{"uid":"cap_ynEpGSSv540nPM8lSFNCC","slug":"sitecheck-web-intel-malwarebazaar-file-hash-lookup-75d8e959","name":"SiteCheck Web Intel – MalwareBazaar File Hash Lookup","description":"Looks up a file hash (SHA-256, SHA-1 or MD5) in abuse.ch MalwareBazaar: whether the sample is known, its other hashes, file name, type, size, signature (malware family), first/last seen, reporter, origin country, delivery method, tags, download count and code-signing info. Metadata only; the sample itself is never downloaded.","url":"https://api.webintel-api.workers.dev/api/security/malbazaar-samples?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["hash"],"properties":{"hash":{"type":"string","description":"SHA-256 (64 hex), SHA-1 (40 hex) or MD5 (32 hex) of the file (required)"},"sha256":{"type":"string","description":"Same as hash (older name)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_p3KvLmTAXtlWhX3C9R9kH","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Looks up a file hash (SHA-256, SHA-1, or MD5) in abuse.ch MalwareBazaar and returns full metadata about the malware sample, including hashes, malware family, file type, first/last seen, tags, and delivery method — without downloading the sample.","exampleAgentPrompt":"Can you check if the file hash 44d88612fea8a8f36de82e1278abb02f is known malware — look it up in MalwareBazaar and tell me the malware family, file type, when it was first seen, and how it was delivered?","exampleUseCases":[{"title":"Malware triage for suspicious download","prompt":"I found a suspicious executable on one of our servers — its SHA-256 is 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f. Can you look it up in MalwareBazaar and tell me the malware family, delivery method, and when it was first reported?"},{"title":"Incident response enrichment","prompt":"We just got an alert with an MD5 hash of 44d88612fea8a8f36de82e1278abb02f. Can you pull everything MalwareBazaar knows about it — origin country, reporter, tags, any code-signing info?"},{"title":"Threat intel feed validation","prompt":"Our threat feed flagged a SHA-1 hash of da39a3ee5e6b4b0d3255bfef95601890afd80709 as malicious. Can you verify it against MalwareBazaar and confirm whether it's a known sample, what type of file it is, and what malware family it belongs to?"}],"resultDescription":"Returns metadata about the matching malware sample from MalwareBazaar: all hash variants (SHA-256, SHA-1, MD5), file name, file type, file size, malware family/signature, first seen and last seen timestamps, reporter, origin country, delivery method, associated tags, download count, and code-signing information. The actual file binary is never returned.","failureModes":["Hash not found in MalwareBazaar — sample is unknown or clean","Invalid hash format (wrong length or non-hex characters) — request rejected","MalwareBazaar API unavailable — upstream timeout or outage","Malformed hash parameter — missing or empty 'hash' query param returns error","Rate limiting or payment failure for the $0.002 per-call fee"],"whenToPreferThis":"Choose this endpoint when you need fast, structured malware metadata for a specific file hash without downloading the sample. It is ideal for triage, incident response enrichment, and threat intelligence workflows where you already have a hash and want to check against the community-maintained MalwareBazaar database. Prefer this over general VirusTotal-style endpoints when the primary need is abuse.ch community data including reporter, delivery method, and origin country attribution.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-25T12:31:19.211Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-malwarebazaar-file-hash-lookup-75d8e959"}