What this endpoint does

Downloads a specific file artifact collected during sandbox behavioral analysis — dropped files, extracted payloads, or configuration data dumped by the sample during execution. To find available files, call Sandbox: Get Dynamic Report and look at the dumped array. Each entry has a name like files/0x0006000000015d50-4.dat — strip the files/ prefix to get the fileName parameter. Only files with the files/ prefix are downloadable here; memory/ dumps return 404 and must be retrieved via Sandbox: Download Archive (TAR) or Sandbox: Download Archive (ZIP) instead.

Response data

Returns the raw binary content of the dumped file as application/octet-stream. These are artifacts the malware created, extracted, or dropped during execution — they may be malicious payloads, decoded configurations, or extracted resources. Handle with appropriate caution. Content type varies by what the malware produced (could be PE executables, scripts, JSON configs, etc.).