<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Automated Malware Triage

## YARA CLI

| Command | Description |
|---|---|
| `yara -s rules.yar sample.exe` | Scan file, show matching strings |
| `yara -r rules/ sample.exe` | Scan with recursive rule directory |
| `yara -t malware rules.yar samples/` | Scan with tag filter |
| `yara -c rules.yar samples/` | Count matches only |

## VirusTotal CLI (vt-cli)

| Command | Description |
|---|---|
| `vt file <hash>` | Look up file by hash |
| `vt scan file <path>` | Submit file for scanning |
| `vt file <hash> --include=behaviours` | Get behavioral report |
| `vt search "<query>"` | Search for samples |

## CAPE Sandbox API

| Endpoint | Method | Description |
|---|---|---|
| `/apiv2/tasks/create/file/` | POST | Submit file for analysis |
| `/apiv2/tasks/view/<id>/` | GET | Check task status |
| `/apiv2/tasks/get/report/<id>/` | GET | Get analysis report |
| `/apiv2/cuckoo/status/` | GET | Check sandbox status |

## Agent Script

```bash
# Identify sample — hashes, entropy, file type
node agent.js identify sample.exe

# YARA rule scan
node agent.js yara sample.exe --rules rules/malware.yar

# VirusTotal lookup
node agent.js vt-lookup <sha256>

# Score sample for triage verdict
node agent.js score sample.exe --rules rules/malware.yar
```
