Malware & File Threat Intelligence API
Extract behaviour indicators, cluster artifacts, analyze executable metadata, detect macro/document risk, extension mismatches, suspicious script patterns, archive payload risks, and IoCs—using local static parsing of caller-supplied files and analysis reports only.
Extract suspicious behaviour indicators from caller-supplied analysis reports/text using local static pattern matching. Files are never executed. Absence of matches is not a malware-free verdict.
Group caller-supplied files/artifacts by identical hashes and structural similarity (magic/extension/size). Clustering is not family attribution or confirmed malware.
Analyze PE/ELF/Mach-O metadata and structural properties from caller-supplied bytes. Static only—files are never executed.
Identify suspicious macro markers in caller-supplied Office/RTF documents via static strings/package entries. Macros are never executed.
Identify mismatches between caller-supplied filenames/extensions and local magic-byte formats, including double extensions.
Analyze caller-supplied scripts for suspicious static patterns (encoded commands, download cradles, obfuscation). Scripts are never executed.
Inspect caller-supplied archives for nested members and risky file types with strict depth/size/decompression limits. Contents are never executed or uploaded to scanners.
Extract IPs, domains, URLs, hashes, and emails from caller-supplied files/reports using local static parsing. Extracted strings are not live threat-intel verdicts.