What this endpoint does

Retrieves full sandbox analysis reports for a specific malware sample identified by its SHA-256 hash. Both the sha256 parameter (identifying the sample) and a query parameter (using the Malware Intelligence query language to filter which analysis runs to include) are required. A typical workflow is to first use the Malware Intelligence: Query endpoint to discover sample hashes matching behavioral criteria, then use this endpoint to retrieve detailed sandbox reports for a specific sample. The same sample may have been analyzed under multiple behavioral profiles (e.g., behavioral1, behavioral2, behavioral3), and reports are returned ordered by highest sandbox score first. Use the limit parameter (1-10, default 1) to control how many reports are returned. For natural language queries to find samples, use the Malware Intelligence: Query Natural Language endpoint; for IOC-based lookups, use the Malware Intelligence: Query by IOCs endpoint.

Response data

Each report contains comprehensive sandbox analysis results organized into sections: dynamic includes runtime behavior (network flows with destination IPs and ports, DNS requests and responses, HTTP request sequences, process trees with command lines, triggered behavioral signatures with MITRE ATT&CK TTP mappings and severity scores, extracted malware configurations including C2 servers and encryption keys, and dropped files with hashes); static includes file hashes, size, extensions, and static analysis signatures; sample provides submission metadata including the sandbox score and MITRE tactic tags; and pe (for Windows executables) includes imports, exports, sections, digital signatures, and the import hash. The metadata section contains industry and sector classifications when available.