What this endpoint does

Downloads the original file that was submitted for sandbox analysis — the actual malware sample or suspicious file in its unmodified binary form. Only available for file-type submissions; URL submissions have no downloadable original file (check the kind field via Sandbox: Get Sample). Get your sampleID from Sandbox: Submit Sample or Sandbox: Search. Files must complete initial processing before downloads become available.

Response data

Returns the raw binary content of the originally submitted file as application/octet-stream — the file is returned in its original form without compression or encryption. Handle with care: this is the original potentially malicious file. A 404 with error code NOT_AVAILABLE means the file hasn't finished processing yet; NOT_FOUND means the sample ID doesn't exist.