category: Data Enrichment & Threat Intelligence provider: Open Source sectionorder: - Connect - Collect commonfields: id: MalwareBazaar version: -1 configuration: - additionalinfo: This is the API endpoint for the MalwareBazaar API. defaultvalue: https://mb-api.abuse.ch display: Server URL name: url required: true type: 0 section: Connect - displaypassword: API Key hiddenusername: true name: credentials type: 9 required: false section: Connect additionalinfo: Starting June 30th 2025 this parameter is mandatory. - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: A - Completely reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged required: true type: 15 section: Collect #randomly for the pre commit - check for the right section - display: Use system proxy settings name: proxy type: 8 required: false section: Collect #randomly for the pre commit - check for the right section - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Collect #randomly for the pre commit - check for the right section description: MalwareBazaar is a project from abuse.ch with the goal of sharing malware samples with the Infosec community, AV vendors, and threat intelligence providers. display: MalwareBazaar name: MalwareBazaar script: commands: - arguments: - default: true description: A list of SHA256, MD5, or SHA1 hashes of the malware samples you want to query. isArray: true name: file required: true description: Check if a particular malware sample is known to MalwareBazaar. name: file outputs: - contextPath: MalwareBazaar.File.sha256_hash description: SHA256 hash of the malware sample. type: String - contextPath: MalwareBazaar.File.sha3_384_hash description: SHA3-384 hash of the malware sample. type: String - contextPath: MalwareBazaar.File.sha1_hash description: SHA1 hash of the malware sample. type: String - contextPath: MalwareBazaar.File.md5_hash description: MD5 hash of the malware sample. type: String - contextPath: MalwareBazaar.File.first_seen description: Timestamp of when the file was first seen by MalwareBazaar in UTC format. type: Date - contextPath: MalwareBazaar.File.last_seen description: Timestamp of when the file was last seen by MalwareBazaar in UTC format. type: Date - contextPath: MalwareBazaar.File.file_name description: Malware sample's file name. type: String - contextPath: MalwareBazaar.File.file_size description: Malware sample's file size in bytes. type: Number - contextPath: MalwareBazaar.File.file_type_mime description: Malware samples's MIME file type. type: String - contextPath: MalwareBazaar.File.file_type description: Malware sample's file type. type: String - contextPath: MalwareBazaar.File.reporter description: Twitter handle of the report (or anonymous for anonymous submissions). type: String - contextPath: MalwareBazaar.File.origin_country description: Two letter country code of the country where the sample was uploaded from. type: String - contextPath: MalwareBazaar.File.anonymous description: Whether the submission of the sample was anonymous - 1 (true) or 0 (false). type: Number - contextPath: MalwareBazaar.File.signature description: Malware family (if available). type: String - contextPath: MalwareBazaar.File.imphash description: Import hash (imphash) (only available for Portable Executables). type: String - contextPath: MalwareBazaar.File.tlsh description: Trend Micro Locality Sensitive Hash (tlsh). type: String - contextPath: MalwareBazaar.File.telfhash description: Trend Micro ELF Hash (telfhash). type: String - contextPath: MalwareBazaar.File.ssdeep description: The SSDeep hash of the file. type: String - contextPath: MalwareBazaar.File.dhash_icon description: In case the file is a Portable Executable, the dhash of the sample's icon. type: Unknown - contextPath: MalwareBazaar.File.comment description: Comment in the malware sample. type: String - contextPath: MalwareBazaar.File.tags description: List of tags in the malware sample. type: String - contextPath: MalwareBazaar.File.code_sign.subject_cn description: Subject common name (CN). type: String - contextPath: MalwareBazaar.File.code_sign.issuer_cn description: Issuer common name (CN). type: String - contextPath: MalwareBazaar.File.code_sign.algorithm description: Algorithm used. type: String - contextPath: MalwareBazaar.File.code_sign.valid_from description: Datetime from which the code sign was valid. type: Date - contextPath: MalwareBazaar.File.code_sign.valid_to description: Datetime until which the code sign was valid (expiry date). type: Date - contextPath: MalwareBazaar.File.code_sign.serial_number description: Serial number of the code sign. type: String - contextPath: MalwareBazaar.File.code_sign.cscb_listed description: Whether the sample is listed in the Code Signing Certificate Blocklist (CSCB). type: String - contextPath: MalwareBazaar.File.code_sign.cscb_reason description: Code Signing Certificate Blocklist (CSCB) listing reason. type: String - contextPath: MalwareBazaar.File.delivery_method description: How the file was distributed. type: String - contextPath: MalwareBazaar.File.file_information description: Contextual information about the file sample. type: Unknown - contextPath: MalwareBazaar.File.yara_rules.rule_name description: Name of the YARA rule that triggered the malware. type: String - contextPath: MalwareBazaar.File.yara_rules.author description: Author of the YARA rule. type: String - contextPath: MalwareBazaar.File.yara_rules.description description: Description of the YARA rule. type: String - contextPath: MalwareBazaar.File.yara_rules.reference description: Reference of the YARA rule. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.ANY.RUN description: Dynamic malware analysis from ANY.RUN. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.CAPE description: Dynamic malware analysis from CAPE sandbox. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.CERT-PL_MWDB description: Threat intel from CERT.PL Malware database. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.vxCube description: Dynamic malware analysis from Dr.Web vxCube. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.DocGuard description: Office document reputation from DocGuad. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.FileScan-IO description: Malware analysis service from FileScan.IO. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.InQuest Labs description: File reputation service from InQuest Labs. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.Intezer description: Code analysis from Intezer. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.ReversingLabs description: File reputation and intelligence from ReversingLabs TitaniumCloud. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.Spamhaus_HBL description: File reputation from Spamhaus Hash Blocklist (HBL). type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.Triage description: Dynamic malware analysis from Hatching Triage. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.UnpacMe description: Malware unpacking service from UnpacMe. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.VMRay description: Dynamic malware analysis from VMRay. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.YOROI_YOMI description: Dynamic malware analysis from YOROI YOMI. type: Unknown - contextPath: MalwareBazaar.File.comments.id description: Unique ID that identifies this comment. type: String - contextPath: MalwareBazaar.File.comments.date_added description: Timestamp (UTC) of when this comment was made. type: Date - contextPath: MalwareBazaar.File.comments.twitter_handle description: Twitter handle who wrote this comment. type: String - contextPath: MalwareBazaar.File.comments.display_name description: Twitter display name. type: String - contextPath: MalwareBazaar.File.comments.comment description: The comment itself. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Reliability description: The reliability of the vendor. type: String - contextPath: File.MD5 description: MD5 hash of the file submitted for analysis. type: String - contextPath: File.SHA1 description: SHA1 hash of the file submitted for analysis. type: String - contextPath: File.SHA256 description: SHA256 hash of the file submitted for analysis. type: String - contextPath: File.Size description: Size of the file submitted for analysis. type: String - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: String - contextPath: File.Malicious.Description description: For malicious files, the reason that the vendor made the decision. type: String - contextPath: File.Relationships.EntityA description: The source of the relationship. type: string - contextPath: File.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: File.Relationships.Relationship description: The name of the relationship. type: string - contextPath: File.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: File.Relationships.EntityBType description: The type of the destination of the relationship. type: string - arguments: - description: SHA256 hash of the malware sample to download. name: sha256_hash required: true description: Download a malware sample from MalwareBazaar. Any malware sample downloaded from MalwareBazaar is zipped and password protected using the password "infected" (without ""). execution: true name: malwarebazaar-download-sample outputs: - contextPath: File.Size description: The size of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.SHA512 description: The SHA512 hash of the file. type: String - contextPath: File.Name description: The name of the file. type: String - contextPath: File.SSDeep description: The SSDeep hash of the file. type: String - contextPath: File.EntryID description: Entry ID of the file. type: String - contextPath: File.Info description: Information about the file. type: String - contextPath: File.Type description: The file type. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.Extension description: The extension of the file. type: String - arguments: - description: SHA256 hash of the malware sample to add a comment. name: sha256_hash required: true - description: The comment to add to the sample. name: comment required: true description: Add a comment for a malware sample. name: malwarebazaar-comment-add outputs: - contextPath: MalwareBazaar.MalwarebazaarCommentAdd.sha256_hash description: SHA256 hash of given file. type: String - contextPath: MalwareBazaar.MalwarebazaarCommentAdd.comment description: The comment that was added to the malware sample. type: String - arguments: - auto: PREDEFINED description: Type of the sample. name: sample_type predefined: - tag - signature - file_type - clamav - imphash - yara_rule - issuer_cn required: true - description: Value of the sample selected. name: sample_value required: true - description: Maximum number of results to return. Default is 1000. Note that when using the issuer_cn argument, all relevant results will display (maximum 100). name: limit - description: Page number to view. Each page contains page_size values. Must be used along with the page_size argument. name: page - description: Number of results per page to display. name: page_size description: Retrieves a list of recent malware samples (maximum 1000) associated with a specific sample type. Note that you can either use the limit argument or the page and page_size argument. name: malwarebazaar-samples-list outputs: - contextPath: MalwareBazaar.MalwarebazaarSamplesList.sha256_hash description: SHA256 hash of the malware sample. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.sha3_384_hash description: SHA3-384 hash of the malware sample. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.sha1_hash description: SHA1 hash of the malware sample. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.md5_hash description: MD5 hash of the malware sample. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.first_seen description: Timestamp of when the file was first seen by MalwareBazaar (UTC). type: Date - contextPath: MalwareBazaar.MalwarebazaarSamplesList.last_seen description: Timestamp of when the file was last seen by MalwareBazaar (UTC). type: Date - contextPath: MalwareBazaar.MalwarebazaarSamplesList.file_name description: Malware sample's file name. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.file_size description: File size in bytes. type: Number - contextPath: MalwareBazaar.MalwarebazaarSamplesList.file_type_mime description: MIME file type. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.file_type description: File type. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.reporter description: Twitter handle of the report (or anonymous for anonymous submissions). type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.anonymous description: Whether the submission of the sample was anonymous - 1 (true) or 0 (false). type: Number - contextPath: MalwareBazaar.MalwarebazaarSamplesList.signature description: Malware family (if available). type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.imphash description: Import hash (imphash) of the sample (only available for Portable Executables). type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.tlsh description: Trend Micro Locality Sensitive Hash (tlsh) of the sample. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.telfhash description: Trend Micro ELF Hash (telfhash) of the sample. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.ssdeep description: The SSDeep hash of the sample. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.dhash_icon description: 'In case the file is a Portable Executable, the dhash of the samples icon.' type: Unknown - contextPath: MalwareBazaar.MalwarebazaarSamplesList.tags description: List of tags. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.subject_cn description: Subject common name (CN). type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.issuer_cn description: Issuer common name (CN). type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.algorithm description: Algorithm used. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.valid_from description: Datetime from which the code sign was valid. type: Date - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.valid_to description: Datetime until which the code sign was valid (expiry date). type: Date - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.serial_number description: Serial number of the code sign. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.cscb_listed description: Whether the sample is listed in the Code Signing Certificate Blocklist (CSCB). type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.cscb_reason description: Code Signing Certificate Blocklist (CSCB) listing reason. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.intelligence.clamav description: List of ClamAV detections (official and unofficial rules). type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.intelligence.downloads description: Number of downloads from MalwareBazaar. type: Number - contextPath: MalwareBazaar.MalwarebazaarSamplesList.intelligence.uploads description: Number of uploads to MalwareBazaar. type: Number - contextPath: MalwareBazaar.MalwarebazaarSamplesList.intelligence.mail description: Indicates if this malware sample has been seen in global spam traffic. type: String dockerimage: demisto/python3:3.12.13.10116658 runonce: false script: '-' subtype: python3 type: python tests: - MalwareBazaar_Test fromversion: 6.0.0