# Dynamic Analysis Results API (TCA-0106) — Spectra Intelligence

> Retrieve dynamic analysis reports from TCA-0106 for files and URLs detonated in the ReversingLabs sandbox, including behavior, network traffic, and malware configuration data.

## General information

This service allows users to retrieve dynamic analysis reports for files and URLs executed in the ReversingLabs cloud sandbox. It returns two types of reports: **merged reports** and **specific reports**.

### Merged reports

If you provide only the file or URL identifier, the response will contain a merged report with an overview of all dynamic analyses performed on the file or the URL. Most objects in the merged report include lists of analysis IDs, allowing the users to retrieve specific reports for more information about items of interest.

### Specific reports

If the request includes the `/latest` query parameter, or an `analysis_id` matching an existing report, the report will contain information specific to that execution. All specific reports will contain download links for the network traffic PCAP file, screenshots, and memory strings dump file captured during that specific analysis. These files have a retention period of 1 year, while their download links are dynamically generated on report request, and are valid for 1 hour.

Files and URLs can be submitted for dynamic analysis using the [TCA-0207 Dynamic Analysis](./tca-0207.md) service.

### Archive reports

While working with archives, use the [archives](#archives) and [archive latest](#archives-latest) endpoints.

Submitting only the SHA1 of the archive to these endpoints returns a list of SHA1 hashes of all files within the archives along with the **merged** dynamic analysis report for each file. If the `/latest` parameter is provided, the API returns a list of SHA1 hashes of all files within the archive, as well as the most recent **specific** dynamic analysis report for each file. Archives do not get an `analysis_id`, only the samples contained inside. They can be used to query the regular [file report endpoint](#files) for getting a specific report on an individual sample.

A user's quota is deducted with the number of files or URLs for which the *merged* or *specific* dynamic analysis report is provided.

### Privacy

Whether submitted files, email metadata, PCAP files, dropped files, screenshots, and memory string dumps will be shared with other ReversingLabs customers depends on the role configured for the Spectra Intelligence account used to upload files.

If the account is configured to upload all files as shareable (not private), other ReversingLabs customers will be able to access analysis results, but also download the uploaded files, dropped files, PCAP files, screenshots, and memory string dumps generated during file execution.

If the account is configured to upload all files as not shareable (private), other ReversingLabs customers will only be able to access analysis results, but not retrieve the actual contents of uploaded files, emails, dropped files, PCAP files, screenshots or memory string dumps.

**This API is rate limited to 5 requests per second.**

## Files

This query returns the dynamic analysis report for the requested sample hash.

<Button title="View OpenAPI Specification" href="/SpectraIntelligence/API-reference/#tag/dynamic-analysis-reversinglabs-cloud-sandbox/get/apidynamicanalysisreportv1queryhash_typehash_value" />

### Request

```
GET /api/dynamic/analysis/report/v1/query/{hash_type}/{hash_value}
```

**Path parameters:**

- `hash_type`
  - Accepts these values: `md5`, `sha1`, `sha256`
- `hash_value`
  - The hash value of the sample for which to retrieve the report. If neither `/latest` nor `analysis_id` are used, the response contains a merged report of all analyses performed on the sample. Must be a valid hash defined by the `hash_type` parameter.
  - This report only contains `pcap`, `memory_strings`, `screenshots` and `dropped_files` if `artifacts_url=True`.
- `/latest`
  - If added at the end of the endpoint path, the response contains only the newest dynamic analysis report for the requested file hash. This parameter is incompatible and mutually exclusive with `analysis_id`.
  - This report contains download links for the network traffic PCAP file, screenshots, and memory strings dump file captured during file execution.
- `analysis_id`
  - If added at the end of the request, the response contains only the dynamic analysis report matching the provided `analysis_id`. This parameter is incompatible and mutually exclusive with `/latest`.
  - This report contains download links for the PCAP network traffic file, screenshots, and memory strings dump file captured during file execution.

**Query parameters:**

- `format`
  - Specifies the response format. Supported values are `json` (default), `xml`
- `artifacts_url`
  - Add `artifacts_url=True` after the path parameters to receive a response containing artifact links (`pcap`, `memory_strings`, `screenshots`, `dropped_files`) for specific reports in the history part of the merged report. Passing this parameter will slow the response down.

### Response

```json
{
  "rl": {
    "report": {},
    "requested_hash": "string",
    "private_data_filtered": true
  }
}
```

- `report`
  - The object containing the dynamic analysis report (merged or report for a specific dynamic analysis run)
- `requested_hash`
  - The SHA1 hash of the analyzed file
- `private_data_filtered`
  - Sample privacy from the perspective of the account requesting the report. If `private_data_filtered` is false, the sample either belongs to the requesting account or is publicly available, and the report includes all relevant information. If `true`, the sample was privately uploaded by a different account, and the report will exclude any information described in the [Privacy](#privacy) chapter.

-----------------------------------------------------------------------

`rl.report`

```json
{
  "network": {},
  "mitre_attack": {},
  "process_tree": [],
  "sha1": "string",
  "analysis_id": "string",
  "classification": "string",
  "dropped_files": [],
  "snort_alerts": [],
  "analysis_duration": 0,
  "platform": "string",
  "configuration": "string",
  "behavioral": [],
  "memory_strings": "string",
  "sha256": "string",
  "pcap": "string",
  "md5": "string",
  "analysis_time": "string",
  "optional_parameters": "string",
  "yara": {}
  "interactive": "string",
  "timeout": 200
}
```

- `sha1`, `sha256`, `md5`
  - Hashes of the analyzed sample
- `classification`
  - The sandbox classification of the sample. Possible values are MALICIOUS, SUSPICIOUS, CLEAN, NO_THREATS_FOUND. In the merged report, classification is always the worst result out of all performed analyses.
- `risk_score`
  - Value representing the trustworthiness or malicious severity of a sample. Risk score is expressed as a number from 0 to 10, with 0 indicating whitelisted samples from a reputable origin, and 10 indicating the most dangerous threats. Goodware samples with risk scores of 2 and 3 are labeled "Likely benign / Public origin", and those with scores of 4 and 5 are labeled as "Not a known threat / Unverified origin". Risk scores from 6 to 10 are reserved for suspicious/malicious samples, and express their severity. The score from the specific report will show the risk score for that specific analysis, whereas the score from analysis with the highest risk score will be propagated to the top level of the merged report.
- `threat_names`
  - Name of the threats. Shows a list of unique threat names within the analyzed sample.
- `first_analysis`
  - The date and time when this sample was first analyzed
- `last_analysis`
  - The date and time when this sample was last analyzed
- `analysis_duration`
  - The duration of the analysis (in seconds)
- `platforms`
  - A list of platforms used to analyze the sample.
- `browser`
  - Browser-specific dynamic analysis detonation. This object is present only in specific reports.
- `configuration`
  - A short description of the platform configuration specifics (for example, "Win10 x64, Office 2016, Java 8 Update 191"). This object is present only in specific reports.
- `history_analysis`
  - An object containing an overview of all available reports. This object is present only in merged reports.
- `sample_name`
  - The name of the sample that was used during analysis. In a merged report, each individual analysis has its own sample_name attribute.
- `sample_path`
  - The full file path of the sample. In a merged report, each individual analysis has its own sample_path attribute.
- `optional_parameters`
  - An object containing a list of optional parameters used during analysis. Possible values: `internet_simulation`, `sample_name`, `geolocation`, `locale`.
    - If `internet_simulation` is true, dynamic analysis was performed without connecting to the internet and a simulated network was used instead. If this value is false, the report is the same as if the parameter is omitted from the response. HTTPS traffic information is not monitored during analysis when `internet_simulation` is set to true.
    - `sample_name` is a custom file name and/or extension provided on submission. Custom extensions impact which application was used to open and run the file.
    - `geolocation` is a geographic location associated with the sample's network activity, reflecting the configured country from which the network traffic is egressed, set via VPN or similar routing methods. Supported geographic location values are: `us` (default), `uk`, `in`, `br`, `de`, `jp`, `sg`, `it`, `es`, `fr`, `tor`.
    - `locale` setting reflects the configured OS language, region, and keyboard layout to simulate a specific country or environment for anti-evasion or targeted analysis purposes. Supported locale values are: `en-US` (default), `en-GB`, `pt-BR`, `de-DE`, `ja-JP`, `it-IT`, `es-ES`, `fr-FR`.
- `mitre_attack`
  - A list of identified MITRE ATT&CK tactics and techniques.
- `network`
  - A list of network resources the analyzed sample used or contacted during execution
- `behavioral`
  - A list of objects containing behavioral information about the executed sample. Every object relates one process spawned during sample execution to specific actions it performed.
- `android_behavioral`
  - A list of objects containing behavioral and permission information about the executed APK sample. Every object relates one process spawned during sample execution to specific actions it performed.
- `malware_configurations`
  - A list of embedded malware configuration data collected during sample execution.
- `bot_configurations`
  - Contains bot-related information.
- `snort_alerts`
  - Matched Snort alerts in PCAP network captures.
- `suricata_alerts`
  - Matched Suricata alerts in PCAP network captures.
- `sigma_detections`
  - Sysmon events, Windows event logs, and operating system process creation events captured during the detonation of malware in a sandbox.
- `signatures`
  - Abstracted behaviors, attributes, and content identified during analysis. Each signature has a signature ID, description and a risk score. Signatures commonly provide the following types of information:
  - Behaviors and capabilities observed during execution of the sample.
  - Attributes extracted via static analysis of the sample or artifacts generated during execution.
  - Data-enrichment results, such as file reputation detections for the sample and any dropped files, Snort signature detections from network traffic, and YARA rule matches in the sample or process memory
- `static.email`
  - For email files, this object includes extracted metadata. In merged reports, the metadata is linked to the analyses from which it was retrieved, identified by their analysis IDs.
- `static.apk`
  - For APK files, this object includes extracted metadata. In merged reports, the metadata is linked to the analyses from which it was retrieved, identified by their analysis IDs.
- `related_analysis`
  - If the analysis spawned additional analysis processes, this object contains a list of their analysis IDs, hashes, their relationship with the parent report, and any other applicable information.
- `dropped_files`
  - An object containing a list of all files dropped during execution of the analyzed sample. ReversingLabs uses an internal algorithm to filter and store dropped files in order to provide customers with the most interesting and valuable files.
- `dropped_files_url`
  - Contains a link to download all files dropped during the file execution. This link is generated when the report is requested, and expires in 1 hour. This object is present as `dropped_files_url` in specific reports, and as `dropped_files` in merged reports when `artifacts_url=True`.
- `pcap`
  - Contains a link to download the PCAP file with all the network traffic generated during sample execution. PCAP files have a retention period of 1 year. This link is generated when the report is requested, and expires in 1 hour. This object is present in specific reports, and in merged reports when `artifacts_url=True`.
- `memory_strings`
  - Contains a link to download a dump of memory strings stored in the memory and captured during file execution. Memory strings have a retention period of 1 year. This link is generated when the report is requested, and expires in 1 hour. This object is present in specific reports, and in merged reports when `artifacts_url=True`.
- `screenshots`
  - Contains a link to screenshots collected during the analysis. Screenshots have a retention period of 1 year. This link is generated when the report is requested, and expires in 1 hour. This object is present in specific reports, and in merged reports when `artifacts_url=True`.
- `process_tree`
  - An entire process tree generated during sample execution, sorted in order. This object is present only in specific reports.
- `warnings`
  - Descriptive warning messages regarding the status of the analysis.
- `errors`
  - Descriptive error messages regarding the status of the analysis.
- `yara`
  - Contains details regarding matched YARA rules during analysis.
- `interactive`
  - Whether the report comes from an interactive session with Spectra Analyze. Can be either "true" or "false" (string, not boolean).
- `timeout`
  - Maximum running time allowed for the sample.

-----------------------------------------------------------------------

`rl.report.mitre_attack.matrix_list`

```json
{
  "matrix_list": [
    {
      "name": "string",
      "tactics": {}
    }
  ]
}
```

- `name`
  - The name of the matrix used during analysis
- `tactics`
  - A list of tactics detected during sample execution.
    Each entry has an `id`, `name`, `description` and a `technique_list`
    containing a list of specific techniques that were detected.
    Technique lists in merged reports will also contain a list of `analysis_ids` for every technique.

-----------------------------------------------------------------------

`rl.report.network`

- `url`
  - A list of URLs extracted during sample execution. Every entry contains:
  - the destination URL
  - URL `source`:
    - `memory`: the URL was extracted from memory.
    - `malware_config`: the URL was extracted from a malware configuration.
    - `file`: the URL was extracted from a PDF file.
    - `network`: the URL was extracted from network traffic.
  - URL `classification`.
  - A list of `categories` for this URL.
- `http`
  - A list of resources this sample contacted using HTTP. Every entry contains the destination IP address and the request method.
- `udp`
  - A list of resources this sample contacted using UDP. Every entry contains the destination IP address, the destination port, and the process ID.
- `tcp`
  - A list of resources this sample contacted using TCP. Every entry contains the destination IP address, the destination port, and the process ID.
- `dns`
  - A list of DNS requests and resolutions the analyzed sample performed during execution. The address field contains the DNS server response, if available.

-----------------------------------------------------------------------

`rl.report.behavioral`

- `process`
  - An object containing information about the process that spawned during dynamic analysis. Contains the process ID, process name, the full execution path with parameters, and parent process ID.
- `mutex_actions`
  - A list of all mutex actions performed by the process during sample execution. Entries contain the file name, file path, the type of action that was performed, and if the action was successful or not.
- `file_actions`
  - A list of all files that were accessed or modified by the process. Entries contain the file name, file path, the type of action that was performed, and if the action was successful or not.
- `registry_actions`
  - A list of all registry actions performed by the process. Entries contain the registry key name, the type of action that was performed, and if the action was successful or not.
- `process_actions`
  - A list of all actions performed by spawned processes. Entries contain the process name, the type of action that was performed, and if the action was successful or not.
- `modules_loaded`
  - A list of all modules loaded by the process.

-----------------------------------------------------------------------

`rl.report.android_behavioral`

- `dynamic_services`
  - List of dynamically started services. Every entry is a stringified Intent, e.g.:
    - `"Intent { cmp=cmf0.c3b5bm90zq.patch/.C11 }"`
- `dynamic_receivers`
  - List of dynamically registered broadcast receivers. Every entry contains:
    - `name`: runtime-registered receiver class name.
    - `intents`: list of intent actions the receiver handles, e.g.:
      - `android.intent.action.BATTERY_CHANGED`
- `permissions_executed`
  - List of permissions actually executed during dynamic analysis. Every entry contains:
    - `name`: permission name, e.g. `ACCESS_NETWORK_STATE`.
    - `executed`: boolean flag indicating whether the permission was used at runtime.

-----------------------------------------------------------------------

`rl.report.malware_configurations`

- `threat_names`
  - Name of the threats. Shows a list of unique threat names within the analyzed sample.
- `configuration`
  - Embedded malware configuration data extracted during sample execution
- `malware_config_ip`
  - C2 IP addresses the malware contacted or attempted to contact during sample execution
- `malware_config_url`
  - C2 URLs the malware contacted or attempted to contact during sample execution
- `analysis_ids`
  - An object containing a list of analysis IDs of specific analyses during which this configuration was extracted. **This object is present only in merged reports.**

-----------------------------------------------------------------------

`rl.report.signatures`

- `sig_id`
  - Signature ID
- `description`
  - Signature description in human-readable format.
- `risk_factor`
  - Risk factor assigned to this signature. Can have one of the following values: `10` - Malicious behavior. Attributable to specific malware family/actor, `9` - Highly malicious behavior or content, `8` - Malicious behavior, `7` - Suspicious behavior, `6` - Moderately suspicious behavior or content, `5` to `1` - Normal behavior or content, `0` - Behavior indicative of goodware

-----------------------------------------------------------------------

`rl.report.dropped_files`

- `dropped_files_url`
  - Contains a link to download all files dropped during the file execution. This link is generated when the report is requested, and expires in 1 hour.
- `sha1`
  - The SHA1 hash of the dropped file
- `sha256`
  - The SHA256 hash of the dropped file
- `md5`
  - The MD5 hash of the dropped file
- `classification`
  - The classification of the dropped file. Possible values are `MALICIOUS`, `SUSPICIOUS`, `CLEAN`, `NO_THREATS_FOUND`.
- `file_name`
  - The file name of the dropped file
- `sample_type`
  - The file type of the dropped file
- `sample_size`
  - The file size of the dropped file (in bytes)
- `analysis_ids`
  - An object containing a list of analysis IDs and classifications for every occurrence of this dropped file during parent sample execution. **This object is present only in merged reports.**

-----------------------------------------------------------------------

`rl.report.static.email`

Contains information extracted from emails. This will be omitted from the report if the sample belongs to a different Spectra Intelligence account, and was uploaded as private (not shareable).

- `subject` - The subject line of the email.
- `from_address` - The sender's name and email address.
- `to_address` - The recipient's email address.
- `cc` - CC (carbon copy) email addresses.
- `bcc` - BCC (blind carbon copy) email addresses.
- `communications` - A list containing extracted strings from the email body or related communications.
- `date` - The date and time the email was sent.
- `analysis_id`: In merged reports, this field includes a list of related analysis IDs, identifying the analyses where the email information was extracted.
- `headers`
  - `key`: Header key (e.g., `Return-Path`).
  - `value`: Header value (e.g., `<email@example.com>`).
  - `analysis_id`: Headers in merged reports also contain a list of related `analysis_ids` for every header.
- `attachment`: A list of email attachments.

-----------------------------------------------------------------------

`rl.report.static.apk`

- `label`
   Human-readable application label from the APK.
- `minimum_sdk`
   Minimum Android SDK version required to install the app.
- `target_sdk`
   Target Android SDK version declared in the manifest.
- `version_code`
   Internal version code of the APK.
- `version_name`
   Version name of the APK, typically user-visible.
- `package_name`
   Unique application package identifier.
- `permissions`
  - List of permissions declared in the manifest.
- `activities`
  - List of declared activity component names. Every entry contains:
    - `name`: fully-qualified activity class name.
- `services`
  - List of declared service component names and their intent filters. Every entry contains:
    - `name`: fully-qualified service class name.
    - `intents`: list of intent actions the service listens for.
- `receivers`
  - List of declared broadcast receiver component names and intent filters. Every entry contains:
    - `name`: fully-qualified receiver class name.
    - `intents`: list of intent actions the receiver handles.
- `icon`
  - Launcher icon resource data. Contains:
    - `name`: file path of the icon resource within the APK.
    - `data`: Base64-encoded PNG image data for the icon.
- `certificate`
  - Signing certificate metadata used to sign the APK. Contains:
    - `issuer`: distinguished name of the certificate issuer.
    - `subject`: distinguished name of the certificate subject.
    - `md5`: MD5 fingerprint of the signing certificate.
    - `sha1`: SHA1 fingerprint of the signing certificate.
    - `sha256`: SHA256 fingerprint of the signing certificate.

-----------------------------------------------------------------------

`rl.report.related_analysis`

In **specific reports**, this object lists related analyses for the given entry. **Merged reports** list all associated files, including duplicates if a file was part of multiple analyses.

- `relationship_type`
  - Indicates the type of relationship between the analysis and its related analyses. Possible values are:
    - `email_source` - Indicates that the related analysis is for an email from which this attachment or URL was extracted.
    - `email_attachment` - Indicates that the related analysis is for an attachment to the email.
    - `email_extracted_url` - Indicates that the related analysis is for a URL extracted from the email.
- `md5`
  - The MD5 hash of the file (applies if the related analysis is for an attachment or source email).
- `sha1`
  - The SHA1 hash of the file (applies if the related analysis is for an attachment or source email).
- `sha256`
  - The SHA256 hash of the file (applies if the related analysis is for an attachment or source email).
- `url`
  - The extracted URL (applies if the related analysis is for an extracted URL).
- `related_analysis_id`
 - The ID of the report associated to the related extracted file/URL.
- `analysis_id`
  - The ID of the analysis during which the related file/URL was encountered.

-----------------------------------------------------------------------

The following objects are present only in merged reports:

`rl.report.history_analysis`

- `analysis_id`
  - The analysis ID of the report
- `classification`
  - The classification of the sample. Possible values are `MALICIOUS`, `SUSPICIOUS`, `CLEAN`, `NO_THREATS_FOUND`.
- `risk_score`
  - Value representing the trustworthiness or malicious severity of a sample.
- `platform`
  - The platform used to analyze the sample
- `browser`
  - Browser-specific dynamic analysis detonation. **This object is present only in merged reports.**
- `configuration`
  - A short description of the platform configuration specifics (for example, "Win10 x64, Office 2016, Java 8 Update 191")
- `analysis_time`
  - The date and time of the analysis
- `screenshots`
  - Contains a link to screenshots collected during the analysis. Screenshots have a retention period of 1 year. This link is generated when the report is requested, and expires in 1 hour.
- `pcap`
  - Contains a link to download the PCAP file with all the network traffic generated during sample execution. This link is generated when the report is requested, and expires in 1 hour. The PCAP file has a retention period of 1 year.
- `dropped_files`
  - An object containing a list of all files dropped during execution of the analyzed sample. ReversingLabs uses an internal algorithm to filter and store dropped files in order to provide customers with the most interesting and valuable files. Contains a link to download all files dropped during the file execution. This link is generated when the report is requested, and expires in 1 hour.
- `memory_strings`
  - Contains a link to download the memory strings captured during the sample execution. This link is generated when the report is requested, and expires in 1 hour. Memory strings have a retention period of 1 year.
- `optional_parameters`
  - An object containing a list of optional parameters used during analysis. Possible values: `internet_simulation`, `sample_name`, `geolocation`, `locale`.
  - If `internet_simulation` is true, dynamic analysis was performed without connecting to the internet and a simulated network was used instead. If this value is false, the report is the same as if the parameter is omitted from the response. HTTPS traffic information is not monitored during analysis when `internet_simulation` is set to true.
  - The `sample_name` is a custom file name and/or extension provided on submission. Custom extensions impact which application was used to open and run the file.
  - The `geolocation` is a geographic location associated with the sample's network activity, reflecting the configured country from which the network traffic is egressed, set via VPN or similar routing methods. Supported geographic location values are: `us` (default), `uk`, `in`, `br`, `de`, `jp`, `sg`, `it`, `es`, `fr`, `tor`.
  - The `locale` setting reflects the configured OS language, region, and keyboard layout to simulate a specific country or environment for anti-evasion or targeted analysis purposes. Supported locale values are: `en-US` (default), `en-GB`, `pt-BR`, `de-DE`, `ja-JP`, `it-IT`, `es-ES`, `fr-FR`.

-----------------------------------------------------------------------

The following objects are present only in specific reports.

`rl.report.process_tree`

- `process_id`
  - The ID assigned to the process
- `parent_process_id`
  - The ID of the parent process
- `process_name`
  - The process name
- `process_parameters`
  - Specific parameters used to execute the process

-----------------------------------------------------------------------

The following objects are present only in specific reports. They will be omitted if the sample belongs to a different Spectra Intelligence account, and was uploaded as private (not shareable).

`rl.report.memory_strings`

- `memory_strings`
  - Contains a link to download the memory strings captured during the sample execution. This link is generated when the report is requested, and expires in 1 hour. Memory strings have a retention period of 1 year.

-----------------------------------------------------------------------

`rl.report.pcap`

- `pcap`
  - Contains a link to download the PCAP file with all the network traffic generated during sample execution. This link is generated when the report is requested, and expires in 1 hour. The PCAP file has a retention period of 1 year.

-----------------------------------------------------------------------

`rl.report.screenshots`

- `screenshots`
  - Contains an S3 link to screenshots collected during the analysis. This link is generated when the report is requested, and expires in 1 hour. Screenshots have a retention period of 1 year.

-----------------------------------------------------------------------

`rl.report.yara`

- `entries`
  - Contains a list of matched YARA rules and details about where they matched.
- `source_type`
  - The type of file or content where the YARA rule matched. Possible values include:
    - `sample`: The original sample file.
    - `dropped_file`: Files created or dropped during the analysis.
    - `memory_dump`: Process memory captured during the analysis.
    - `unpacked_pe`: Unpacked PE (Portable Executable) files extracted during analysis.
    - `html`: HTML files involved in the analysis.
    - `pcap`: Network traffic captured in a PCAP file.
    - `other`: Any other content types.
- `source_name`
  - The name of the source where the YARA rule matched (optional).
- `rule`
  - Contains details about each YARA rule that matched against the source.
  - `description`: A textual explanation of the YARA rule's purpose.
  - `matched_data`: A list of matched strings within the YARA rule.
    - `matched_string`: The base64-encoded string that triggered the YARA rule match.
    - `matched_offset`: The decimal-encoded offset where the string was found in the source file or memory dump.

-----------------------------------------------------------------------

### Examples

#### Merged report

<Button title="View OpenAPI Specification" href="/SpectraIntelligence/API-reference/#tag/dynamic-analysis-reversinglabs-cloud-sandbox/get/apidynamicanalysisreportv1queryhash_typehash_value" />

##### Request

```
GET /api/dynamic/analysis/report/v1/query/sha1/cac61424fb5414d589687bfd35452a351604ef11
```

##### Response

<details>

<summary>Response</summary>

``` json
{
  "rl":{
    "report":{
      "mitre_attack":{
        "matrix_list":[
          {
            "tactics":{
              "tactic_list":[
                {
                  "techniques":{
                    "technique_list":[
                      {
                        "analysis_ids":[
                          "bc093926-e53f-49d9-82d7-1e5481cb22eb"
                        ],
                        "id":"T1091",
                        "name":"Replication Through Removable Media"
                      },
                      "..."
                    ]
                  },
                  "id":"8",
                  "name":"Lateral Movement"
                },
                "..."
              ]
            },
            "name":"Enterprise"
          }
        ]
      },
      "sha1":"cac61424fb5414d589687bfd35452a351604ef11",
      "last_analysis":"2021-02-09T18:54:58",
      "network":{
        "udp":[
          {
            "destination_port":53,
            "destination_ip":"8.8.4.4",
            "analysis_ids":[
              "bc093926-e53f-49d9-82d7-1e5481cb22eb"
            ]
          },
          "..."
        ],
        "dns":[
          {
            "type":"A (IP address)",
            "analysis_ids":[
              "bc093926-e53f-49d9-82d7-1e5481cb22eb"
            ],
            "value":"services.homedns.org",
            "address":"xxx.xxx.xxx.xxx"
          },
          "..."
        ]
      },
      "classification":"MALICIOUS",
      "history_analysis":[
        {
          "analysis_id":"bc093926-e53f-49d9-82d7-1e5481cb22eb",
          "classification":"MALICIOUS",
          "analysis_duration":217,
          "platform":"windows7",
          "configuration":"MS Office 2007;Java 7;Adobe reader 8;Firefox 37;Google Chrome 51;Internet Explorer 8",
          "sample_name": "Sample",
          "sample_path": "C:\Users\user\Desktop",
          "analysis_time":"2021-02-07T23:49:38",
        },
        "..."
      ],
      "sample_name": "Sample",
      "sample_path": "C:\Users\user\Desktop",
      "first_analysis":"2021-02-07T23:49:38",
      "dropped_files":[
        {
          "sha1":"BCF7B98F948D2CDDF2ABB74C4673604DDE801E1A",
          "classification":"NO_THREATS_FOUND",
          "file_name":"Logs",
          "sample_type":"ASCII text, with CRLF line terminators",
          "sample_size":33,
          "analysis_ids":[
            {
              "analysis_id":"bc093926-e53f-49d9-82d7-1e5481cb22eb",
              "classification":"NO_THREATS_FOUND"
            }
          ],
          "sha256":"51BE93BCB053F7412C5FFBCA5C947EC0DDA4A52D6D9A12F18BCE35C4E1F216A0",
          "file_path":"C:\\Users\\user\\AppData\\Roaming",
          "md5":"F07F3A1093767FF0B58C5FB7FC7617C7"
        },
        "..."
      ],
      "optional_parameters": "internet_simulation=true, geolocation=us, locale=en-US",
      "snort_alerts":[
        {
          "message":"ICMP Destination Unreachable Port Unreachable",
          "classification_type":"Misc activity",
          "destination_ip":"8.8.4.4",
          "rule":402,
          "analysis_ids":[
            "bc093926-e53f-49d9-82d7-1e5481cb22eb"
          ]
        },
        "..."
      ],
      "platforms":[
        "windows7",
        "windows10"
      ],
      "behavioral":[
        {
          "process":{
            "name":"cmd.exe",
            "parameters":"cmd /c REG ADD HKLM\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile /v 'DoNotAllowExceptions' /t REG_DWORD /d '0' /f",
            "analysis_ids":[
              "bc093926-e53f-49d9-82d7-1e5481cb22eb"
            ]
          },
          "mutex_actions":[
            {
              "status":"success or wait",
              "name":"unknown",
              "action_type":"mutex_created",
              "analysis_ids":[
                "bc093926-e53f-49d9-82d7-1e5481cb22eb"
              ]
            }
          ],
          "process_actions":[
            {
              "status":"success or wait",
              "path":"C:\\Windows\\SysWOW64\\cmd.exe",
              "analysis_ids":[
                "bc093926-e53f-49d9-82d7-1e5481cb22eb"
              ],
              "action_type":"process_terminated"
            },
            "..."
          ],
          "file_actions":[
            {
              "status":"success or wait",
              "file_name":"reg.exe",
              "file_path":"C:\\Windows\\SysWOW64",
              "action_type":"file_opened",
              "analysis_ids":[
                "bc093926-e53f-49d9-82d7-1e5481cb22eb"
              ]
            },
            "..."
          ],
          "modules_loaded":[
            {
              "module_name":"\\KnownDlls32\\MPR.dll",
              "analysis_ids":[
                "bc093926-e53f-49d9-82d7-1e5481cb22eb"
              ]
            },
            "..."
          ],
          "registry_actions":[
            {
              "status":"success or wait",
              "key_name":"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile",
              "analysis_ids":[
                "bc093926-e53f-49d9-82d7-1e5481cb22eb"
              ],
              "action_type":"key_opened"
            },
            "..."
          ]
        },
        "..."
      ],
      "yara": {
        "entries": [
          {
            "source_type": "sample",
            "rule": [
              {
                "description": "Detects executables packed with aPLib.",
                "matched_data": [
                  {
                    "matched_string": "QVAzMhgAAADP3QAAaFvqdQDMAQDrxK5YTThakA==",
                    "matched_offset": 45520
                  }
                ]
              }
            ]
          },
          {
            "source_type": "dropped_file",
            "source_name": "C:\\ProgramData\\d0db02bh22.exe",
            "rule": [
              {
                "description": "Detects executables packed with aPLib.",
                "matched_data": [
                  {
                    "matched_string": "QVAzMhgAAADcMQEApbYBZgAyAgAxg8GcTThakA==",
                    "matched_offset": 45520
                  },
                  {
                    "matched_string": "QVAzMhgAAADP3QAAaFvqdQDMAQDrxK5YTThakA==",
                    "matched_offset": 123848
                  }
                ]
              }
            ]
          },
          {
            "source_type": "memory_dump",
            "source_name": "d0db02bh22.exe",
            "rule": [
              {
                "description": "Detects executables packed with aPLib.",
                "matched_data": [
                  {
                    "matched_string": "QVAzMhgAAADP3QAAaFvqdQDMAQDrxK5YTThakA==",
                    "matched_offset": 3735928559
                  }
                ]
              }
            ]
          }
        ]
      },
      "sha256":"cc6102694e9d8f8efbd63c687972291369079c0bbd62b5d71cc106e9f64946d6",
      "md5":"4f2af32661dc73320acbe5acea29cfba"
    },
    "requested_hash":"cac61424fb5414d589687bfd35452a351604ef11"
  }
}
```

</details>

#### Specific Report

There are no formatting differences between reports retrieved using the `analysis_id` and `/latest` endpoint parameters. The only differences can occur in cases when users request information on a private sample belonging to another Spectra Intelligence account.

If the sample is public, other ReversingLabs customers will be able to access analysis results, but also download the uploaded files, dropped files, PCAP files, screenshots, and memory string dumps generated during file execution.

If the sample is private, other ReversingLabs customers will only be able to access analysis results, but not retrieve the actual contents of uploaded files, dropped files, PCAP files, screenshots or memory string dumps.

<Button title="View OpenAPI Specification" href="/SpectraIntelligence/API-reference/#tag/dynamic-analysis-reversinglabs-cloud-sandbox/get/apidynamicanalysisreportv1queryhash_typehash_valuespecific_report" />

##### Request

```
GET /api/dynamic/analysis/report/v1/query/sha1/cac61424fb5414d589687bfd35452a351604ef11/dd39d858-636f-4c76-a0d1-249ef21ff780
```

##### Response

<details>
<summary>Response</summary>

``` json
{
  "rl":{
    "report":{
      "mitre_attack":{
        "matrix_list":[
          {
            "tactics":{
              "tactic_list":[
                {
                  "id":"8",
                  "name":"Lateral Movement",
                  "techniques":{
                    "technique_list":[
                      {
                        "id":"T1080",
                        "name":"Taint Shared Content"
                      },
                      "..."
                    ]
                  }
                },
                "..."
              ]
            },
            "name":"Enterprise"
          }
        ]
      },
      "process_tree":[
        {
          "process_id":2096,
          "name":"rl_file.exe",
          "parameters":"'C:\\Users\\user\\Desktop\\rl_file.exe' ",
          "parent_process_id":1712
        }
      ],
      "sha1":"cac61424fb5414d589687bfd35452a351604ef11",
      "analysis_id":"dd39d858-636f-4c76-a0d1-249ef21ff780",
      "classification":"MALICIOUS",
      "dropped_files":[
        {
          "sha1":"E0A8096041DFA6D6E5F9D41E870C892E59438964",
          "classification":"NO_THREATS_FOUND",
          "file_name":"81608.bpc",
          "sample_type":"PE32 executable (GUI) Intel 80386, for MS Windows",
          "sample_size":5077073,
          "sha256":"6BECD956E49FA786BC2845909BC2C7BB6B8E633DE1633151014B44AF925966C6",
          "file_path":"C:\\ProgramData\\Microsoft\\OFFICE\\DATA",
          "md5":"60BCE3FACE583205A3247205052FD7A1"
        },
        "..."
      ],
      "analysis_duration":188,
      "platform":"windows7",
      "configuration":"MS Office 2007;Java 7;Adobe reader 8;Firefox 37;Google Chrome 51;Internet Explorer 8",
      "sample_name": "Sample",
      "sample_path": "C:\Users\user\Desktop",
      "behavioral":[
        {
          "process_actions":[
            {
              "status":"success or wait",
              "path":"C:\\Users\\user\\Desktop\\rl_file.exe",
              "action_type":"process_queried"
            }
          ],
          "registry_actions":[
            {
              "status":"object name not found",
              "key_name":"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language",
              "action_type":"key_value_queried"
            },
            "..."
          ],
          "file_actions":[
            {
              "status":"success or wait",
              "file_name":"KsecDD",
              "file_path":"\\Device",
              "action_type":"file_opened"
            },
            "..."
          ],
          "process":{
            "name":"rl_file.exe",
            "parameters":"'C:\\Users\\user\\Desktop\\rl_file.exe' "
          },
          "mutex_actions":[
            {
              "status":"success or wait",
              "name":"unknown",
              "action_type":"mutex_created"
            },
            "..."
          ],
          "modules_loaded":[
            {
              "module_name":"C:\\Windows\\SysWOW64\\sechost.dll"
            },
            "..."
          ]
        }
      ],
      "yara": {
        "entries": [
          {
            "source_type": "sample",
            "rule": [
              {
                "description": "Detects executables packed with aPLib.",
                "matched_data": [
                  {
                    "matched_string": "QVAzMhgAAADP3QAAaFvqdQDMAQDrxK5YTThakA==",
                    "matched_offset": 45520
                  }
                ]
              }
            ]
          },
          {
            "source_type": "dropped_file",
            "source_name": "C:\\ProgramData\\d0db02bh22.exe",
            "rule": [
              {
                "description": "Detects executables packed with aPLib.",
                "matched_data": [
                  {
                    "matched_string": "QVAzMhgAAADcMQEApbYBZgAyAgAxg8GcTThakA==",
                    "matched_offset": 45520
                  },
                  {
                    "matched_string": "QVAzMhgAAADP3QAAaFvqdQDMAQDrxK5YTThakA==",
                    "matched_offset": 123848
                  }
                ]
              }
            ]
          },
          {
            "source_type": "memory_dump",
            "source_name": "d0db02bh22.exe",
            "rule": [
              {
                "description": "Detects executables packed with aPLib.",
                "matched_data": [
                  {
                    "matched_string": "QVAzMhgAAADP3QAAaFvqdQDMAQDrxK5YTThakA==",
                    "matched_offset": 3735928559
                  }
                ]
              }
            ]
          }
        ]
      },
      "sha256":"cc6102694e9d8f8efbd63c687972291369079c0bbd62b5d71cc106e9f64946d6",
      "md5":"4f2af32661dc73320acbe5acea29cfba",
      "analysis_time":"2021-02-08T12:51:37",
      "optional_parameters": "internet_simulation=true, geolocation=us, locale=en-US"
    },
    "requested_id":"dd39d858-636f-4c76-a0d1-249ef21ff780",
    "requested_hash":"cac61424fb5414d589687bfd35452a351604ef11"
  }
}
```

</details>

#### Latest report

<Button title="View OpenAPI Specification" href="/SpectraIntelligence/API-reference/#tag/dynamic-analysis-reversinglabs-cloud-sandbox/get/apidynamicanalysisreportv1queryhash_typehash_valuespecific_report" />

##### Request

```
GET /api/dynamic/analysis/report/v1/query/sha1/cac61424fb5414d589687bfd35452a351604ef11/latest
```

<details>
<summary>Response</summary>

``` json
{
  "rl":{
    "report":{
      "mitre_attack":{
        "matrix_list":[
          {
            "tactics":{
              "tactic_list":[
                {
                  "id":"8",
                  "name":"Lateral Movement",
                  "techniques":{
                    "technique_list":[

                    ]
                  }
                },
                "..."
              ]
            },
            "name":"Enterprise"
          }
        ]
      },
      "yara": {
        "entries": [
          {
            "source_type": "sample",
            "rule": [
              {
                "description": "Detects executables packed with aPLib.",
                "matched_data": [
                  {
                    "matched_string": "QVAzMhgAAADP3QAAaFvqdQDMAQDrxK5YTThakA==",
                    "matched_offset": 45520
                  }
                ]
              }
            ]
          },
          {
            "source_type": "dropped_file",
            "source_name": "C:\\ProgramData\\d0db02bh22.exe",
            "rule": [
              {
                "description": "Detects executables packed with aPLib.",
                "matched_data": [
                  {
                    "matched_string": "QVAzMhgAAADcMQEApbYBZgAyAgAxg8GcTThakA==",
                    "matched_offset": 45520
                  },
                  {
                    "matched_string": "QVAzMhgAAADP3QAAaFvqdQDMAQDrxK5YTThakA==",
                    "matched_offset": 123848
                  }
                ]
              }
            ]
          },
          {
            "source_type": "memory_dump",
            "source_name": "d0db02bh22.exe",
            "rule": [
              {
                "description": "Detects executables packed with aPLib.",
                "matched_data": [
                  {
                    "matched_string": "QVAzMhgAAADP3QAAaFvqdQDMAQDrxK5YTThakA==",
                    "matched_offset": 3735928559
                  }
                ]
              }
            ]
          }
        ]
      },
      "sha1":"cac61424fb5414d589687bfd35452a351604ef11",
      "analysis_id":"64708859-7739-4c1a-9e64-2de5741882db",
      "classification":"NO_THREATS_FOUND",
      "analysis_duration":210,
      "platform":"windows7",
      "configuration":"MS Office 2007;Java 7;Adobe reader 8;Firefox 37;Google Chrome 51;Internet Explorer 8",
      "sample_name": "Sample",
      "sample_path": "C:\Users\user\Desktop",
      "memory_strings":"https://...",
      "sha256":"cc6102694e9d8f8efbd63c687972291369079c0bbd62b5d71cc106e9f64946d6",
      "pcap":"https://...",
      "md5":"4f2af32661dc73320acbe5acea29cfba",
      "analysis_time":"2021-02-09T18:54:58",
      "optional_parameters": "internet_simulation=true, geolocation=us, locale=en-US"
    },
    "requested_hash":"cac61424fb5414d589687bfd35452a351604ef11"
  }
}
```

</details>

## URLs

This query returns dynamic analysis reports for the requested URL.

The requested URL is identified by its Base64 encoding or SHA1 hash. Use the Base64/SHA1 identifier that you get in the response of the [TCA-0207 Dynamic Analysis](./tca-0207.md) service.

If you calculate this value **locally**, for example using `sha1sum`, there is a chance that you won't get results for that URL because the Dynamic Analysis service first performs a normalization process on the URL, and only then calculates the Base64 encoding / SHA1 hash.

### Request

```
GET /api/dynamic/analysis/report/v1/query/url/sha1/{sha1_value}/{analysis_id}
```

```
GET /api/dynamic/analysis/report/v1/query/url/base64/{base64_value}/{analysis_id}
```

**Path parameters**:

- `sha1_value`
  - A valid SHA1 value defined by the SHA1 parameter.
  - Required
- `base64_value`
  - A valid Base64 value defined by the Base64 parameter.
  - Required
- `analysis_id`
  - If added at the end of the request, the response will contain only the dynamic analysis report matching the provided analysis_id. It can be supplied only if the `latest` parameter is not already supplied. If neither are provided, the response returns a merged report.
  - Optional
- `latest`
  - Required if the user wants to retrieve the latest dynamic analysis report for the requested URL. It can be supplied only if the `analysis_id` parameter is not already supplied. If neither are provided, the response returns a merged report.
  - Optional

## Archives

This query returns dynamic analysis reports for the requested archive sample hash.

### Request

By submitting the SHA1 of the archive, the query returns the merged dynamic analysis report for each file within the archive. This endpoint accepts only SHA1 hashes.

```
GET /api/dynamic/analysis/report/v1/archive/query/sha1/{hash_value}
```

**Path parameters:**

- `hash_value`
  - The hash value of the sample for which to retrieve the report. If `/latest` is not used, the response will contain a merged report of all analyses performed on the sample.

### Response

``` json
{
  "rl": {
    "requested_hash": "string",
    "files": [
      {
        "sha1": "string",
        "merged_report": {}
      },
      {
        "sha1": "string",
        "merged_report": {}
      }
    ]
  }
}
```

### Examples

```
GET /api/dynamic/analysis/report/v1/archive/query/sha1/e662bfd39cf389b0bad5262e6007c09824261ee4
```

<details>
<summary>Response</summary>
``` json
{
  "rl": {
    "requested_hash": "e662bfd39cf389b0bad5262e6007c09824261ee4",
    "files": [
      {
        "sha1": "zzzf8d4dd290435a978e70adcf7876c0",
        "merged_report": {}
      },
      {
        "sha1": "vvvf8d4dd290435a978e70adcf7876c0",
        "merged_report": {}
      }
    ]
  }
}
```
</details>

## Archives Latest

By submitting SHA1 of the archive with the `/latest` parameter, the query returns the most recent specific dynamic analysis report for each file within the archive.

### Request

```
GET /api/dynamic/analysis/report/v1/archive/query/{hash_type}/{hash_value}/latest
```

**Path parameters:**

- `hash_value`
  - The hash value of the sample for which to retrieve the report. If `/latest` is not used, the response will contain a merged report of all analyses performed on the sample.

### Response

``` json
{
  "rl": {
    "requested_hash": "string",
    "files": [
      {
        "sha1": "string",
        "report": {}
      },
      {
        "sha1": "string",
        "report": {}
      }
    ]
  }
}
```

### Examples

```
GET /api/dynamic/analysis/report/v1/archive/query/sha1/e662bfd39cf389b0bad5262e6007c09824261ee4/latest
```

<details>
<summary>Response</summary>
``` json
{
  "rl": {
    "requested_hash": "e662bfd39cf389b0bad5262e6007c09824261ee4",
    "files": [
      {
        "sha1": "zzzf8d4dd290435a978e70adcf7876c0",
        "report": {}
      },
      {
        "sha1": "vvvf8d4dd290435a978e70adcf7876c0",
        "report": {}
      }
    ]
  }
}
```
</details>

## Custom Response Status Codes

This API implements custom response status codes. Find a complete list of possible HTTP response codes and their descriptions in the [General](../../index.md#response-status-codes) section of the documentation.

| CODE |                 | DESCRIPTION |
| :--- | :-------------- | :---------- |
| 404  | Preprocessing    | If the sample is still being validated for dynamic analysis, the response will contain the `pre_processing` status.
|      | Queued           | The sample is queued for analysis, indicated by the `queued` status in the response. |
|      | Preparing Sample | The `preparing_sample` status indicates that the sample is currently being submitted to the sandbox. |
|      | Analyzing        | The `analyzing` status indicates that the sample is currently being analyzed. |
|      | Postprocessing   | The `post_processing` status indicates that the report is currently being generated. |
|      | Error            | The ``error`` message response indicates that the sample failed to analyze.  |
