What this endpoint does

Downloads a specific file artifact collected during sandbox behavioral analysis — dropped files, extracted payloads, or configuration data dumped by the sample during execution. To find available files, call Sandbox: Get Dynamic Report and look at the dumped array. Each entry has a name like files/0x0006000000015d50-4.dat — strip the files/ prefix to get the fileName parameter. Only files with the files/ prefix are downloadable here; memory/ dumps return 404 and must be retrieved via Sandbox: Download Archive (TAR) or Sandbox: Download Archive (ZIP) instead.

Response data

Returns the raw binary content of the dumped file as application/octet-stream. These are artifacts the malware created, extracted, or dropped during execution — they may be malicious payloads, decoded configurations, or extracted resources. Handle with appropriate caution. Content type varies by what the malware produced (could be PE executables, scripts, JSON configs, etc.).

200Binary file content.

404Sample/task/file not found.