nullable — The command line used to start the process.
        - `image` string, nullable — The file path to the process executable.
        - `pid` integer, nullable — Process ID.
        - `ppid` integer, nullable — Parent process ID.
        - `procid` integer, nullable — A unique identifier assigned by the sandbox.
        - `procid_parent` integer, nullable — The parent process identifier within the sandbox environment.
      - `registry` Registry, nullable — Details of registry operations observed during analysis.
        - `create` RegistryCreate[] — List of registry keys created.
          - `key` string, nullable — The registry key path that was created.
        - `read` RegistryRead[] — List of registry keys read.
          - `key` string, nullable — The registry key path that was accessed.
        - `write` RegistryWrite[] — List of registry keys written.
          - `key` string, nullable — The registry key path that was modified.
          - `value` string, nullable — The new value written to the registry key.
      - `registry_count` integer, nullable — Total number of registry operations observed.
      - `signatures` Signature[] — List of behavioral or heuristic signatures triggered during analysis.
        - `desc` string, nullable — A textual description of the signature.
        - `indicators` Indicator[] — A list of indicators associated with this signature.
          - `description` string, nullable — A descriptive message detailing the indicator.
          - `ioc` string, nullable
          - `procid` integer — Process identifier associated with this indicator.
        - `name` string, nullable — The name of the signature.
        - `label` string, nullable — An optional label for the signature.
        - `score` integer, nullable — Severity score assigned to the signature.
        - `tags` string[] — Tags or keywords associated with the signature.
        - `ttp` string[] — Tactics, Techniques, and Procedures (TTPs) associated with the signature.
      - `signatures_count` integer, nullable — Total count of signatures triggered.
    - `metadata` Metadata, required — Response metadata with additional context about the enrichment operation. Only included when the metadata query parameter is set to true.
      - `entries` object[] — Metadata entries providing additional context about the response data elements.
        - `key` string — The metadata key or field name.
        - `value` string — The metadata value or description.
    - `pe` Pe, nullable — Details about the Portable Executable (PE) file structure extracted from the sample. This includes the exported functions, header flags, imported DLLs and functions, section details, digital signatures, and compilation timestamp.
      - `exports` string[] — List of exported functions and symbols from the PE file.
      - `header` PeHeader, nullable — Header details of the PE file, providing flags that indicate characteristics of the DLL and the file.
        - `dll_characteristics` string[] — A list of DLL characteristic flags, such as high entropy, dynamic base, NX compatibility, etc.
        - `file_characteristics` string[] — A list of file characteristic flags, such as indicating an executable image or large address awareness.
      - `imphash` string, nullable — The import hash (imphash) calculated from the imported functions
      - `imports` PeImports[]
        - `dll_name` string, nullable — The name of the DLL from which functions are imported.
        - `imports` string[] — A list of function names imported from the corresponding DLL.
      - `sections` PeSections[]
        - `characteristics` string[] — A list of flags and characteristics for the section (e.g., code, initialized data, memory execution/read permissions).
        - `name` string, nullable — The name of the section (e.g., .text, .rdata, .rsrc).
        - `raw_data_offset` integer, nullable — The offset from the beginning of the file to where the section's raw data starts.
        - `raw_data_size` integer, nullable — The size (in bytes) of the section's raw data in the file.
        - `virtual_size` integer, nullable — The size (in bytes) of the section when loaded into memory.
      - `signatures` PeSignatures[]
        - `issuer` string, nullable — The issuer of the digital certificate used to sign the PE file.
        - `not_after` string, nullable — The expiration date of the digital certificate.
        - `not_before` string, nullable — The start date of the digital certificate's validity period.
        - `serial` string, nullable — The serial number of the digital certificate.
        - `subject` string, nullable — The subject (owner) details from the digital certificate.
      - `timestamp` integer, nullable
    - `sample` Sample, required — Basic sample information as collected by the sandbox.
      - `completed` string, nullable — ISO 8601 timestamp when the analysis was completed.
      - `created` string, nullable — ISO 8601 timestamp when the sample was first submitted.
      - `id` string, nullable — Unique identifier for the sample.
      - `score` integer, nullable — A risk or confidence score assigned to the sample.
      - `tags` string[] — A list of tags categorizing the sample (e.g., discovery).
    - `static` Static, required — Static analysis results for a malware sample.
      - `exts` string[] — File extensions associated with the sample.
      - `sha1` string, nullable — SHA1 hash of the sample.
      - `md5` string, nullable — MD5 hash of the sample.
      - `sha256` string, nullable — SHA256 hash of the sample.
      - `sha512` string, nullable — SHA512 hash of the sample.
      - `size` integer, nullable — File size in bytes.
      - `ssdeep` string, nullable — Fuzzy hash value (ssdeep) of the sample.
      - `tags` string[] — Static tags applied to the sample.
      - `target` string, nullable — The target file or resource of interest.
      - `extracted` Extracted[] — List of extracted artifacts (e.g. configurations or credentials).
        - `config` ExtractedMalwareConfig, nullable — Extracted malware configuration with C2 servers, encryption keys, and other settings.
          - `botnet` string, nullable
          - `c2` string[]
          - `campaign` string, nullable
          - `credentials` ExtractedMalwareCredentials[]
            - `host` string, nullable
            - `password` string, nullable
            - `port` integer, nullable
            - `username` string, nullable
          - `decoy` string[]
          - `dns` string[]
          - `extracted_pe` string, nullable
          - `family` string, nullable
          - `keys` ExtractedConfigKey[]
            - `key` string, nullable
            - `kind` string, nullable
            - `value` string, nullable
          - `listen_addr` string, nullable
          - `listen_for` string[]
          - `listen_port` integer, nullable
          - `mutex` string[]
          - `rule` string, nullable
          - `tags` string[]
          - `version` string, nullable
          - `webinject` string[]
        - `credentials` ExtractedMalwareCredentials — Credentials extracted from malware analysis (hardcoded passwords, API keys, etc.).
          - `host` string, nullable
          - `password` string, nullable
          - `port` integer, nullable
          - `username` string, nullable
        - `dropper` ExtractedMalwareDropper — Dropper/downloader URLs extracted from malware analysis.
          - `deobfuscated` string, nullable
          - `family` string, nullable
          - `language` string, nullable
          - `source` string, nullable
          - `urls` DropperUrl[]
            - `type` string, nullable
            - `url` string, nullable
        - `dumped_file` string
        - `path` string, nullable
        - `ransom_note` ExtractedMalwareRansomNote — Ransom note content extracted from ransomware analysis.
          - `contact` string[]
          - `emails` string[]
          - `family` string, nullable
          - `note` string, nullable
          - `target` string, nullable
          - `urls` string[]
          - `wallets` string[]
        - `resource` string, nullable
      - `registry` Registry, nullable — Details of registry operations observed during analysis.
        - `create` RegistryCreate[] — List of registry keys created.
          - `key` string, nullable — The registry key path that was created.
        - `read` RegistryRead[] — List of registry keys read.
          - `key` string, nullable — The registry key path that was accessed.
        - `write` RegistryWrite[] — List of registry keys written.
          - `key` string, nullable — The registry key path that was modified.
          - `value` string, nullable — The new value written to the registry key.
      - `registry_count` integer, nullable — Total number of registry operations observed.
      - `signatures` Signature[] — List of behavioral or heuristic signatures triggered during analysis.
        - `desc` string, nullable — A textual description of the signature.
        - `indicators` Indicator[] — A list of indicators associated with this signature.
          - `description` string, nullable — A descriptive message detailing the indicator.
          - `ioc` string, nullable
          - `procid` integer — Process identifier associated with this indicator.
        - `name` string, nullable — The name of the signature.
        - `label` string, nullable — An optional label for the signature.
        - `score` integer, nullable — Severity score assigned to the signature.
        - `tags` string[] — Tags or keywords associated with the signature.
        - `ttp` string[] — Tactics, Techniques, and Procedures (TTPs) associated with the signature.
      - `signatures_count` integer, nullable — Total count of signatures triggered.

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/versions/c8c2f68d8b60/schema)