# Imphash Similarity API (tca-0302) — Spectra Intelligence

> Find Windows PE files sharing the same import hash (imphash) using Spectra Intelligence tca-0302; returns SHA1 hashes paginated at up to 1000 records per page.

Imphash Index provides a list of all available SHA1 hashes for files sharing the same import hash (imphash). An imphash is a hash calculated from a string which contains the libraries imported by a Windows Portable Executable (PE) file.

## General Info about Requests/Responses

- All requests support the format query field which supports two options: **xml** or **json**
- The default response format is xml

## ImpHash Index Single Query

This query returns a response containing SHA1 hashes for the requested imphash value. The response can contain a maximum of 1000 records per page. If more than 1000 records match the requested criteria, the next page of records can be retrieved by providing the SHA1 hash returned in the `next_page_sha1` response field as the `next_page_sha1` parameter of the next request.

<Button title="View OpenAPI Specification" href="/SpectraIntelligence/API-reference/#tag/malware-hunting/get/apiimphash_indexv1queryhash_value" />

### Request

```
GET /api/imphash_index/v1/query/{hash_value}[/next_page_sha1/{next_page_sha1}][?format=xml|json]
```

#### Path parameters

- `hash_value`
  - Must be a valid ImpHash hash
  - Required
- `next_page_sha1`
  - Optional parameter used for pagination. It is the SHA1 hash of the first sample on the next page.
  - Optional

#### Query parameters

- `format`
  - Specifies the response format. Supported values: **xml** (default), **json**
  - Optional

### Response

Response code 404 is returned with data: *Sample not found* when the hash is not found in the database records.

``` json
{
  "rl": {
    "imphash_index": {
      "next_page_sha1": "string",
      "query_imphash": "string",
      "sha1_list": [
        "string"
      ]
    }
  }
}
```

`rl.imphash_index`

- `query_imphash`
  - Imphash value from the query
- `next_page_sha1`
  - First SHA1 on the next page
- `sha1_list`
  - List of SHA1 hashes grouped by RHA1 for given imphash

### Examples

#### Format query field

Here the format for query response is varying:

```
/api/imphash_index/v1/query/0931e97555ac33eb10aa9539fe890070?format=json
/api/imphash_index/v1/query/0931e97555ac33eb10aa9539fe890070?format=xml
```

#### next_page_sha1 query field

```
/api/imphash_index/v1/query/0931e97555ac33eb10aa9539fe890070/next_page_sha1/dccc8cd495be5729742d0a7b75188d2b0f33429a
```

## ImpHash Index Single Sample Query

This query returns a response containing SHA1 hashes for the requested sample SHA1 value. The response can contain a maximum of 1000 records per page. If more than 1000 records match the requested criteria, the next page of records can be retrieved by providing the SHA1 hash returned in the `next_page` response field as the `next_page` parameter of the next request.

<Button title="View OpenAPI Specification" href="/SpectraIntelligence/API-reference/#tag/malware-hunting/get/apiimphash_indexv1querysamplehash_value" />

### Request

```
GET /api/imphash_index/v1/query/sample/{sha1}[/page/{page}][?format=xml|json]
```

#### Path parameters

- `sha1`
  - Must be a valid sample hash
  - Required
- `page`
  - Optional parameter used for pagination. It is the SHA1 hash of the first sample on the next page.
  - Optional

#### Query parameters

- `format`
  - Specifies the response format. Supported values: **xml** (default), **json**
  - Optional

### Response

Response code 404 is returned with data: *Sample not found* when the hash is not found in the database records.

``` json
{
  "rl": {
    "imphash_index": {
      "next_page": "string",
      "query_hash": "string",
      "list": [
        "string"
      ]
    }
  }
}
```

`rl.imphash_index`

- `query_hash`
  - Sample SHA1 hash value from the query
- `next_page`
  - First SHA1 on the next page
- `list`
  - List of SHA1 hashes grouped by RHA1 for given sample hash

## Examples

### next_page sample query field

```
/api/imphash_index/v1/query/sample/003748c030bb2cb5954fdaf0368c8617cf04b3df/page/dccc8cd495be5729742d0a7b75188d2b0f33429a
```
