What this endpoint does

Retrieves the static analysis report for a sample — file metadata, hashes, PE structure, YARA signature matches, and discovered/unpacked files, all without requiring behavioral execution to complete. Available within seconds of submission, making it useful for quick triage before behavioral results are ready. Use the static1 task ID convention. Get your sampleID from Sandbox: Submit Sample or Sandbox: Search. For behavioral analysis (process trees, network activity, extracted configs), use Sandbox: Get Dynamic Report. For a combined view of all findings, use Sandbox: Get Sample Overview.

Response data

Returns static analysis findings — what can be determined about a file without executing it. The analysis.score gives an initial maliciousness verdict based on YARA rules and file characteristics alone. The files array is the key section: it lists every file discovered during static unpacking (archives, embedded executables, nested payloads) with all hash types computed, plus which file was selected for behavioral analysis. The signatures array shows YARA and static detection rule matches. The extracted array may contain malware configurations decoded from static patterns. Use the hashes from this report to pivot into Recorded Future's core intelligence API for broader threat context.