API Documentation

The API is provided for the registered users to allow for accessing of files and data stored within out dataset.

Tools

Language Developer Link
Python @SilasCutler Github.com/MalShare/MalShare-Toolkit
.NET @AlexBK1996 Github.com/MalShare/MalShare.NET
Go @MonaxGT Github.com/MonaxGT/gomalshare
Java @Libranalysis Github.com/ThisIsLibra/MalShareApi
Python @0xDroogy https://github.com/Droogy/Malget
Python @toys0ldier https://github.com/toys0ldier/malware_keywords

API Endpoints

Request Type URL Path Description Output Format
GET /api.php?api_key=[API_KEY]&action=getlist List hashes from the past 24 hours JSON
GET /api.php?api_key=[API_KEY]&action=getlistraw List hashes from the past 24 hours Raw Text List
GET /api.php?api_key=[API_KEY]&action=getsources List of sample sources from the past 24 hours JSON
GET /api.php?api_key=[API_KEY]&action=getsourcesraw List of sample sources from the past 24 hours Raw Text List
GET /api.php?api_key=[API_KEY]&action=getfile&hash=[HASH] Download File Raw data
GET /api.php?api_key=[API_KEY]&action=details&hash=[HASH] GET stored file details JSON
POST /api.php?api_key=[API_KEY]&action=hashlookup Supply an array of hex-encoded hashes in a POST field named hashes. JSON
GET /api.php?api_key=[API_KEY]&action=type&type=[FILE TYPE] List MD5/SHA1/SHA256 hashes of a specific type from the past 24 hours JSON
GET /api.php?api_key=[API_KEY]&action=search&query=[SEARCH QUERY] Search sample hashes, sources and file names Raw data
GET /api.php?api_key=[API_KEY]&action=gettypes Get list of file types & count from the past 24 hours JSON
POST /api.php?api_key=[API_KEY]&action=upload Upload using FormData field "upload". Uploading files temporarily increases a users quota.
GET /api.php?api_key=[API_KEY]&action=getfilenames Returns a list of file names from uploads in the past day
GET /api.php?api_key=[API_KEY]&action=getlimit GET allocated number of API key requests per day and remaining Raw data
POST /api.php?api_key=[API_KEY]&action=download_url Perform URL download and add result to sample collection.
Pass URL to be downloaded in POST body with name url
Pass 1 to a variable with name recursive to enable crawling of the specified URL.

Example:
curl -X POST -F "url=https://example.com" "https://malshare.com/api.php?api_key=1234&action=download_url"
JSON
GET /api.php?api_key=[API_KEY]&action=download_url_check&guid=[GUID] Check status of download task via GUID. Response contains one of the following status values:
  • missing task with specified GUID does not exist
  • pending task was submitted but not picked up yet
  • processing download in progress
  • finished job finished
JSON