Skip to content
BranchesTags

Latest commit

 

History

3 Commits

Folders and files

NameName
Last commit message
Last commit date
LICENSE
LICENSE
 
 
README.md
README.md
 
 

Repository files navigation

🔑 File Hash Analyzer API — v0.0.2

The File Hash Analyzer API provides a lightweight and fast way to check if a file hash (MD5, SHA1, or SHA256) is malicious, safe, or unknown. It integrates MalwareBazaar intelligence feeds and allows crowdsourced reporting to keep the database growing. Seeded with 1M+ real malware samples and refreshed every 6 hours. Perfect for SIEM tools, SOC dashboards, malware sandboxes, and email gateways.

File Hash Analyzer API

Base URL:

https://file-hash-analyzer-api.p.rapidapi.com

Authentication:

  • x-rapidapi-key: Your RapidAPI key
  • x-rapidapi-host: https://file-hash-analyzer-api.p.rapidapi.com

1️⃣ / — Service Info

Method: GET Description: Returns the service name, version, and a list of all available endpoints.

Response (200 OK)

{
  "success": true,
  "data": {
    "name": "File Hash Analyzer",
    "version": "0.0.2",
    "description": "Analyze file hashes (MD5/SHA1/SHA256) against a crowd-sourced and MalwareBazaar-seeded database.",
    "endpoints": [
      {"method": "GET", "path": "/", "summary": "Service info"},
      {"method": "GET", "path": "/health", "summary": "Health check"},
      {"method": "GET", "path": "/analyze", "summary": "Analyze one hash"},
      {"method": "POST", "path": "/analyze", "summary": "Analyze one hash (JSON body)"},
      {"method": "POST", "path": "/analyze/batch", "summary": "Analyze up to 500 hashes"},
      {"method": "GET", "path": "/hash/<hash>", "summary": "RESTful single-hash lookup"},
      {"method": "POST", "path": "/report", "summary": "Submit a crowd-sourced verdict"},
      {"method": "POST", "path": "/report/batch", "summary": "Submit up to 100 verdicts"},
      {"method": "GET", "path": "/search", "summary": "Search database"},
      {"method": "GET", "path": "/recent", "summary": "Recently added entries"},
      {"method": "GET", "path": "/families", "summary": "Malware family breakdown"}
    ]
  },
  "meta": {"request_id": "d9ab522232f2", "api_version": "0.0.2"}
}

2️⃣ /health — Health Check

Method: GET Description: Returns service health status, database row count, last MalwareBazaar sync time, and whether a MalwareBazaar API key is configured.

Response (200 OK)

{
  "success": true,
  "data": {
    "status": "ok",
    "service": "File Hash Analyzer",
    "version": "0.0.2",
    "db": {"status": "ok", "total_hashes": 1117364},
    "malwarebazaar": {"api_key_configured": true, "note": "free key at https://auth.abuse.ch/"},
    "uptime_s": 3621.45,
    "last_sync": "2026-08-26T23:34:00+00:00"
  },
  "meta": {"request_id": "a1b2c3d4e5f6", "api_version": "0.0.2"}
}

3️⃣ /analyze — Analyze a Hash

Method: GET or POST Description: Query the database for a hash to check if it's known malicious, safe, or unknown. Supports MD5, SHA1, and SHA256. If you query with an MD5 or SHA1, the full SHA256 record is returned with matched_by indicating how it was resolved.

Request Parameters (GET)

Parameter Type Required Description
hash string Yes Hash to check (MD5, SHA1, or SHA256)
algorithm string No md5, sha1, or sha256. Auto-detected if omitted

Request Body (POST)

{
  "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
  "algorithm": "sha256"
}

Response (200 OK) — Malicious hit

{
  "success": true,
  "data": {
    "found": true,
    "query_hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
    "query_algorithm": "sha256",
    "verdict": "malicious",
    "confidence": 0.98,
    "tags": "mirai,botnet,iot",
    "source": "MalwareBazaar",
    "votes": 12,
    "md5": null,
    "sha1": null,
    "file_type": "elf",
    "first_seen": "2026-01-15",
    "created_at": "2026-08-26T12:00:00+00:00"
  },
  "meta": {"request_id": "d9ab522232f2", "api_version": "0.0.2"}
}

Response (200 OK) — Not found

{
  "success": true,
  "data": {
    "found": false,
    "query_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "query_algorithm": "sha256",
    "verdict": "unknown",
    "confidence": null,
    "tags": [],
    "source": null,
    "votes": 0,
    "md5": null,
    "sha1": null,
    "file_type": null,
    "first_seen": null,
    "created_at": null
  },
  "meta": {"request_id": "d9ab522232f2", "api_version": "0.0.2"}
}

Errors

  • 400 → Invalid hash or unsupported algorithm
  • 500 → Internal server error

4️⃣ /analyze/batch — Analyze Multiple Hashes

Method: POST Description: Analyze up to 500 hashes in a single request. Returns individual results for each hash plus a summary with found/not-found/invalid counts.

Request Body

Parameter Type Required Description
hashes array Yes Array of hash strings (MD5/SHA1/SHA256). Max 500. 
{
  "hashes": [
    "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "d41d8cd98f00b204e9800998ecf8427e"
  ]
}

Response (200 OK)

{
  "success": true,
  "data": {
    "results": [
      {
        "found": true,
        "query_hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
        "query_algorithm": "sha256",
        "verdict": "malicious",
        "confidence": 0.98,
        "tags": "mirai,botnet",
        "source": "MalwareBazaar",
        "votes": 12,
        "md5": null, "sha1": null, "file_type": null,
        "first_seen": null, "created_at": "2026-08-26T12:00:00+00:00"
      },
      {
        "found": false,
        "query_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
        "query_algorithm": "sha256",
        "verdict": "unknown",
        "confidence": null, "tags": [], "source": null, "votes": 0,
        "md5": null, "sha1": null, "file_type": null,
        "first_seen": null, "created_at": null
      },
      {
        "found": false,
        "query_hash": "d41d8cd98f00b204e9800998ecf8427e",
        "query_algorithm": "md5",
        "verdict": "invalid",
        "error": "Unsupported or undetectable hash algorithm",
        "confidence": null, "tags": [], "source": null, "votes": 0,
        "md5": null, "sha1": null, "file_type": null,
        "first_seen": null, "created_at": null
      }
    ],
    "summary": {
      "total": 3,
      "found": 1,
      "not_found": 1,
      "invalid": 1
    }
  },
  "meta": {"request_id": "a1b2c3d4e5f6", "api_version": "0.0.2", "duration_ms": 1.38}
}

Errors

  • 400 → Empty hash list or batch limit exceeded
  • 500 → Internal server error

5️⃣ /hash/<hash> — RESTful Hash Lookup

Method: GET Description: RESTful single-hash lookup. Same as /analyze but the hash goes in the URL path instead of a query parameter. Useful for URL-based integrations and gateway routing.

Request Parameters

Parameter Type Required Description
hash (path) string Yes The hash to look up (MD5/SHA1/SHA256)

Request Example

GET https://file-hash-analyzer-api.p.rapidapi.com/hash/f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702

Response: Same shape as /analyze above.

6️⃣ /report — Report a Hash

Method: POST Description: Crowdsource a hash, adding a new entry or updating an existing one. If the hash already exists, tags are merged and the vote count increments.

Request Body

Parameter Type Required Description
hash string Yes Hash to report (MD5/SHA1/SHA256)
verdict string Yes malicious, safe, or unknown
algorithm string No Force hash algo. Auto-detected if omitted.
tags array No Array of tag strings (family names, behaviors)
source string No Source attribution string
file_type string No File type label
first_seen string No ISO date when first observed
md5 string No MD5 hash (32 hex chars)
sha1 string No SHA1 hash (40 hex chars) 
{
  "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
  "verdict": "malicious",
  "tags": ["emotet", "banker", "trojan"],
  "source": "InternalSOC",
  "file_type": "peexe",
  "first_seen": "2026-08-01",
  "md5": "abc12345678901234567890123456789",
  "sha1": "def4567890123456789012345678901234567890"
}

Response Examples

  • 201 Created (new entry added)
{
  "success": true,
  "data": {
    "status": "created",
    "entry": {
      "id": 1117365,
      "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
      "algorithm": "sha256",
      "verdict": "malicious",
      "tags": "banker,emotet,trojan",
      "source": "InternalSOC",
      "votes": 1,
      "md5": "abc12345678901234567890123456789",
      "sha1": "def4567890123456789012345678901234567890",
      "file_type": "peexe",
      "first_seen": "2026-08-01",
      "created_at": "2026-08-26T23:45:00+00:00"
    }
  },
  "meta": {"request_id": "d9ab522232f2", "api_version": "0.0.2"}
}
  • 200 OK (existing entry updated)
{
  "success": true,
  "data": {
    "status": "updated",
    "entry": {
      "id": 42,
      "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
      "algorithm": "sha256",
      "verdict": "malicious",
      "tags": "banker,emotet,trojan",
      "source": "InternalSOC",
      "votes": 13,
      "md5": "abc12345678901234567890123456789",
      "sha1": "def4567890123456789012345678901234567890",
      "file_type": "peexe",
      "first_seen": "2026-08-01",
      "created_at": "2026-08-26T12:00:00+00:00"
    }
  },
  "meta": {"request_id": "d9ab522232f2", "api_version": "0.0.2"}
}

Errors

  • 400 → Invalid hash, unsupported algorithm, or invalid verdict
  • 409 → Hash already exists (integrity conflict)
  • 500 → Internal server error

7️⃣ /report/batch — Report Multiple Hashes

Method: POST Description: Submit up to 100 verdict reports in a single request. Each report follows the same rules as /report. Returns per-hash status (created/updated/error) and a summary.

Request Body

Parameter Type Required Description
reports array Yes Array of report objects (max 100)

Each report object:

Field Type Required Description
hash string Yes Hash to report
verdict string Yes malicious, safe, or unknown
tags array No Tag strings
source string No Source attribution
algorithm string No Force hash algo
file_type string No File type label
first_seen string No ISO date 
{
  "reports": [
    {
      "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
      "verdict": "malicious",
      "tags": ["emotet"],
      "source": "ScannerX"
    },
    {
      "hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "verdict": "safe",
      "tags": ["known-good"],
      "source": "WhitelistDB"
    }
  ]
}

Response (200 OK)

{
  "success": true,
  "data": {
    "results": [
      {"hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702", "status": "updated"},
      {"hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "status": "created"}
    ],
    "summary": {"total": 2, "errors": 0}
  },
  "meta": {"request_id": "a1b2c3d4e5f6", "api_version": "0.0.2"}
}

Errors

  • 400 → Empty reports list or batch limit exceeded
  • 500 → Internal server error

8️⃣ /search — Search Database

Method: GET Description: Search by family/tag name, hex prefix, verdict, or source. Paginated (max 100 per page). If q is 6+ hex characters, searches as a hash prefix. Otherwise searches as a family/tag keyword using full-text search. Results are ordered by most recently added.

Request Parameters

Parameter Type Required Description
q string No Search query: tag/family name OR hex prefix (6+ hex chars)
verdict string No Filter: malicious, safe, or unknown
source string No Filter by source substring
page int No Page number (default 1)
per_page int No Results per page, 1-100 (default 20)

Request Examples

GET https://file-hash-analyzer-api.p.rapidapi.com/search?q=emotet&verdict=malicious
GET https://file-hash-analyzer-api.p.rapidapi.com/search?q=000000&per_page=10
GET https://file-hash-analyzer-api.p.rapidapi.com/search?verdict=safe&page=2&per_page=50

Response (200 OK)

{
  "success": true,
  "data": {
    "results": [
      {
        "id": 1,
        "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
        "algorithm": "sha256",
        "verdict": "malicious",
        "tags": "emotet,banker,trojan",
        "source": "MalwareBazaar",
        "votes": 12,
        "md5": null, "sha1": null, "file_type": null,
        "first_seen": "2026-01-15",
        "created_at": "2026-08-26T12:00:00+00:00"
      }
    ]
  },
  "meta": {
    "request_id": "d9ab522232f2",
    "api_version": "0.0.2",
    "page": 1,
    "per_page": 20,
    "total": 412,
    "pages": 21
  }
}

Errors

  • 400 → Invalid page/per_page value
  • 500 → Internal server error

9️⃣ /recent — Recently Added Entries

Method: GET Description: Browse the most recently added/updated hashes, ordered by creation time descending. Optionally filter by verdict.

Request Parameters

Parameter Type Required Description
page int No Page number (default 1)
per_page int No Results per page, 1-100 (default 20)
verdict string No Filter: malicious, safe, or unknown

Request Examples

GET https://file-hash-analyzer-api.p.rapidapi.com/recent?per_page=10
GET https://file-hash-analyzer-api.p.rapidapi.com/recent?verdict=malicious&page=2

Response (200 OK)

{
  "success": true,
  "data": {
    "results": [
      {
        "id": 1117364,
        "hash": "abc123def456...",
        "algorithm": "sha256",
        "verdict": "malicious",
        "tags": "mirai,botnet",
        "source": "MalwareBazaar",
        "votes": 1,
        "md5": null, "sha1": null, "file_type": null,
        "first_seen": null,
        "created_at": "2026-08-26T23:34:00+00:00"
      }
    ]
  },
  "meta": {
    "request_id": "a1b2c3d4e5f6",
    "api_version": "0.0.2",
    "page": 1,
    "per_page": 10,
    "total": 1117364,
    "pages": 111737
  }
}

Errors

  • 400 → Invalid page/per_page value or verdict
  • 500 → Internal server error

🔟 /families — Malware Family Breakdown

Method: GET Description: Returns a breakdown of malware families (tags) sorted by prevalence. Shows total count plus malicious/safe/unknown sub-counts per family.

Request Parameters

Parameter Type Required Description
limit int No Max families to return, 1-100 (default 20)

Request Example

GET https://file-hash-analyzer-api.p.rapidapi.com/families?limit=10

Response (200 OK)

{
  "success": true,
  "data": {
    "families": [
      {"family": "mirai", "count": 4210, "malicious": 4200, "safe": 0, "unknown": 10},
      {"family": "heodo", "count": 3800, "malicious": 3790, "safe": 5, "unknown": 5},
      {"family": "emotet", "count": 2560, "malicious": 2555, "safe": 0, "unknown": 5},
      {"family": "agenttesla", "count": 1890, "malicious": 1885, "safe": 0, "unknown": 5},
      {"family": "formbook", "count": 1620, "malicious": 1615, "safe": 0, "unknown": 5}
    ],
    "total_families": 2161
  },
  "meta": {"request_id": "d9ab522232f2", "api_version": "0.0.2"}
}

Errors

  • 400 → Invalid limit value
  • 500 → Internal server error

💡 Notes

  • Supported hash algorithms: md5, sha1, sha256.
  • MD5 and SHA1 queries automatically resolve to the full SHA256 record when available (matched_by indicates the lookup method).
  • Tags are lowercase, comma-separated strings (e.g. "agenttesla,keylogger").
  • The database is seeded with 1M+ real malware samples from MalwareBazaar and refreshed every 6 hours.
  • Confidence scores: MalwareBazaar-sourced entries score 0.98, crowd-sourced entries scale up to 0.95 based on vote count.
  • Batch limits: /analyze/batch accepts up to 500 hashes, /report/batch accepts up to 100 reports.

🔗 Example curl Requests

Analyze hash (GET)

curl -X GET "https://file-hash-analyzer-api.p.rapidapi.com/analyze?hash=f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702" \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  -H "x-rapidapi-host: file-hash-analyzer-api.p.rapidapi.com"

Analyze hash (POST)

curl -X POST "https://file-hash-analyzer-api.p.rapidapi.com/analyze" \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  -H "x-rapidapi-host: file-hash-analyzer-api.p.rapidapi.com" \
  -H "Content-Type: application/json" \
  -d '{"hash":"f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702"}'

Analyze batch

curl -X POST "https://file-hash-analyzer-api.p.rapidapi.com/analyze/batch" \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  -H "x-rapidapi-host: file-hash-analyzer-api.p.rapidapi.com" \
  -H "Content-Type: application/json" \
  -d '{"hashes":["f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702","aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"]}'

RESTful hash lookup

curl -X GET "https://file-hash-analyzer-api.p.rapidapi.com/hash/f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702" \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  -H "x-rapidapi-host: file-hash-analyzer-api.p.rapidapi.com"

Report a hash

curl -X POST "https://file-hash-analyzer-api.p.rapidapi.com/report" \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  -H "x-rapidapi-host: file-hash-analyzer-api.p.rapidapi.com" \
  -H "Content-Type: application/json" \
  -d '{"hash":"f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702","verdict":"malicious","tags":["emotet"],"source":"user-report"}'

Report batch

curl -X POST "https://file-hash-analyzer-api.p.rapidapi.com/report/batch" \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  -H "x-rapidapi-host: file-hash-analyzer-api.p.rapidapi.com" \
  -H "Content-Type: application/json" \
  -d '{"reports":[{"hash":"f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702","verdict":"malicious","tags":["emotet"],"source":"ScannerX"}]}'

Search by family

curl -X GET "https://file-hash-analyzer-api.p.rapidapi.com/search?q=emotet&verdict=malicious" \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  -H "x-rapidapi-host: file-hash-analyzer-api.p.rapidapi.com"

Recent entries

curl -X GET "https://file-hash-analyzer-api.p.rapidapi.com/recent?per_page=5" \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  -H "x-rapidapi-host: file-hash-analyzer-api.p.rapidapi.com"

Malware families

curl -X GET "https://file-hash-analyzer-api.p.rapidapi.com/families?limit=10" \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  -H "x-rapidapi-host: file-hash-analyzer-api.p.rapidapi.com"

Health check

curl -X GET "https://file-hash-analyzer-api.p.rapidapi.com/health" \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  -H "x-rapidapi-host: file-hash-analyzer-api.p.rapidapi.com"

About

Check file hash reputation instantly with the File Hash Analyzer API. Lookup MD5 & SHA256 hashes against a malware intelligence database, submit crowdsourced reports, and tag threats like AgentTesla, Emotet, and TrickBot. A lightweight alternative to VirusTotal.

dakidarts.com/api/file-hash-analyzer-api/

Topics

apidakidartsfile-hash-value-validationfile-hashinghashingrapidapi

Resources

Readme
MIT license
Activity
Custom properties

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors