--- title: "Get results of a binexplode scan" method: GET path: "/v0/binexplode/scan/{id}" tags: ["BinExplode"] --- # Get results of a binexplode scan `GET /v0/binexplode/scan/{id}` Retrieve the results of a completed binexplode scan. ## Path parameters - `id` string, uuid, required — Task ID ## Response `200` OK - HandlerTypesGetScanResultResponse - `results` StrelkaResponse[] — binexplode list of responses for a single input file, each additional response represents an explosion result - `depth` integer — depth in explosion, starts at 0 - `file_extension` string — file extension if known. Using YARA and MIME rules (see .flavors) may provide more accurate detections. - `file_name` string — name of the file, or a placeholder. For files exploded from an archive this will be the actual name, but for extracted text, octet stream etc, it will be assigned by the parent to something arbitrary. - `flavors` StrelkaFlavors — matched yara and mime for file type identification - `external` string[] — Flavors marked by scanners exploding a file - `mime` string — Detected MIME type using the libmagic unix utility. - `yara` string[] — Matched YARA rules, for current definitions see [here](https://github.com/sublime-security/strelka/blob/main/build/configs/taste.yara) - `node_id` string — ID representing this file in the tree - `parent_node_id` string — ID of parent, or not present for the root - `scan` StrelkaScan — Contains results of all available bin explode scanners. Some scanners explode embedded binaries more than offer scan/analysis. Some of these have total_extracted & total_unextracted (the count of any files remaining after limits are hit). Some exploding scanners have limited analyses, besides the insight into the count of embedded files (see ZIP). RawOCR is an example which explodes, but does not report totals & explodes content which isn't truly an embedded file. - `bzip2` StrelkaBZip2 — Unpacks bzip2 files. Reports size - `size` integer, nullable — Size of uncompressed file within. - `docx` StrelkaDocX — Extracts details for a document, and explodes the text for further scanning. - `author` string, nullable - `category` string, nullable - `comments` string, nullable - `created` string, date-time, nullable - `font_colors` string[] — all non black (#000000) detected font colors. represented as web colors (hex) without '#' prefix. - `image_count` integer, nullable - `keywords` string, nullable - `last_printed` string, date-time, nullable - `modified` string, date-time, nullable - `revision` integer, nullable - `subject` string, nullable - `title` string, nullable - `word_count` integer, nullable - `encrypted_doc` StrelkaEncryptedDoc — Unpacks encrypted doc files by trying to break the password. Does not report totals - `cracked_password` string, nullable — If the doc was successfully opened, this is the password for the doc. - `encrypted_zip` StrelkaEncryptedZip — Unpacks encrypted ZIP files by trying to break the password. Reports total files even if the zip could not be cracked. - `cracked_password` string, nullable — If the ZIP was successfully opened, this is the password for the zip. - `total_extracted` integer, nullable - `total_files` integer, nullable - `entropy` StrelkaEntropy — Shannon entropy of file - `entropy` number, double, nullable — Shannon entropy (log base 2). A higher number means higher entropy. - `exiftool` StrelkaExifTool — Responses from the popular ExifTools application - `command_line_arguments` string - `create_date` string, date-time, nullable - `creator` string - `exif_tool_version` number, double - `fields` StrelkaKeyVal[] - `key` string - `value` string - `file_permissions` string - `file_type` string - `file_type_extension` string - `flags` string[] - `hot_key` string - `image_height` integer — In pixels - `image_width` integer — In pixels - `linearized` string - `local_base_path` string - `modify_date` string, date-time, nullable - `page_count` integer - `pdf_version` string - `producer` string - `relative_path` string - `run_window` string - `source_file` string - `target_file_dos_name` string - `title` string - `zip_bit_flag` integer - `zip_compressed_size` integer - `zip_file_name` string - `zip_modify_date` string, date-time, nullable - `zip_uncompressed_size` integer - `gif` StrelkaJpegGif — Extracts contents past the GIF trailer for further processing. Empty if there's no data based trailer. - `trailer_index` integer - `gzip` StrelkaGZip — Unpacks gzip. Reports the size - `size` integer, nullable — Size of uncompressed file within. - `hash` StrelkaHash — Multiple hash algorithms - `md5` string - `sha1` string - `sha256` string - `ssdeep` string - `html` StrelkaHTML — Scripts and basic details from HTML files. Explodes scripts for further scanning. - `hyperlinks` string[] - `scripts` StrelkaEmbeddedHTMLScript[] — All unique identifiers present in JS. unescape and write may be considered suspicious; a variable name is also an identifier. - `language` string, nullable — Language of script, e.g. 'javascript' - `scripts` string, nullable - `type` string, nullable - `spans` StrelkaHTMLSpan[] — HTML Span Tags - `style` string - `title` string - `total_extracted` integer, nullable - `ics` StrelkaICS — Parses iCalendar files and extracts events, attachments, and metadata - `calendars` StrelkaICSCalendar[] — Parsed calendar objects - `calscale` string — Calendar scale - `components` StrelkaICSComponent[] — Calendar components - `attachments` StrelkaICSAttachment[] — File attachments - … - `attendees` StrelkaICSAttendee[] — Event attendees - … - `class` string — Classification - `created` string — Creation date/time - `description` string — Detailed description - `dtend` string — End date/time - `dtstamp` string — Creation timestamp - `dtstart` string — Start date/time - `duration` string — Duration in human-readable format - `last_modified` string — Last modification date/time - `location` string — Event location - `organizers` StrelkaICSOrganizer[] — Event organizers - … - `priority` string — Priority level (0-9) - `sequence` string — Revision sequence - `status` string — Event status - `summary` string — Brief description - `transp` string — Transparency - `type` 'VEVENT' | 'VTODO' | 'VJOURNAL' | 'VTIMEZONE' | 'VALARM' — Component type - `uid` string — Unique identifier - `urls` MdmServiceURL[] — Referenced URLs - … - `method` string — Calendar method - `prodid` string — Product identifier - `version` string — iCalendar version - `flags` string[] — Warning/error flags from parsing - `parse_error` string, nullable — Error message if parsing failed - `total` StrelkaICSTotal — Summary counts for calendar components - `alarms` integer — Total VALARM components - `attachments` integer — Total ATTACH properties - `attendees` integer — Total attendees across all components - `components` integer — Total calendar components - `events` integer — Total VEVENT components - `extracted_files` integer — Successfully extracted files - `journals` integer — Total VJOURNAL components - `organizers` integer — Total organizers across all components - `timezones` integer — Total VTIMEZONE components - `todos` integer — Total VTODO components - `urls` integer — Total URL properties - `total_extracted` integer, nullable - `total_files` integer, nullable - `javascript` StrelkaJavascript — Contains details about the types of elements found in a JS script. Very simple scripts might signal obfuscation. - `identifiers` string[] — All unique identifiers present in JS. unescape and write may be considered suspicious; a variable name is also an identifier. - `keywords` string[] — All unique keywords present in JS, e.g. 'if'. - `regular_expressions` string[] — All unique regular expressions present JS. - `strings` string[] — All unique strings present in JS. - `tokens` string[] — All unique tokens/types present in JS. The other values in this type would be present in this list if they occur at all. E.g. a simple script may contain just Identifier & Punctuator (punctuator is not included any further) - `jpeg` StrelkaJpegGif — Extracts contents past the GIF trailer for further processing. Empty if there's no data based trailer. - `trailer_index` integer - `libarchive` StrelkaLibArchive — Unpacks archives supported by libarchive (including ISO files). Reports totals - `total_extracted` integer, nullable - `total_files` integer, nullable - `lnk` StrelkaLNK — Extracted details from LNK files. See ExifTools too. - `MAC` string - `command_line_arguments` string - `drive_serial_number` string - `drive_type` string - `local_base_path` string - `machine_id` string - `relative_path` string - `volume_label` string - `working_dir` string - `macho` StrelkaMachO — Unpacks and inspects Mach Objects (executables, libraries, etc) - `commands` string[] — All commands within - `has_code_signature` boolean - `header` object - `cpu` object — Details about the CPU/arch the binary is intended for - `primary` string — Primary type, e.g. x86_64 - `sub` string — Human description (may include ',', 'and', etc) - `file` 'BUNDLE' | 'CORE' | 'DSYM' | 'DYLIB' | 'DYLIB_STUB' | 'DYLINKER' | 'EXECUTE' | 'FVMLIB' | 'KEXT_BUNDLE' | 'OBJECT' | 'PRELOAD' — Typo of Macho - `flags` string[] — Flag List from header - `load_dylinker_name` string — Dylinker command name used - `nx` boolean — Binary has NX (non-executable stack) protection - `pie` boolean — Binary is position independent - `source_version` string — 5 part source version - `symbols` object — Details about symbols within binary - `imported` string[] — Imported symbols - `libraries` string[] — Imported libraries - `total_binaries` integer — Number of binaries registered - `total_commands` integer — Number of load commands - `total_libraries` integer — Number of libraries/Dylib commands - `total_relocations` integer — Number of relocations - `total_sections` integer — Number of sections - `total_segments` integer — Number of segments - `total_symbols` integer — Number of symbols - `ocr` StrelkaOCR — Attempts to find text in images and explodes the text for further scanning. - `raw` string — Full text returned from OCR, including whitespace - `text` string[] — Array of words found by OCR - `ole` StrelkaOle — Unpacks valid OLE files. Reports total files. - `total_extracted` integer, nullable - `pdf` StrelkaPDF — Unpacks a PDF for further processing. Reports total files. - `invalid_urls` string[] — URLs which could not be parsed - `total_extracted` integer, nullable - `urls` MdmServiceURL[] — Detected URLs - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - … - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - `encoders` string[] — List of detected URL rewrite encoders while unraveling the URL - `original` string, required — Original URL without any unraveling URL rewrites - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `pdf_obj_hash` StrelkaPDFObjHash — Generates PDF Object Hash of the given PDF file - `hash_string` string — Hash string used to generate the object hash for the PDF - `object_hash` string — Object hash of the PDF. This is the hash of the object types present in the document. - `pptx` StrelkaPPTX — Extracts details for a powerpoint (pptx) document, and explodes the text for further scanning. - `author` string, nullable - `category` string, nullable - `comments` string, nullable - `created` string, date-time, nullable - `image_count` integer, nullable - `invalid_urls` string[] — URLs which could not be parsed - `keywords` string, nullable - `last_modified_by` string, nullable - `last_printed` string, date-time, nullable - `modified` string, date-time, nullable - `revision` integer, nullable - `slide_count` integer, nullable - `subject` string, nullable - `title` string, nullable - `urls` MdmServiceURL[] — Detected URLs - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - … - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - `encoders` string[] — List of detected URL rewrite encoders while unraveling the URL - `original` string, required — Original URL without any unraveling URL rewrites - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `word_count` integer, nullable - `qr` StrelkaQR — Checks for QR codes and evaluates them - `data` string, nullable — Raw UTF8 Data - `type` 'email' | 'mobile' | 'app' | 'geo' | 'wifi' | 'url' | 'undefined' — Type of content, if known - `url` MdmServiceURL — URL details when QR code type is url - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - … - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - `encoders` string[] — List of detected URL rewrite encoders while unraveling the URL - `original` string, required — Original URL without any unraveling URL rewrites - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `rar` StrelkaRar — Unpacks rar files. Reports totals - `host_os` string, nullable - `total_extracted` integer, nullable - `total_files` integer, nullable - `rtf` StrelkaRTF — Unpacks RTF files. Reports totals - `total_extracted` integer, nullable - `strings` StrelkaStrings — Simply finds and extracts any strings from. - `raw` string — If the entire input is a string, mirror the input as a single string. - `strings` string[] — All detected strings. - `tar` StrelkaTar — Unpacks tar files. Reports totals - `total_extracted` integer, nullable - `total_files` integer, nullable - `url` StrelkaURL — Detects URLs from text (generally text unpacked by other scanners). - `invalid_urls` string[] — URLs which could not be parsed - `urls` MdmServiceURL[] — Detected URLs. - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - … - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - `encoders` string[] — List of detected URL rewrite encoders while unraveling the URL - `original` string, required — Original URL without any unraveling URL rewrites - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `vba` StrelkaVBA — Examines VBA macros in Ole files, and unpacks macro code for further analysis. - `auto_exec` string[] — All keywords associated with auto exec macros - `base64` string[] — Decoded base64 strings - `dridex` string[] — Decoded dridex strings - `hex` string[] — Decoded hex strings - `ioc` string[] — String values of indicators, such as 'cmd.exe' - `suspicious` string[] — Reported descriptions of suspicious behavior, e.g. 'Run' or 'Hex Strings' - `total_extracted` integer, nullable - `total_files` integer, nullable - `vba_obfuscated` string[] — Decoded vba obfuscated strings - `xml` StrelkaXML — Finds namespaces and other details from XML - `doc_type` string — DOCTYPE declaration from file - `namespaces` string[] - `tags` string[] - `total_extracted` integer, nullable - `version` string, nullable — XML version as declared by the document - `yara` StrelkaYARA — Reports YARA results from custom installed YARA rules. - `flags` string[] - `matches` StrelkaYARAMatch[] - `meta` object - `name` string - `zip` StrelkaZip — Unpacks ZIP files. Reports total files. - `all_paths` string[] — All member paths included in the zip (files and folders) - `attempted_files` string[] — File names, including path, which the scanner attempted to open (cuts off at a limit) - `encrypted` boolean — True if known to be encrypted. scan.encrypted_zip can contain details if password is bypassed. - `total_extracted` integer, nullable - `total_files` integer, nullable - `zlib` StrelkaZLib — Unpacks zlib files. Reports size - `size` integer, nullable — Size of uncompressed file within. - `size` integer — file size in bytes - `source` string — Scanner which 'exploded' this file - `task_response` HandlerTypesGetTaskResponse — Generic information about the scan task execution, such as status or errors. - `created_at` string, date-time — Task creation time - `error` string — Task error - `id` string, uuid, required — Task ID - `state` 'pending' | 'started' | 'succeeded' | 'failed' | 'retrying', required — Task status --- [API](https://skmtc.net/sublime/apis/sublime-platform-api.md) · [All operations](https://skmtc.net/sublime/apis/sublime-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sublime/sublime-platform-api/revisions/d5df82850357/schema)