<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Analyzing Malicious Attachments

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js analyze <file>` | Static analysis with hash and type detection |
| `node agent.js extract-iocs <file>` | Extract URLs, IPs, domains from strings |
| `node agent.js check-hash <file>` | Generate SHA256/MD5/SHA1 for TI lookup |
| `node agent.js scan-yara <file> --rules <dir>` | YARA rule scan |

### Examples

```bash
# Full static analysis of Office document
node agent.js analyze suspicious.docm

# Extract IOCs for blocklisting
node agent.js extract-iocs suspicious.docm

# Generate hashes for VirusTotal lookup
node agent.js check-hash suspicious.exe

# Scan against custom YARA rules
node agent.js scan-yara suspicious.docm --rules /opt/yara-rules/
```

## External Tools

| Tool | Command | Purpose |
|---|---|---|
| oletools | `olevba file.docm` | Extract VBA macros |
| oletools | `oleid file.docm` | Identify OLE indicators |
| oletools | `oleobj file.docm` | Extract embedded objects |
| oletools | `msodde file.docx` | Detect DDE attacks |
| YARA | `yara -r rules/ file` | Pattern matching scan |
| strings | `strings -n 8 file` | Extract ASCII strings |
| file | `file --brief file` | Magic byte identification |
| xxd | `xxd file \| head` | Hex dump inspection |

## Hash Lookup Services

| Service | URL |
|---|---|
| VirusTotal | `https://www.virustotal.com/gui/file/<sha256>` |
| MalwareBazaar | `https://bazaar.abuse.ch/sample/<sha256>` |
| Hybrid Analysis | `https://www.hybrid-analysis.com/` |
| Any.Run | `https://any.run/` |
