{"uid":"cap_plCVRANvXvtRBs31CKkWG","slug":"sicher-hash-reputation-lookup-f8bc4e8d","name":"Sicher Hash Reputation Lookup","description":"Queries three abuse.ch metadata services for an MD5, SHA-1 or SHA-256 value. It reports known malware metadata, associated ThreatFox indicators, and URLhaus payload provenance, then derives a conservative known-malicious or unknown verdict. No endpoint for sample retrieval is called and no binary is downloaded. A missing record means unknown to these sources, not proven benign. VirusTotal is deliberately not used because its public terms do not permit redistribution in this paid product.","url":"https://sicher.halowerk.com/v1/hash-reputation?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"hash":{"type":"string","pattern":"^[A-Fa-f0-9]+$","maxLength":64,"minLength":32,"description":"MD5, SHA-1 or SHA-256 digest."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_uj283kske-P8IaQIE80da","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Queries abuse.ch MalwareBazaar, ThreatFox, and URLhaus to determine whether a file hash (MD5, SHA-1, or SHA-256) is associated with known malware, returning a consolidated known-malicious or unknown verdict.","exampleAgentPrompt":"Can you check whether the SHA-256 hash 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f is known malware? Query MalwareBazaar, ThreatFox, and URLhaus and give me the verdict.","exampleUseCases":[{"title":"Malware triage during incident response","prompt":"We found a suspicious file on a compromised host with SHA-256 hash 3395856ce81f2b7382dee72602f798b642f14d0. Check if it's known malware — pull MalwareBazaar, ThreatFox, and URLhaus metadata and tell me the verdict."},{"title":"CI/CD pipeline artifact integrity check","prompt":"Before we deploy, check this build artifact: its MD5 is d41d8cd98f00b204e9800998ecf8427e. Has it shown up in any abuse.ch malware databases? I need to know if it's flagged as malicious or just unknown."},{"title":"Threat intel enrichment for SOC alert","prompt":"We got an alert with a file hash — SHA-1 is da39a3ee5e6b4b0d3255bfef95601890afd80709. Can you enrich this with abuse.ch threat intelligence and tell me whether ThreatFox or URLhaus have any associated indicators?"}],"resultDescription":"Returns malware metadata from MalwareBazaar (file type, tags, first seen), ThreatFox indicator associations (threat actor, malware family, confidence), and URLhaus payload provenance (URLs that distributed the file), plus a synthesized verdict of 'known-malicious' or 'unknown'. A missing record means the hash is unknown to these sources, not proven benign.","failureModes":["Hash not found in any abuse.ch source — returns 'unknown' verdict, not an error","Invalid hash format (wrong length or non-hex characters) — returns validation error","Upstream abuse.ch API unavailable — service may return 503 or timeout","Ambiguous verdict when sources disagree — conservative approach defaults to known-malicious if any source flags it"],"whenToPreferThis":"Choose this endpoint when you need a privacy-respecting, redistribution-safe file hash reputation check that aggregates MalwareBazaar, ThreatFox, and URLhaus without VirusTotal (whose public terms prohibit redistribution in commercial products). Ideal for SOC automation, CI/CD pipelines, and threat enrichment workflows where you want abuse.ch-specific intelligence without downloading binaries or triggering sample retrieval.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-10T06:39:21.639Z","isFirstParty":false,"canonicalSlug":"sicher-hash-reputation-lookup-f8bc4e8d"}