File analysis (TCA-0104)

File analysis (TCA-0104)

This service returns the analysis record that Spectra Intelligence holds for a file hash. Depending on the sample, the record can include static analysis data, the history of multi-AV scans, the sources the sample came from, its relationships to other samples, and sandbox data. The service supports single and bulk hash queries.

This API is rate limited to 100 requests per second. If you go over the rate limit, or if you reach your quota, the service returns HTTP status code 429. See Response status codes.

Common use cases

The service returns what Spectra Intelligence already knows about a sample. It does not upload, detonate, or rescan the sample. If the service has no record of a hash, the response is HTTP status code 404.

• Case building on a known-bad hash. After File reputation (TCA-0101) gives you a verdict, this service gives you the evidence behind it: the static analysis story and indicators, the MITRE ATT&CK mapping, the certificate data, and the full multi-AV history in xref.
• Pivoting and enrichment. Use relationships to move to the containers, parents, and children of a sample. Use sources to find where the sample came from, including the domain and the original file name.
• IOC extraction. Use interesting_strings for the network resources found by static analysis, and dynamic_analysis network data for the addresses and requests observed in the sandbox.

The record is historical, and it changes as new reports arrive. The xref section keeps the 20 most recent multi-AV reports, and sources keeps up to 10 entries. To find how current the data is, read xref.last_seen, which is the time of the most recent multi-AV report.

For a verdict alone, use File reputation (TCA-0101), which is a cheaper call. For the per-scanner detail behind the xref section, use Multi-AV scanner (TCA-0103).

General information about requests and responses

• The service is available at https://data.reversinglabs.com and uses HTTP Basic authentication. See Getting started for credentials and your first request.
• All requests support the format query field. It has two options: xml and json.
• The default response format is xml. For bulk queries, the default response format is the same as the post_format.
• All bulk query rules accept a POST payload of the same format, described below.
• A bulk request must not contain more than 100 hashes. A request that contains more than 100 hashes returns HTTP status code 413.
• POST requests must set the HTTP header field Content-Type: application/octet-stream
• The dynamic analysis report is available only with additional permissions.
• For the full list of response codes, see Response status codes.

Querying results for recently uploaded files

When querying results for recently uploaded files, use the SHA1 hash. SHA256 and other hash types become available only after the file analysis is complete.

Single file analysis

This query returns a response containing analysis results for the requested hash. Depending on the hash, the response can contain information such as full file format information, static analysis data, historic multi-AV scan records, extracted malware configuration network and mutex data, dynamic network analysis data, file sources, parent information, certificate chain data, certificate signer information.

View OpenAPI Specification

Request

GET /api/databrowser/rldata/query/{hash_type}/{hash_value}[?format=xml|json]

• hash_type accepts these options: md5, sha1, sha256
• hash_value must be a valid hash defined by the hash_type parameter

Response

If Spectra Intelligence has no record of the requested hash, the service returns HTTP status code 404 with the plain-text body Sample not found. This body is not JSON, so parse the status code before you parse the body. A 404 means that the service has no analysis record for the hash. It is not a verdict on the file. To get a record, upload the sample with the File upload (TCA-0202-0203) API.

Response

{
  "rl": {
    "sample": {
      "sha1": "455444e78729be76584d0e49dc2cf2c2b2224358",
      "md5": "string",
      "sha256": "03e1581c3e66b9c30976662f76cf59730ab8d47b71d75e19f75eb674618b11d0",
      "sha384": "string",
      "sha512": "string",
      "ripemd160": "string",
      "crc32": "52520008",
      "ssdeep": "string",
      "tlsh": "string",
      "imphash": "string",
      "pe_sha1": "string",
      "pe_sha256": "string",
      "sample_size": 1085,
      "password_uploaded": true,
      "relationships": {
        "container_sample_sha1": [
          "string"
        ],
        "parent_sample_sha1": [
          "string"
        ],
        "child_sample_sha1": [
          "string"
        ],
        "more_child_samples_available": true
      },
      "analysis": {
        "entries": [
          {
            "record_time": "2026-09-15T11:16:03",
            "analysis_type": "TC_REPORT",
            "analysis_version": "5.0.0",
            "tc_report": {
              "info": {
                "file": {
                  "file_type": "PE",
                  "file_subtype": "Exe",
                  "proposed_filename": "string"
                },
                "identification": {
                  "name": "string"
                },
                "validation": {
                  "valid": true
                },
                "package": {}
              },
              "metadata": {
                "application": {},
                "certificate": {},
                "attack": {},
                "software_packages": {}
              },
              "interesting_strings": [
                {
                  "category": "domain",
                  "values": [
                    "example.com"
                  ]
                }
              ],
              "story": "string",
              "indicators": [
                {
                  "priority": 7,
                  "category": 12,
                  "description": "Retrieves the name of the user associated with the process.",
                  "id": 937,
                  "relevance": 0
                }
              ]
            }
          }
        ]
      },
      "xref": {
        "first_seen": "2026-09-15T11:15:01",
        "last_seen": "2026-09-15T11:19:00",
        "sample_type": "PE32+ executable (GUI) x86-64, for MS Windows, 8 sections",
        "entries": [
          {
            "record_time": "2026-09-15T11:19:00",
            "scanners": [
              {
                "name": "string",
                "result": "string"
              }
            ],
            "info": {
              "scanners": [
                {
                  "name": "string",
                  "version": "string",
                  "timestamp": "2026-09-15T10:05:00"
                }
              ]
            }
          }
        ]
      },
      "sources": {
        "entries": [
          {
            "record_time": "2026-09-15T11:15:01",
            "tag": "external_feed",
            "properties": [
              {
                "name": "file_name",
                "value": "string"
              }
            ],
            "domain": {
              "name": "example.com"
            }
          }
        ]
      },
      "dynamic_analysis": {
        "entries": [
          {
            "dynamic_analysis_report": {
              "analysed_on": "2025-11-20T10:42:21",
              "version": "34.0.0",
              "summary": {
                "mutexes": [
                  "string"
                ]
              },
              "network": {
                "dns_requests": [
                  {
                    "type": "65",
                    "query": "beacons2.gvt2.com"
                  }
                ],
                "domains": [
                  {
                    "ip": "172.217.74.94",
                    "name": "beacons-handoff.gcp.gvt2.com"
                  }
                ],
                "tcp_destinations": [
                  {
                    "port": 49748,
                    "address": "192.168.2.151"
                  }
                ],
                "udp_destinations": [
                  {
                    "port": 49988,
                    "address": "192.168.2.151"
                  }
                ],
                "http_requests": [
                  {
                    "uri": "http://e8.i.lencr.org/"
                  }
                ]
              }
            }
          }
        ]
      },
      "computer_vision_analysis": {
        "entries": [
          {
            "analysis_time": "string",
            "results": [
              {
                "format": "QR_CODE",
                "category": "https",
                "value": "string"
              }
            ]
          }
        ]
      }
    }
  }
}

Not every field appears in every response.

• Always returned: sha1, md5, sha256, sha384, sha512, ripemd160, sample_size, relationships, analysis, xref.
• Optional: crc32, ssdeep, tlsh, imphash, pe_sha1, pe_sha256, password_uploaded, sources, dynamic_analysis, computer_vision_analysis. Whether the service returns an optional field depends on the sample, on its file type, and on your permissions.

Check for an optional field before you read it.

rl.sample

• sha1
  • The SHA1 value of the requested sample. This field is always returned and you can use it as a primary key.
• md5, sha256, sha384, sha512, ripemd160
  • The respective hashes of the requested sample.
• crc32
  • The CRC32 checksum of the requested sample. The service returns it for some samples only.
• ssdeep
  • A fuzzy hash that you can use for file similarity comparisons. The service does not calculate it for all samples.
• tlsh
  • A hash value that you can use for file similarity comparisons. It helps you identify similar, nearly identical, or modified files. The service does not calculate the TLSH hash if SSDEEP is enabled and the file is smaller than 1024 bytes or larger than 734003200 bytes.
• imphash
  • The import hash of the sample. The service returns it for samples that import functions, such as PE files.
• pe_sha1, pe_sha256
  • The Authenticode hashes of the sample. The service returns them for PE samples.
• sample_size
  • The logical file size of the requested sample, in bytes.
• password_uploaded
  • Shows that a password was uploaded to unpack this sample. If nobody uploaded a password, the service omits this field.
• relationships
  • The container, parent, and child samples of the requested sample. See the rl.sample.relationships section below.
• analysis
  • The analysis results for the requested sample. This section currently holds Spectra Core static analysis only.
• xref
  • The multi-AV scanning reports for the requested sample. The service returns the 20 most recent reports. Each item is one multi-AV scanning report.
• sources
  • The sources that the sample came from. These can be domains, uploaders, and other origins. One sample can have several sources. The service returns up to 10 entries, sorted by timestamp with the most recent first.
• dynamic_analysis
  • The network data and the mutexes that the sandbox observed, if the sample was detonated. This section requires additional permissions.
• computer_vision_analysis
  • The URIs that computer vision analysis detected in images, and the data it extracted from QR codes. The service returns this section if it has already analyzed the sample.
  • For email samples, this section holds the QR and OCR-decoded URIs found in the email itself and propagated from all child samples.

---

rl.sample.relationships

The service omits an array when the sample has no relationship of that kind.

• container_sample_sha1
  • The container hashes. A container is the top-level archive or sample uploaded to the system and that holds the requested sample. The service returns up to 5 container sample hashes, sorted by SHA1 hash.
• parent_sample_sha1
  • The samples that directly contain the requested sample. The requested hash is a child of the hashes in this list. The service returns up to 5 parent sample hashes, sorted by SHA1 hash.
• child_sample_sha1
  • The samples contained in the requested sample. The service found them by file extraction and returns up to 10 of them.
• more_child_samples_available
  • Shows that the sample has more than 10 child samples. If the sample has 10 or fewer, the service omits this field.

---

rl.sample.analysis.entries[]

• record_time
  • Timestamp indicating when the analysis was executed.
• analysis_type
  • Label indicating the type of analysis (for example, TC_REPORT indicates Spectra Core static analysis).
• analysis_version
  • Version of the tool used for analysis.
• tc_report
  • Available metadata for the requested sample obtained as a result of Spectra Core static analysis.

---

rl.sample.analysis.entries[].tc_report

• info
  • Contains information about file_type, file_subtype, validation, identification, and package (if applicable).
• metadata
  • Relevant information about a sample extracted through static analysis. The fields returned in this section depend on the sample type.
• interesting_strings
  • When Spectra Core encounters files with strings that contain interesting information, it will tag those files with tags corresponding to the type of string. Strings are considered interesting if they contain information related to various network resources and addresses. Interesting strings are usually found in binary files, documents and text files. Every item inside this object belongs to a category and contains values.
  • The category field classifies the extracted string based on its type. It includes common network resource identifiers and address formats such as URIs, IPs, and protocols. Supported values: domain, mailto, ipv4, ipv6, http, https, ftp, nfs, file, gopher, ldap, prospero, net.pipe, net.tcp, news, nntp, telnet, uuid, and wais.
  • The values fields contain the extracted string values.
• story
  • The story section contains a summarized natural language description of the file's behavior and properties.
• indicators
  • List of indicators. They are the main static analysis technique Spectra Core uses to describe the analyzed content behavior. Since indicators are human-readable, their purpose is to simplify the code analysis process by converting complex code patterns into descriptions of their intent. Simply put, indicators make it possible to describe the file behavior through descriptions like “Downloads a file”, “Encrypts or encodes data in memory using Windows API”, “Enumerates currently available disk drives”, etc. While some indicators can only be found in certain formats, most are universal and therefore generally applicable.

---

rl.sample.analysis.entries[].tc_report.info

The file type fields are nested one level deeper, in info.file. Use info.file.file_type, not info.file_type.

• file
  • An object that holds the file type data:
    • file_type - the type of the sample, as Spectra Core detects it. For example, Document, Image, or PE.
    • file_subtype - the subtype of the sample, as Spectra Core detects it. For example, TIFF, Clojure, or HTML.
    • proposed_filename - a suggested file name, extracted from other metadata when the original file name is not available.
• identification
  • An object with the field name, which holds the identification name of the sample. Spectra Core does not generate an identification for all file types and subtypes, so the service omits this object for some samples.
• validation
  • An object that shows whether Spectra Core considered the sample valid when it processed the sample. It has these fields:
    • valid - true or false.
    • description - a list of the reasons for the result, such as bad checksum, bad signature, invalid certificate, expired certificate, blacklisted certificate, whitelisted certificate, malformed certificate, and self-signed certificate. The service omits this field when it has no reasons to report. For the meaning of these values, see Sample validation explanations.
• package
  • Sample metadata about malware configurations, such as C&C servers.

---

rl.sample.analysis.entries[].tc_report.metadata

• application
  • Refers to all PE files. Metadata that is extracted statically from these formats can vary depending on the type of application. This section can contain information such as dos_header, file_header, optional_header, sections, imports, resources...
• certificate
  • If the requested sample contains certificate-related metadata, this section provides detailed information about certificates, such as subject, issuer, serial_number, thumbprint, extensions...
• attack
  • If the requested sample contains MITRE ATT&CK metadata, this section provides list of attack tactics, and for each of these tactics, list of their attack techniques and subtechniques. Attack tactics, techniques and subtechniques have information about their id, description and name, while techniques and subtechniques can additionally contain indicators with priority, category, relevance etc.
• software_packages
  • List of packages. File type reserved for all programming language-specific packages. softwarePackage is specific metadata related to the package file type.

---

rl.sample.analysis.entries[].tc_report.software_packages

• name
  • Package name
• description
  • Package summary
• authors
  • List of package authors
• release_dependencies
  • List of release dependency packages with the field name, representing the name of the package
• develop_dependencies
  • List of development dependency packages with the field name, representing the name of the package

---

rl.sample.analysis.entries[].indicators

• priority
  • Priority is a number used to sort the indicators from least to most interesting (0 to 10) within a category. It is determined by the severity of the action described by the indicator. More dangerous indicators are prioritized higher within their category.
• category
  • The category that the indicator belongs to, as a numeric identifier. This is not the string category used by interesting_strings.
• description
  • A short description of the capability that the detected indicator refers to.
• id
  • Unique ID of an indicator.
• relevance
  • Contribution to the final classification.

---

rl.sample.xref.entries[]

• record_time
  • Timestamp when the multi-AV report was generated.
• scanners
  • List of results per scanner for this report. Every item is a scanner-specific scanning report, containing the scanner name and scanner detection string.
• info
  • Information about the scanners used for this scanning report. Contains a sequence of scanners ordered by name, with name, version, and timestamp indicating when the scanner was updated.
• first_seen
  • The date and time of the oldest multi-AV report created for the requested sample. The service keeps the 20 most recent reports, so for a sample with more reports than that, first_seen is older than the oldest record_time in entries.
• last_seen
  • The date and time of the most recent multi-AV report for the requested sample. It matches the newest record_time in entries. Read this field to find how current the multi-AV data is.
• sample_type
  • The sample type that the service detected for the requested sample.

---

rl.sample.sources.entries[]

• record_time
  • Timestamp indicating when the requested sample was uploaded.
• tag
  • Uploader designation indicating the origin of the sample; can be reversing_labs, external_feed, microsoft_whitelist or nsrl.
• properties
  • Sample data for this source, as name/value pairs in free format. The names depend on the source and can include the file name, the URL, and the IP address. The service omits this field for a source that has no such data.
• domain
  • If there is a domain linked to the sample source, it will be described within this element.

---

rl.sample.dynamic_analysis.entries[].dynamic_analysis_report

This section requires additional permissions. The service returns it only for samples that it detonated in the sandbox.

• analysed_on
  • The timestamp of the dynamic analysis report for the requested sample.
• version
  • The version of the tool that performed the dynamic analysis.
• summary
  • Holds the mutexes that the sandbox detected. The service omits this object when the sandbox detected no mutexes.
• network
  • Holds the network activity that the sandbox observed. It can contain dns_requests, domains, tcp_destinations, udp_destinations, and http_requests. The service returns only the kinds of activity that the sandbox observed, so a report can contain one of these fields or several. The service omits the whole object when the sandbox observed no network activity.

---

rl.sample.computer_vision_analysis.entries[]

• analysis_time
  • The timestamp indicating when the computer vision analysis was performed.
• results
  • A list of elements detected by the computer vision analysis. Each element includes the following fields: format, category, and value.
  • For email samples, results include URIs extracted directly from the email and URIs propagated from all child samples for up to 1,000 children, providing information for QR and OCR-decoded URIs within an email and its attachments.
  • The format field specifies the data format from which the string was extracted. Supported values: OCR for URIs extracted from images and PDFs, and QR_CODE for strings extracted from QR codes.
  • The category field classifies the extracted string based on its type. It includes common network resource identifiers and address formats such as URIs, IPs, and protocols. Supported values: domain, mailto, ipv4, ipv6, http, https, ftp, nfs, file, gopher, ldap, prospero, net.pipe, net.tcp, news, nntp, telnet, uuid, and wais.
  • The value field contains the extracted string value from the computer vision analysis.

Sample validation explanations

Name	Description
Valid certificate	Any certificate with an intact digital certificate chain that confirms the integrity of the signed file. The hash within Signer Info matches the hash of the file contents.
Invalid certificate	Any certificate with an intact digital certificate chain, but for which the certificate chain validation failed due to other reasons (e.g. because of attribute checks). Without a valid digital certificate chain, the integrity of the signed file cannot be validated.
Bad checksum	The integrity of the signed file could not be verified, because the hash within Signer Info does not match the hash of the file contents.
Bad signature	Any certificate with an intact digital certificate chain, but for which the signature validation failed. Without a valid signature, the integrity of the signed file cannot be validated.
Malformed certificate	Any certificate that does not have an intact digital certificate chain. The digital certificate is corrupted or incomplete, but that doesn't mean the file is also corrupted. Without a valid digital certificate chain, the integrity of the signed file cannot be validated.
Self-signed certificate	A self-signed certificate is a certificate that is signed by the same entity whose identity it certifies. In other words, this is a certificate that is used to sign a file, and doesn't have a CA that issued it. If CA information is present, but not found within the Spectra Core certificate store, the CA will be considered plausible and files signed with it will be declared valid (they will not be considered self-signed).
Impersonation attempt	Any self-signed certificate is a candidate for an impersonation check. Impersonation means that the signer is trying to misrepresent itself as a trusted party, where "trusted party" is defined by the certificate whitelist. Any self-signed certificate that matches the common name of another certificate on the Spectra Core whitelist is marked as an impersonation attempt
Expired certificate	Any certificate with signing time information is checked for expiration. When the time on the local machine indicates that the certificate has passed its "valid to" date and time, the certificate is considered expired. The "Expired" certificate status is merely informative, and expired certificates cannot influence certificate classification.
Untrusted certificate	Any valid certificate for which the digital certificate chain cannot be validated against a trusted CA. Untrusted certificates are valid certificates, but they cannot be whitelisted because their chain does not terminate with a CA in the Spectra Core certificate store.
Other	security catalog, revoked certificate, revoked certificate unspecified, revoked certificate key compromise, revoked certificate ca compromise, revoked certificate affiliation changed, revoked certificate superseded, revoked certificate cessation of operation, revoked certificate hold, revoked certificate remove from crl, revoked certificate privilege withdrawn, revoked certificate aa compromise, signed after revocation, blacklisted certificate, whitelisted certificate, bad certificate timestamp

Bulk file analysis

This query returns the same data as the single query, but for several hashes in one response. It is more network-efficient than several consecutive single queries. Each entry has the same fields as a single query response for the same hash.

View OpenAPI Specification

Request

POST /api/databrowser/rldata/bulk_query/{post_format}

• post_format is a required parameter that defines the POST payload format
• post_format variable rule will accept the options xml and json

The following definitions are valid for both formats:

• hash_type value must be one of the following options: md5, sha1, sha256
• hash_value must be a valid hash defined by hash_type

Request body

{
  "rl": {
    "query": {
      "hash_type": "hash_type",
      "hashes": [
        "hash_value",
        "hash_value",
        "hash_value"
      ]
    }
  }
}

Response

{
  "rl": {
    "entries": [
      {}
    ],
    "invalid_hashes": [
      "string"
    ],
    "unknown_hashes": [
      "string"
    ]
  }
}

• entries
  • One entry per requested hash that Spectra Intelligence has a record for. Each entry has the same fields as the rl.sample object of a single query.
• invalid_hashes
  • The hashes in the request that have an incorrect format. This includes hashes with an incorrect length and hashes that contain characters that are not hexadecimal. The service returns them as plain strings.
• unknown_hashes
  • The hashes from the request that the service has no record for, or that have no multi-AV data. The service returns them as plain strings.

The service returns rl.invalid_hashes and rl.unknown_hashes only when the request contains such hashes. If every hash you submit is valid and known, the response contains rl.entries alone. Check for a list before you read it.

Every hash you submit is returned in exactly one of the three lists, so together they account for the whole request.

The number of entries in rl.entries is smaller than the number of hashes you submit whenever the request contains an unknown or an invalid hash. The service removes those hashes into the other two lists. Use the sha1 field of an entry to match it to the hash that you requested. If you match the entries by their position in your request array, you get the data for the wrong hashes.

Examples

Runnable requests with authentication, in curl and Python, are available in the OpenAPI reference for both the single and the bulk operation.

Single query - changing the response format

/api/databrowser/rldata/query/sha1/a25b6db2d363eaa31de348399aedc5651280b52b?format=json
/api/databrowser/rldata/query/sha1/a25b6db2d363eaa31de348399aedc5651280b52b?format=xml

Single query - changing the hash type

/api/databrowser/rldata/query/sha1/a25b6db2d363eaa31de348399aedc5651280b52b
/api/databrowser/rldata/query/sha256/10dbb2b27208c5566d326b47950657bf6b3c9a59e302598a128ad7125d5fb4fd

Bulk query - changing the POST format

/api/databrowser/rldata/bulk_query/xml
/api/databrowser/rldata/bulk_query/json

Bulk query - JSON POST format

/api/databrowser/rldata/bulk_query/json

{
  "rl": {
    "query": {
      "hash_type": "md5",
      "hashes": [
        "4bb64c06b1a72539e6d3476891daf17b",
        "6353de8f339b7dcc6b25356f5fbffa4e",
        "59cb087c4c3d251474ded9e156964d5d",
        "6c2eb9d1a094d362bcc7631f2551f5a4",
        "a82c781ce0f43d06c28fe5fc8ebb1ca9",
        "920f5ba4d08f251541c5419ea5fb3fb3"
      ]
    }
  }
}

{
  "rl": {
    "query": {
      "hash_type": "sha1",
      "hashes": [
        "13e40f38427a55952359bfc5f52b5841ce1b46ba",
        "831fc2b9075b0a490adf15d2c5452e01e6feaa17",
        "42b05278a6f2ee006072af8830c103eab2ce045f"
      ]
    }
  }
}

See also

• File reputation (TCA-0101) - the classification verdict for a hash, when you do not need the full analysis record
• Multi-AV scanner (TCA-0103) - the per-scanner detail behind the xref section
• File analysis - non-malicious (TCA-0105) - the same response shape, restricted to goodware
• File upload (TCA-0202-0203) - how to upload a sample when the service returns 404 for its hash
• Spectra Core analysis - what the static analysis in the analysis section does
• ReversingLabs malware naming standard - how the platform, type, and family names are composed