Malware & File Threat Intelligence API

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "reports": [
    {
      "id": "R1",
      "title": "Sandbox summary",
      "text": "Sample created process powershell.exe and wrote CurrentVersion\\Run persistence. Observed reverse shell beacon to C2.",
      "source": "Caller-supplied analysis report"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "behavior-R1",
      "detector": "file-behavior-indicator-extract",
      "title": "Suspicious behaviour indicators extracted",
      "observedFacts": [
        "Matched behaviour pattern: Process creation indicator.",
        "Matched behaviour pattern: Persistence indicator.",
        "Matched behaviour pattern: Network/C2 indicator."
      ],
      "inferredThreat": "Reported behaviours can indicate malicious capability if the source analysis is accurate.",
      "confidence": "high",
      "relatedIds": [
        "R1"
      ],
      "reasons": [
        "process_create",
        "persistence",
        "network_c2"
      ],
      "evidence": [
        {
          "subject": "R1",
          "fact": "Pattern process_create matched in supplied analysis text/bytes window.",
          "inference": "Behaviour indicators are extracted statically from supplied reports/files; not dynamic execution proof.",
          "confidence": "medium"
        },
        {
          "subject": "R1",
          "fact": "Pattern persistence matched in supplied analysis text/bytes window.",
          "inference": "Behaviour indicators are extracted statically from supplied reports/files; not dynamic execution proof.",
          "confidence": "medium"
        },
        {
          "subject": "R1",
          "fact": "Pattern network_c2 matched in supplied analysis text/bytes window.",
          "inference": "Behaviour indicators are extracted statically from supplied reports/files; not dynamic execution proof.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied analysis report",
      "status": "signal",
      "confirmedMalware": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "fileExecuted": false,
  "networkAccessed": false,
  "confirmedMalwareClaimed": false,
  "malwareFreeNotClaimed": true,
  "findings": [
    {
      "kind": "conflict",
      "code": "behavior_indicator",
      "subject": "R1",
      "detail": "Behaviour indicators: process_create, persistence, network_c2 (confirmedMalware=false)."
    }
  ],
  "limitations": [
    "Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.",
    "Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.",
    "Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.",
    "Nested archive inspection lists metadata and may inflate only small members within decompression caps.",
    "No paid threat-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/file-security/file-behavior-indicator-extract" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "reports": [
    {
      "id": "R1",
      "title": "Sandbox summary",
      "text": "Sample created process powershell.exe and wrote CurrentVersion\\Run persistence. Observed reverse shell beacon to C2.",
      "source": "Caller-supplied analysis report"
    }
  ]
}
JSON

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "artifacts": [
    {
      "id": "F1",
      "filename": "a.bin",
      "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "sizeBytes": 2048,
      "source": "Caller-supplied"
    },
    {
      "id": "F2",
      "filename": "b.bin",
      "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "sizeBytes": 2048,
      "source": "Caller-supplied"
    },
    {
      "id": "F3",
      "filename": "c.exe",
      "sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
      "sizeBytes": 2048,
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "cluster-hash-aaaaaaaaaaaaaaaa",
      "detector": "malware-artifact-cluster",
      "title": "Identical-hash artifact cluster",
      "observedFacts": [
        "2 artifacts share hash aaaaaaaaaaaaaaaa…"
      ],
      "inferredThreat": "Identical hashes indicate the same bytes; malice is not confirmed by clustering alone.",
      "confidence": "high",
      "relatedIds": [
        "F1",
        "F2"
      ],
      "reasons": [
        "identical_hash"
      ],
      "evidence": [
        {
          "subject": "F1",
          "fact": "filename=a.bin; magic=empty; size=2048",
          "confidence": "high"
        },
        {
          "subject": "F2",
          "fact": "filename=b.bin; magic=empty; size=2048",
          "confidence": "high"
        }
      ],
      "source": "Caller-supplied artifacts; deterministic hash clustering",
      "status": "signal",
      "confirmedMalware": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "fileExecuted": false,
  "networkAccessed": false,
  "confirmedMalwareClaimed": false,
  "malwareFreeNotClaimed": true,
  "findings": [],
  "limitations": [
    "Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.",
    "Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.",
    "Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.",
    "Nested archive inspection lists metadata and may inflate only small members within decompression caps.",
    "No paid threat-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/file-security/malware-artifact-cluster" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "artifacts": [
    {
      "id": "F1",
      "filename": "a.bin",
      "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "sizeBytes": 2048,
      "source": "Caller-supplied"
    },
    {
      "id": "F2",
      "filename": "b.bin",
      "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "sizeBytes": 2048,
      "source": "Caller-supplied"
    },
    {
      "id": "F3",
      "filename": "c.exe",
      "sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
      "sizeBytes": 2048,
      "source": "Caller-supplied"
    }
  ]
}
JSON

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "files": [
    {
      "id": "E1",
      "filename": "sample.exe",
      "fileBase64": "TVoAAGZha2UtcGU=",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "analyzed",
  "itemCount": 1,
  "items": [
    {
      "id": "exe-meta-E1",
      "detector": "executable-metadata-analyze",
      "title": "Executable metadata risk indicators",
      "status": "insufficient_evidence",
      "observedFacts": [
        "magic=pe_executable",
        "sizeBytes=11",
        "MZ found but PE header could not be fully parsed within supplied bytes."
      ],
      "inferredThreat": "Executable structural features can indicate packing or disguise.",
      "confidence": "low",
      "relatedIds": [
        "E1"
      ],
      "reasons": [
        "pe_header_incomplete"
      ],
      "evidence": [
        {
          "subject": "E1",
          "fact": "magic=pe_executable; sizeBytes=11; MZ found but PE header could not be fully parsed within supplied bytes.",
          "inference": "Static metadata only; file was not executed.",
          "confidence": "low"
        }
      ],
      "source": "Caller-supplied",
      "confirmedMalware": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "fileExecuted": false,
  "networkAccessed": false,
  "confirmedMalwareClaimed": false,
  "malwareFreeNotClaimed": true,
  "findings": [
    {
      "kind": "conflict",
      "code": "executable_metadata",
      "subject": "E1",
      "detail": "Executable indicators: pe_header_incomplete (confirmedMalware=false)."
    }
  ],
  "limitations": [
    "Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.",
    "Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.",
    "Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.",
    "Nested archive inspection lists metadata and may inflate only small members within decompression caps.",
    "No paid threat-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/file-security/executable-metadata-analyze" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "files": [
    {
      "id": "E1",
      "filename": "sample.exe",
      "fileBase64": "TVoAAGZha2UtcGU=",
      "source": "Caller-supplied"
    }
  ]
}
JSON

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "files": [
    {
      "id": "D1",
      "filename": "invoice.doc",
      "fileBase64": "0M8R4KGxGuF2YmFQcm9qZWN0LmJpbiBBdXRvT3BlbiBTaGVsbCBWQkEgbWFjcm9zaGVldHM=",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "macro-D1",
      "detector": "macro-document-risk-detect",
      "title": "Suspicious macro document indicators",
      "observedFacts": [
        "OLE/text window contains VBA/macro storage indicators.",
        "Auto-execution macro entrypoint wording present."
      ],
      "inferredThreat": "Macro-enabled documents with auto-exec markers are commonly used for initial access.",
      "confidence": "high",
      "relatedIds": [
        "D1"
      ],
      "reasons": [
        "macro_storage_indicator",
        "auto_exec_macro"
      ],
      "evidence": [
        {
          "subject": "D1",
          "fact": "magic=ole_cfb; extension=doc",
          "inference": "Macro risk from static markers only; document was not opened/executed.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied",
      "status": "signal",
      "confirmedMalware": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "fileExecuted": false,
  "networkAccessed": false,
  "confirmedMalwareClaimed": false,
  "malwareFreeNotClaimed": true,
  "findings": [
    {
      "kind": "conflict",
      "code": "macro_risk",
      "subject": "D1",
      "detail": "Macro indicators: macro_storage_indicator, auto_exec_macro (confirmedMalware=false)."
    }
  ],
  "limitations": [
    "Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.",
    "Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.",
    "Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.",
    "Nested archive inspection lists metadata and may inflate only small members within decompression caps.",
    "No paid threat-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/file-security/macro-document-risk-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "files": [
    {
      "id": "D1",
      "filename": "invoice.doc",
      "fileBase64": "0M8R4KGxGuF2YmFQcm9qZWN0LmJpbiBBdXRvT3BlbiBTaGVsbCBWQkEgbWFjcm9zaGVldHM=",
      "source": "Caller-supplied"
    }
  ]
}
JSON

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "files": [
    {
      "id": "X1",
      "filename": "invoice.pdf.exe",
      "fileBase64": "TVoAAGZha2UtcGU=",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "ext-X1",
      "detector": "file-extension-mismatch-detect",
      "title": "File extension / format mismatch",
      "observedFacts": [
        "filename=invoice.pdf.exe",
        "extension=exe",
        "magic=pe_executable",
        "Double extension pattern: .pdf.exe"
      ],
      "inferredThreat": "Mismatched extensions are often used to disguise dangerous payloads.",
      "confidence": "high",
      "relatedIds": [
        "X1"
      ],
      "reasons": [
        "double_extension"
      ],
      "evidence": [
        {
          "subject": "X1",
          "fact": "filename=invoice.pdf.exe; extension=exe; magic=pe_executable; Double extension pattern: .pdf.exe",
          "inference": "Compared filename extension to local magic bytes only.",
          "confidence": "high"
        }
      ],
      "source": "Caller-supplied",
      "status": "signal",
      "confirmedMalware": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "fileExecuted": false,
  "networkAccessed": false,
  "confirmedMalwareClaimed": false,
  "malwareFreeNotClaimed": true,
  "findings": [
    {
      "kind": "conflict",
      "code": "extension_mismatch",
      "subject": "X1",
      "detail": "Extension mismatch: double_extension (confirmedMalware=false)."
    }
  ],
  "limitations": [
    "Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.",
    "Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.",
    "Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.",
    "Nested archive inspection lists metadata and may inflate only small members within decompression caps.",
    "No paid threat-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/file-security/file-extension-mismatch-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "files": [
    {
      "id": "X1",
      "filename": "invoice.pdf.exe",
      "fileBase64": "TVoAAGZha2UtcGU=",
      "source": "Caller-supplied"
    }
  ]
}
JSON

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "files": [
    {
      "id": "S1",
      "filename": "payload.ps1",
      "fileBase64": "<base64 document omitted>",
      "source": "Caller-supplied"
    }
  ]
}

The base64 document is shortened here; send the full encoded document.

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "script-S1",
      "detector": "suspicious-script-pattern-detect",
      "title": "Suspicious script patterns",
      "observedFacts": [
        "Matched script pattern encoded_command.",
        "Matched script pattern download_cradle.",
        "Matched script pattern eval_exec.",
        "Matched script pattern hidden_window."
      ],
      "inferredThreat": "Suspicious script constructs can indicate download cradles, obfuscation, or living-off-the-land abuse.",
      "confidence": "high",
      "relatedIds": [
        "S1"
      ],
      "reasons": [
        "encoded_command",
        "download_cradle",
        "eval_exec",
        "hidden_window"
      ],
      "evidence": [
        {
          "subject": "S1",
          "fact": "Matched script pattern encoded_command. Matched script pattern download_cradle. Matched script pattern eval_exec. Matched script pattern hidden_window.",
          "inference": "Static regex indicators only; script was not executed.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied",
      "status": "signal",
      "confirmedMalware": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "fileExecuted": false,
  "networkAccessed": false,
  "confirmedMalwareClaimed": false,
  "malwareFreeNotClaimed": true,
  "findings": [
    {
      "kind": "conflict",
      "code": "script_pattern",
      "subject": "S1",
      "detail": "Script patterns: encoded_command, download_cradle, eval_exec, hidden_window (confirmedMalware=false)."
    }
  ],
  "limitations": [
    "Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.",
    "Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.",
    "Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.",
    "Nested archive inspection lists metadata and may inflate only small members within decompression caps.",
    "No paid threat-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/file-security/suspicious-script-pattern-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "files": [
    {
      "id": "S1",
      "filename": "payload.ps1",
      "fileBase64": "<base64 document omitted>",
      "source": "Caller-supplied"
    }
  ]
}
JSON

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "maxArchiveDepth": 2,
  "files": [
    {
      "id": "Z1",
      "filename": "drop.zip",
      "fileBase64": "<base64 document omitted>",
      "source": "Caller-supplied"
    }
  ]
}

The base64 document is shortened here; send the full encoded document.

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "maxArchiveDepth": 2,
  "maxInflateBytes": 512000,
  "items": [
    {
      "id": "archive-Z1",
      "detector": "archive-payload-risk-detect",
      "title": "Archive payload risk indicators",
      "observedFacts": [
        "Archive members inspected=2 (depth cap 2, inflate cap 512000).",
        "2 member(s) have risky extensions/types (e.g. payload.js, nested/drop.exe)."
      ],
      "inferredThreat": "Nested/risky archive members are commonly used to smuggle payloads.",
      "confidence": "medium",
      "relatedIds": [
        "Z1"
      ],
      "reasons": [
        "risky_member_types"
      ],
      "evidence": [
        {
          "subject": "Z1",
          "fact": "Archive members inspected=2 (depth cap 2, inflate cap 512000). 2 member(s) have risky extensions/types (e.g. payload.js, nested/drop.exe).",
          "inference": "Archive inspected locally with depth/size caps; not executed / not sent to scanners.",
          "confidence": "medium"
        },
        {
          "subject": "payload.js",
          "fact": "depth=0; magic=unknown; size=8",
          "confidence": "medium"
        },
        {
          "subject": "nested/drop.exe",
          "fact": "depth=0; magic=pe_executable; size=11",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied",
      "status": "signal",
      "confirmedMalware": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "fileExecuted": false,
  "networkAccessed": false,
  "confirmedMalwareClaimed": false,
  "malwareFreeNotClaimed": true,
  "findings": [
    {
      "kind": "conflict",
      "code": "archive_payload",
      "subject": "Z1",
      "detail": "Archive indicators: risky_member_types (confirmedMalware=false)."
    }
  ],
  "limitations": [
    "Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.",
    "Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.",
    "Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.",
    "Nested archive inspection lists metadata and may inflate only small members within decompression caps.",
    "No paid threat-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/file-security/archive-payload-risk-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "maxArchiveDepth": 2,
  "files": [
    {
      "id": "Z1",
      "filename": "drop.zip",
      "fileBase64": "<base64 document omitted>",
      "source": "Caller-supplied"
    }
  ]
}
JSON

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "reports": [
    {
      "id": "R2",
      "title": "IoC dump",
      "text": "Contact http://203.0.113.50/gate and evil.example domain. Hash aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "indicators": {
    "ips": [
      "203.0.113.50"
    ],
    "urls": [
      "http://203.0.113.50/gate"
    ],
    "domains": [
      "evil.example"
    ],
    "sha256": [
      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
    ],
    "sha1": [],
    "md5": [],
    "emails": []
  },
  "items": [
    {
      "id": "ioc-R2",
      "detector": "malware-indicator-extract",
      "title": "Indicators of compromise extracted",
      "observedFacts": [
        "ips=1",
        "urls=1",
        "domains=1",
        "sha256=1"
      ],
      "inferredThreat": "Extracted network/host/hash indicators may support further investigation if contextually malicious.",
      "confidence": "medium",
      "relatedIds": [
        "R2"
      ],
      "reasons": [
        "ioc_ips",
        "ioc_urls",
        "ioc_domains",
        "ioc_sha256"
      ],
      "evidence": [
        {
          "subject": "R2",
          "fact": "Extracted IoC counts: ips=1, urls=1, domains=1, sha256=1",
          "inference": "IoCs are strings extracted from supplied content; not validated against live threat intel.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied",
      "status": "signal",
      "confirmedMalware": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "fileExecuted": false,
  "networkAccessed": false,
  "confirmedMalwareClaimed": false,
  "malwareFreeNotClaimed": true,
  "findings": [],
  "limitations": [
    "Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.",
    "Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.",
    "Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.",
    "Nested archive inspection lists metadata and may inflate only small members within decompression caps.",
    "No paid threat-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/file-security/malware-indicator-extract" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "reports": [
    {
      "id": "R2",
      "title": "IoC dump",
      "text": "Contact http://203.0.113.50/gate and evil.example domain. Hash aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "source": "Caller-supplied"
    }
  ]
}
JSON