Skip to main content

Imphash Similarity API (TCA-0302) — Spectra Intelligence

An imphash, or import hash, is an MD5 hash calculated over the ordered list of libraries and functions a Windows Portable Executable (PE) file imports. Because that import table survives recompilation, files built from the same source share an imphash even when their contents differ — which makes it a reliable way to cluster samples into malware families.

The Imphash Index API (TCA-0302) returns every SHA1 hash in Spectra Intelligence for files sharing a given imphash. Query it two ways: by an imphash value directly, or by a sample SHA1 to find files that share that sample's imphash.

Request and response formats​

  • All requests support the format query field which supports two options: xml or json
  • The default response format is xml

Query by imphash value​

This query returns a response containing SHA1 hashes for the requested imphash value. The response can contain a maximum of 1000 records per page. If more than 1000 records match the requested criteria, the next page of records can be retrieved by providing the SHA1 hash returned in the next_page_sha1 response field as the next_page_sha1 parameter of the next request.

View OpenAPI Specification

Request​

GET /api/imphash_index/v1/query/{hash_value}[/next_page_sha1/{next_page_sha1}][?format=xml|json]

Path parameters​

  • hash_value
    • Must be a valid ImpHash hash
    • Required
  • next_page_sha1
    • Optional parameter used for pagination. It is the SHA1 hash of the first sample on the next page.
    • Optional

Query parameters​

  • format
    • Specifies the response format. Supported values: xml (default), json
    • Optional

Response​

Response code 404 is returned with data: Sample not found when the hash is not found in the database records.

{
  "rl": {
    "imphash_index": {
      "next_page_sha1": "string",
      "query_imphash": "string",
      "sha1_list": [
        "string"
      ]
    }
  }
}

rl.imphash_index

  • query_imphash
    • Imphash value from the query
  • next_page_sha1
    • First SHA1 on the next page
  • sha1_list
    • List of SHA1 hashes grouped by RHA1 for given imphash

Examples​

Format query field​

Here the format for query response is varying:

/api/imphash_index/v1/query/0931e97555ac33eb10aa9539fe890070?format=json
/api/imphash_index/v1/query/0931e97555ac33eb10aa9539fe890070?format=xml

next_page_sha1 query field​

/api/imphash_index/v1/query/0931e97555ac33eb10aa9539fe890070/next_page_sha1/dccc8cd495be5729742d0a7b75188d2b0f33429a

Query by sample SHA1​

This query returns a response containing SHA1 hashes for the requested sample SHA1 value. The response can contain a maximum of 1000 records per page. If more than 1000 records match the requested criteria, the next page of records can be retrieved by providing the SHA1 hash returned in the next_page response field as the next_page parameter of the next request.

View OpenAPI Specification

Request​

GET /api/imphash_index/v1/query/sample/{sha1}[/page/{page}][?format=xml|json]

Path parameters​

  • sha1
    • Must be a valid sample hash
    • Required
  • page
    • Optional parameter used for pagination. It is the SHA1 hash of the first sample on the next page.
    • Optional

Query parameters​

  • format
    • Specifies the response format. Supported values: xml (default), json
    • Optional

Response​

Response code 404 is returned with data: Sample not found when the hash is not found in the database records.

{
  "rl": {
    "imphash_index": {
      "next_page": "string",
      "query_hash": "string",
      "list": [
        "string"
      ]
    }
  }
}

rl.imphash_index

  • query_hash
    • Sample SHA1 hash value from the query
  • next_page
    • First SHA1 on the next page
  • list
    • List of SHA1 hashes grouped by RHA1 for given sample hash

Examples​

next_page sample query field​

/api/imphash_index/v1/query/sample/003748c030bb2cb5954fdaf0368c8617cf04b3df/page/dccc8cd495be5729742d0a7b75188d2b0f33429a