<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Malware Intelligence Analysis

## VirusTotal API v3

**Base URL:** `https://www.virustotal.com/api/v3/`

### File Report
```bash
curl -H "x-apikey: API_KEY" \
  https://www.virustotal.com/api/v3/files/SHA256_HASH
```

### File Behavior Report
```bash
curl -H "x-apikey: API_KEY" \
  https://www.virustotal.com/api/v3/files/SHA256_HASH/behaviours
```

### Upload File for Scanning
```bash
curl -X POST -H "x-apikey: API_KEY" \
  --form file=@sample.exe \
  https://www.virustotal.com/api/v3/files
```

## MalwareBazaar API

**Base URL:** `https://mb-api.abuse.ch/api/v1/`

### Query by Hash
```bash
curl -X POST https://mb-api.abuse.ch/api/v1/ \
  -d '{"query":"get_info","hash":"SHA256_HASH"}'
```

### Query by Tag
```bash
curl -X POST https://mb-api.abuse.ch/api/v1/ \
  -d '{"query":"get_taginfo","tag":"Emotet","limit":50}'
```

### Download Sample
```bash
curl -X POST https://mb-api.abuse.ch/api/v1/ \
  -d '{"query":"get_file","sha256_hash":"SHA256"}' --output sample.zip
```

## Cape Sandbox API

**Base URL:** `http://cape:8000/apiv2/`

### Submit File
```bash
curl -X POST http://cape:8000/apiv2/tasks/create/file/ \
  -F file=@sample.exe -F timeout=120
```

### Get Report
```bash
curl http://cape:8000/apiv2/tasks/get/report/TASK_ID/
```

## Hybrid Analysis API

**Base URL:** `https://www.hybrid-analysis.com/api/v2/`

### Submit File
```bash
curl -X POST -H "api-key: API_KEY" \
  -F file=@sample.exe -F environment_id=120 \
  https://www.hybrid-analysis.com/api/v2/submit/file
```

### Search by Hash
```bash
curl -X POST -H "api-key: API_KEY" \
  -d '{"hash":"SHA256_HASH"}' \
  https://www.hybrid-analysis.com/api/v2/search/hash
```

## YARA Compilation

```python
import yara

# Compile from file
rules = yara.compile(filepath="rules/malware.yar")

# Compile from string
rules = yara.compile(source='rule test { condition: true }')

# Scan file
matches = rules.match("/path/to/sample.exe")

# Scan data
matches = rules.match(data=binary_data)
```

## Key Malware Databases

| Source | URL | API |
|--------|-----|-----|
| VirusTotal | virustotal.com | REST v3 |
| MalwareBazaar | bazaar.abuse.ch | REST |
| Hybrid Analysis | hybrid-analysis.com | REST v2 |
| Any.Run | any.run | REST |
| Cape Sandbox | capev2.readthedocs.io | REST |
| Malpedia | malpedia.caad.fkie.fraunhofer.de | REST |
