YARAify Community API

https://yaraify.abuse.ch/api/
Admin
YARAify Community API is a free malware scanning service that scans files against YARA and ClamAV...
Tokens:26,114
Snippets:75
Trust Score:10
Update:6 months ago
Show doc for...
Tokens:
Raw
### POST /api/v1/

Source: https://yaraify.abuse.ch/api

Query the Yaraify API to get a list of files matching a specific YARA rule.

```APIDOC
## POST /api/v1/

### Description
Retrieves a list of recent files that match a specific YARA rule.

### Method
POST

### Endpoint
https://yaraify-api.abuse.ch/api/v1/

### Parameters
#### Request Body
- **query** (string) - Required - The query type, must be "get_yara".
- **search_term** (string) - Required - The YARA rule name to search for.
- **result_max** (integer) - Optional - Max number of results to display (default: 25, max: 1000).

### Request Example
{
  "query": "get_yara",
  "search_term": "MALWARE_Win_Neshta"
}

### Response
#### Success Response (200)
- **query_status** (string) - Status of the query.
- **query_info** (object) - Metadata about the search results.
- **data** (array) - List of file objects matching the YARA rule.

#### Response Example
{
  "query_status": "ok",
  "query_info": {
    "search_scope": "all time",
    "result_count": 13,
    "result_max": 500
  },
  "data": [
    {
      "sha256_hash": "5e3834ebbd42dbdbe6251efbf12869b3a70880f3535765ad8109b458543c8b2e",
      "file_size": 792412,
      "mime_type": "application/x-dosexec",
      "md5_hash": "37fe12185eceac065501e65ba3851463",
      "sha1_hash": "d29f33a7d26b7d7253e07bc7517779076a5b021f",
      "first_seen": "2022-04-15 08:24:20 UTC",
      "sightings": 1
    }
  ]
}
```

--------------------------------

### Obtain Auth-Key using curl

Source: https://yaraify.abuse.ch/api

This example demonstrates how to include the required 'Auth-Key' header in a curl request to interact with the YARAify API.

```bash
curl -H "Auth-Key: YOUR-AUTH-KEY" -X POST -d '{ "query": "get_results", "task_id": "fb2763e9-7b84-11ec-9f01-42010aa4000b" }' https://yaraify-api.abuse.ch/api/v1/
```

--------------------------------

### YARA Rule Meta Field Example

Source: https://yaraify.abuse.ch/api

This is an example of a UUID format required for the 'yarahub_uuid' meta field when deploying a YARA rule. Ensure all required meta fields are correctly formatted.

```text
__ 88e20464-0a56-46aa-8c34-336a0e976745
```

--------------------------------

### API Response for Listing Tasks

Source: https://yaraify.abuse.ch/api

This is an example of the JSON response when querying for tasks associated with an identifier. It includes task details like ID, status, and file hashes.

```json
{
"query_status": "ok",
"data": [
  {
      "task_id": "9b91e5d3-7b7e-11ec-9f01-42010aa1000b",
      "task_status": "processed",
      "md5_hash": "83fdeaf19ae60e26dd0b53ab74a66f55",
      "sha256_hash": "65104ef88eb6e5e0416a33fe16709450ff79b3698266b9ce96af3d848cf44c48",
      "file_name": "dropped.dll"
  },
  {
      "task_id": "3b895428-7b7e-11ec-9f01-62010aa4000b",
      "task_status": "processed",
      "md5_hash": "3677819a63a436c7d90d01e8fab38eb6",
      "sha256_hash": "2c4591542b85eb8601213322454ba4aabc683ae03b70a8244436895575732be8",
      "file_name": "evil.dll"
  },
  {
      "task_id": "7b817a16-7b7e-12ec-9f01-02010aa4000b",
      "task_status": "processed",
      "md5_hash": "fd5c9eaf79bb0abe8372364553933215",
      "sha256_hash": "09a7c4f3878793169f3a1c2467a1c160534255b5d0ca13db6b4c5c4178ef3379",
      "file_name": "emotet_sample.exe"
  }
]
}
```

--------------------------------

### GET /download/yaraify-rules.zip

Source: https://yaraify.abuse.ch/api

Downloads a bulk archive of all public YARA rules available on YARAhub.

```APIDOC
## GET /download/yaraify-rules.zip

### Description
Downloads a bulk archive of all public YARA rules available on YARAhub. Note: The file is generated every 5 minutes.

### Method
GET

### Endpoint
https://yaraify-api.abuse.ch/download/yaraify-rules.zip
```

--------------------------------

### API Response Structure

Source: https://yaraify.abuse.ch/api

Example of the JSON response returned by the API, containing query status, metadata, and a list of matching file objects.

```json
{
    "query_status": "ok",
    "query_info": {
        "search_scope": "all time",
        "result_count": 64,
        "result_max": 250
    },
    "data": [
        {
            "sha256_hash": "0278236466b0915e5b5fb228033a46c7ed1d9f29ce07f5784b3746e8ea64fadb",
            "file_size": 1750234,
            "mime_type": "application\/x-dosexec",
            "md5_hash": "77bfdf73e32b496bb9f111c304b8fb95",
            "sha1_hash": "8a88235b7bc5a8e4cc233532e4011b2fae4ac257",
            "sha3_384_hash": "f9826bdc674c19a3867a3b1d78c0ba1897303d70eb7ed5eaa6755bed3f368caaaea9543bd84ea66b086b653b1e23b2dd",
            "first_seen": "2022-04-14 10:23:53 UTC",
            "last_seen": null,
            "sightings": 1,
            "imphash": "680b9682922177224183342c299d809f",
            "ssdeep": "24576:nKtpZm23yqec9S5hZqT5\/ZMoK3EHBCTFvfrr+E+OLzO9AO4k17vvoA+rXBxQHKbC:nC3LoqNG0HBi1X+5OmmPA7Hj+hb",
            "tlsh": "T193859E62AE9D4876C076363C8C1F6259A8297E103D289C5E67E80D0DCF3A7917F2539F",
            "telfhash": null,
            "gimphash": null,
            "dhash_icon": "399998ecd4d46c0e"
        },
        {
            "sha256_hash": "72011546699b21166467da8d7bd37ff0d96717288519f3fad8c19750e39aca42",
            "file_size": 1771258,
            "mime_type": "application\/x-dosexec",
            "md5_hash": "59f2c99f52c368a923c74621d8b4e6fd",
            "sha1_hash": "fe5e0f5cf0ebd90e17034483eb9a902dd5cdd7bc",
            "sha3_384_hash": "8038039ec77602fbfe8ac922a7e1509c42dcbf6f07713af294df84c780b438e9b85181eab199ed8bcc70bba259bb18be",
            "first_seen": "2022-04-14 10:17:43 UTC",
            "last_seen": null,
            "sightings": 1,
            "imphash": "680b9682922177224183342c299d809f",
            "ssdeep": "24576:nKtpZm23yqec9S5hZqT5\/ZMoK3EHBCTFvfrr+E+OLzO9AO4k17vvoA+rXBxQHKbC:nC3LoqNG0HBi1X+5OmmPA7Hj+hb",
            "tlsh": "T1AE859E62AE9D4876C076363C8C1F6259A8297E103D289C5E67E80D0DCF3A7917F2539F",
            "telfhash": null,
            "gimphash": null,
            "dhash_icon": "399998ecd4d46c0e"
        },
        {
            "sha256_hash": "cb36a871888de7f8de75a2e0204526e07429390e9a15a7031406c9d3c2ee2207",
            "file_size": 1747228,
            "mime_type": "application\/x-dosexec",
            "md5_hash": "825b058531390b5c602b02353a5fa550",
            "sha1_hash": "09b9844ff84985cba76060b8f982060287b77fde",
            "sha3_384_hash": "7e376e7c47642c0729d87337696e3b1940c91b0cd410668d642f37a8a492e7502d0daeda56529a710fa0f81a09aecf38",
            "first_seen": "2022-04-13 19:52:33 UTC",
            "last_seen": null,
            "sightings": 1,
            "imphash": "680b9682922177224183342c299d809f",
            "ssdeep": "24576:nKtpZm23yqec9S5hZqT5\/ZMoK3EHBCTFvfrr+E+OLzO9AO4k17vvoA+rXBxQHKbC:nC3LoqNG0HBi1X+5OmmPA7Hj+hb",
            "tlsh": "T1F3859E62AE9D4876C076363C8C1F6259A8297E103D289C5E67E80D0DCF3A7917F2539F",
            "telfhash": null,
            "gimphash": null,
            "dhash_icon": "399998ecd4d46c0e"
        }
        [...]
}
```

--------------------------------

### API Response Structure

Source: https://yaraify.abuse.ch/api

Example JSON response returned by the gimphash query endpoint.

```json
{
    "query_status": "ok",
    "query_info": {
        "search_scope": "all time",
        "result_count": 1,
        "result_max": 25
    },
    "data": [
        {
            "sha256_hash": "631fc8da17bc3eb84718969a48b679237165887baede146faba6df842c80ab5c",
            "file_size": 7053280,
            "mime_type": "application\/x-dosexec",
            "md5_hash": "132a961afc5b7846f72c5944798535f6",
            "sha1_hash": "5ff9a26cba1baa65d34dd53cd9b7913b8e524570",
            "sha3_384_hash": "9404fba96909631807b2821f17a21d6315ec5f068b0c146a5cb7c58b073d7462374f44080f4ba5e255d130e0de981a72",
            "first_seen": "2022-07-02 09:24:03 UTC",
            "last_seen": "2022-07-02 12:26:15 UTC",
            "sightings": 2,
            "imphash": "c7269d59926fa4252270f407e4dab043",
            "ssdeep": "98304:lcjs3aEh2qJechqerH0KCYXidWPpTuEVtTZtWAI4AmnXTj+q+c6q1:28dqcp0KC8iMBLvTZkAI\/m\/+cF1",
            "tlsh": "T12C668D43F89560E9C6EAD130CA75C2527B307888073027D36F65AABA6B73BD05FB9750",
            "telfhash": null,
            "gimphash": "a081e2fab5999d99ed6be718af55e93df171d14bc83c7ca5fdc0907edba0d338",
            "dhash_icon": null
        }
    ]
}
```

--------------------------------

### Yaraify API Response Example

Source: https://yaraify.abuse.ch/api

This is a sample JSON response from the Yaraify API when querying for YARA rule matches. It includes query status, information about the search, and a list of matching file data, such as SHA256 hash, file size, and first seen date.

```json
{
    "query_status": "ok",
    "query_info": {
        "search_scope": "all time",
        "result_count": 13,
        "result_max": 500
    },
    "data": [
        {
            "sha256_hash": "5e3834ebbd42dbdbe6251efbf12869b3a70880f3535765ad8109b458543c8b2e",
            "file_size": 792412,
            "mime_type": "application\/x-dosexec",
            "md5_hash": "37fe12185eceac065501e65ba3851463",
            "sha1_hash": "d29f33a7d26b7d7253e07bc7517779076a5b021f",
            "sha3_384_hash": "24f01256c2587cced649065378fd982298152ab5685d9f4c741c2cecd77a35ed3f878d69f65ef801640fb85aee071474",
            "first_seen": "2022-04-15 08:24:20 UTC",
            "last_seen": null,
            "sightings": 1,
            "imphash": "43fd39eb6df6bf3a9a3edd1f646cd16e",
            "ssdeep": "12288:PGXqG\/H1k6hUvoNUrIE33T5zTTlL9O3ZO6epkflNaGD0u74tt+3hJLGgFqLM:PZwk6hUv\/sEnnL6zLaGD46LLGng",
            "tlsh": "T138F423C1EB53E7E1C8EF4D38920FFB6546642102AE00095779E68E58BDFC3B2335568A",
            "telfhash": null,
            "gimphash": null,
            "dhash_icon": null
        },
        {
            "sha256_hash": "b9807ee941907647ce285fab2687e4796f7f3c76afc5c8c9c141ca3568fcf87a",
            "file_size": 1576960,
            "mime_type": "application\/x-dosexec",
            "md5_hash": "9161ee3cf96fda13ca70d450705b9002",
            "sha1_hash": "3f97d7d2fe39c0f0cddfa89a3f4066bf0d3bdb4b",
            "sha3_384_hash": "3734b149a09675adcb26c8775083dcd5ca037797c6e6262d6c89d19de6eeff8f731e6e71e80b20e515b4af35f5f7c39e",
            "first_seen": "2022-04-14 20:54:31 UTC",
            "last_seen": "2022-04-14 20:54:31 UTC",
            "sightings": 2,
            "imphash": null,
            "ssdeep": "24576:JB4gDb100oLvVt8LfdCIGCYNoMJcsfU4uat4fo\/lG4HfOvN8zOkik9eZ:TjnJMnU4u8lG42KzOkikw",
            "tlsh": "T18B75AE23E54280FDD65820316CBB7F3ABDB497595A24CA83A7E8DE791F32251932730D",
            "telfhash": null,
            "gimphash": null,
            "dhash_icon": "7171717169e8e8e8"
        },
        {
            "sha256_hash": "1d580d9f99a387f0735bde436955d7595dfb4f7c41fc9968cc1aa78734fa4d2a",
            "file_size": 1578496,
            "mime_type": "application\/x-dosexec",
            "md5_hash": "ea3f7b921ceca64d2100850cbef4aa55",
            "sha1_hash": "9b09dc4da34863ab96cad9ed4cf53e0d7b87ffef",
            "sha3_384_hash": "bcd24af5bd6a1b2602ca5916e0453f2f4a2f8543281051fd3bc3cd227d4cd8fb10b5c7cc1daa8cbd36162f7b13671bf2",
            "first_seen": "2022-04-12 16:15:34 UTC",
            "last_seen": null,
            "sightings": 1,
            "imphash": null,
            "ssdeep": "24576:T4gDb100oLvVt8LfdCIGCYNoMJcsfU4uat4fo\/lG4HfOvN8QOkik9eZ:TjnJMnU4u8lG42KQOkikw",
            "tlsh": "T1AE75AE23E54280FDD65820316CBB7F3ABDB497595A24CA83A7E8DE791F32251932730D",
            "telfhash": null,
            "gimphash": null,
            "dhash_icon": "7171717169e8e8e8"
        },
        [...]
}

```

--------------------------------

### API response structure

Source: https://yaraify.abuse.ch/api

Example of the JSON response returned by the YARAify API, containing file metadata and scan results.

```json
{
    "query_status": "ok",
    "data": {
        "metadata": {
            "file_size": 792372,
            "file_type_mime": "application\/x-dosexec",
            "first_seen": "2022-01-22 19:24:01 UTC",
            "last_seen": "2022-01-23 14:52:44 UTC",
            "sightings": 11,
            "sha256_hash": "de7fa65d5cd5314ba0ce6ab19a7dcd9853639a1152447457de7efb39a9ba1f46",
            "md5_hash": "b0bb095dd0ad8b8de1c83b13c38e68dd",
            "sha1_hash": "cc597480e2f833f48e67ec75cd2c41547ceeb04c",
            "sha3_384": "21527985085b570a8c429df8f3e8cfc0da5664b605c641d05a1f09692539a1d51deac5d60622290ee86fdd9b250dcf4e",
            "imphash": null,
            "ssdeep": null,
            "tlsh": null,
            "telfhash": null,
            "gimphash": null,
            "dhash_icon": null
        },
        "tasks": [
            {
                "task_id": "1f3da23c-7c5c-11ec-9f01-42010aa4000b",
                "time_stamp": "2022-01-23 14:52:44 UTC",
                "file_name": "b0bb095dd0ad8b8de1c83b13c38e68dd.exe",
                "task_parameters": {
                    "clamav_scan": 1,
                    "unpack": 1,
                    "share_file": 1
                },
                "unpacked_files_cnt": "2",
                "clamav_results": [
                    "PUA.Win.Packer.Upx-4",
                    "Win.Dropper.Gh0stRAT-9789289-0",
                    "Win.Dropper.Gh0stRAT-9789290-0",
                    "Win.Malware.FlyAgent-9850229-1",
                    "Win.Malware.Zusy-5710245-0"
                ],
                "static_results": [
                    {
                        "rule_name": "pe_imphash",
                        "author": null,
                        "description": null,
                        "reference": null,
                        "yarahub_uuid": null,
                        "tlp": "WHITE"
                    },
                    {
                        "rule_name": "Skystars_Malware_Imphash",
                        "author": "Skystars LightDefender",
                        "description": "imphash",
                        "reference": null,
                        "yarahub_uuid": null,
                        "tlp": "WHITE"
                    }
                ],
                "unpack_results": [
                    {
                        "unpacked_file_name": "10000000.dll",
                        "unpacked_md5": "d87f7e2caa4e48c3f98d352a9e087ab8",
                        "unpacked_sha256": "8c7236d27b8dbaffcd64d9b5155e8c416f33102604ab27076d32c321681ae5c3",
                        "unpacked_yara_matches": [
                            {
                                "rule_name": "xxx",
                                "author": "xxx",
                                "description": "xxx",
                                "reference": "xxx",
                                "yarahub_uuid": "xxx",
                                "tlp": "GREEN"
                            },
                            {
                                "rule_name": "win_younglotus_auto",
                                "author": "Detects win.younglotus.",
                                "description": null,
                                "reference": "Felix Bilstein - yara-signator at cocacoding dot com",
                                "yarahub_uuid": null,
                                "tlp": "WHITE"
                            },
                            {
                                "rule_name": "MALWARE_Win_Zegost",
                                "author": "Detects Zegost",
                                "description": null,
                                "reference": "ditekSHen",
                                "yarahub_uuid": null,
                                "tlp": "WHITE"
                            }
                        ]
                    },
                    {
```

--------------------------------

### YARA Rule Response Example

Source: https://yaraify.abuse.ch/api

This JSON structure represents a typical response when querying for recent YARA rules. It includes metadata such as timestamps, rule names, authors, and licensing information.

```json
{
    "query_status": "ok",
    "data": [
        {
            "time_stamp": "2022-05-01 08:10:52 UTC",
            "yarahub_uuid": "1b95ce79-6034-4740-8e45-5f0840602d1a",
            "rule_name": "win_danabot",
            "author": "Johannes Bader",
            "description": "detects DanaBot",
            "date": "2022-04-19",
            "yarahub_license": "CC BY-SA 4.0",
            "yarahub_author_twitter": "@viql",
            "yarahub_reference_link": "https:\/\/test.ch\/bla",
            "yarahub_reference_md5": "8195d9c7b7193e9c63137d156df7b6f3",
            "yarahub_rule_matching_tlp": "TLP:WHITE",
            "yarahub_rule_sharing_tlp": "TLP:WHITE",
            "malpedia_family": "win.danabot"
        },
        [...]
    ]
}

```

--------------------------------

### Scan File with Python (Basic)

Source: https://yaraify.abuse.ch/api

A basic Python script using the 'requests' library to submit a file for scanning via the YARAify API. Ensure 'sample.exe' exists in the same directory.

```python
#!/usr/bin/env python3
import requests
import json

files = {
    'file': (open('sample.exe','rb'))
}
response = requests.post('https://yaraify-api.abuse.ch/api/v1/', files=files, verify=True)
print(response.content.decode("utf-8", "ignore"))
        
```

--------------------------------

### API Response Structure

Source: https://yaraify.abuse.ch/api

Example of the JSON response returned by the API when querying for a ClamAV signature.

```json
{
    "query_status": "ok",
    "query_info": {
        "search_scope": "all time",
        "result_count": 13,
        "result_max": 500
    },
    "data": [
        {
            "sha256_hash": "5e3834ebbd42dbdbe6251efbf12869b3a70880f3535765ad8109b458543c8b2e",
            "file_size": 792412,
            "mime_type": "application\/x-dosexec",
            "md5_hash": "37fe12185eceac065501e65ba3851463",
            "sha1_hash": "d29f33a7d26b7d7253e07bc7517779076a5b021f",
            "sha3_384_hash": "24f01256c2587cced649065378fd982298152ab5685d9f4c741c2cecd77a35ed3f878d69f65ef801640fb85aee071474",
            "first_seen": "2022-04-15 08:24:20 UTC",
            "last_seen": null,
            "sightings": 1,
            "imphash": "43fd39eb6df6bf3a9a3edd1f646cd16e",
            "ssdeep": "12288:PGXqG\/H1k6hUvoNUrIE33T5zTTlL9O3ZO6epkflNaGD0u74tt+3hJLGgFqLM:PZwk6hUv\/sEnnL6zLaGD46LLGng",
            "tlsh": "T138F423C1EB53E7E1C8EF4D38920FFB6546642102AE00095779E68E58BDFC3B2335568A",
            "telfhash": null,
            "gimphash": null,
            "dhash_icon": null
        },
        {
            "sha256_hash": "b9807ee941907647ce285fab2687e4796f7f3c76afc5c8c9c141ca3568fcf87a",
            "file_size": 1576960,
            "mime_type": "application\/x-dosexec",
            "md5_hash": "9161ee3cf96fda13ca70d450705b9002",
            "sha1_hash": "3f97d7d2fe39c0f0cddfa89a3f4066bf0d3bdb4b",
            "sha3_384_hash": "3734b149a09675adcb26c8775083dcd5ca037797c6e6262d6c89d19de6eeff8f731e6e71e80b20e515b4af35f5f7c39e",
            "first_seen": "2022-04-14 20:54:31 UTC",
            "last_seen": "2022-04-14 20:54:31 UTC",
            "sightings": 2,
            "imphash": null,
            "ssdeep": "24576:JB4gDb100oLvVt8LfdCIGCYNoMJcsfU4uat4fo\/lG4HfOvN8zOkik9eZ:TjnJMnU4u8lG42KzOkikw",
            "tlsh": "T18B75AE23E54280FDD65820316CBB7F3ABDB497595A24CA83A7E8DE791F32251932730D",
            "telfhash": null,
            "gimphash": null,
            "dhash_icon": "7171717169e8e8e8"
        },
        {
            "sha256_hash": "1d580d9f99a387f0735bde436955d7595dfb4f7c41fc9968cc1aa78734fa4d2a",
            "file_size": 1578496,
            "mime_type": "application\/x-dosexec",
            "md5_hash": "ea3f7b921ceca64d2100850cbef4aa55",
            "sha1_hash": "9b09dc4da34863ab96cad9ed4cf53e0d7b87ffef",
            "sha3_384_hash": "bcd24af5bd6a1b2602ca5916e0453f2f4a2f8543281051fd3bc3cd227d4cd8fb10b5c7cc1daa8cbd36162f7b13671bf2",
            "first_seen": "2022-04-12 16:15:34 UTC",
            "last_seen": null,
            "sightings": 1,
            "imphash": null,
            "ssdeep": "24576:T4gDb100oLvVt8LfdCIGCYNoMJcsfU4uat4fo\/lG4HfOvN8QOkik9eZ:TjnJMnU4u8lG42KQOkikw",
            "tlsh": "T1AE75AE23E54280FDD65820316CBB7F3ABDB497595A24CA83A7E8DE791F32251932730D",
            "telfhash": null,
            "gimphash": null,
            "dhash_icon": "7171717169e8e8e8"
        },
        [...]
}
```

--------------------------------

### POST /api/v1/ (Download Specific Rule)

Source: https://yaraify.abuse.ch/api

Downloads a specific YARA rule from YARAhub, provided it is marked as TLP:WHITE.

```APIDOC
## POST /api/v1/

### Description
Downloads a specific YARA rule from YARAhub, provided it is marked as TLP:WHITE.

### Method
POST

### Endpoint
https://yaraify-api.abuse.ch/api/v1/

### Parameters
#### Request Body
- **query** (string) - Required - Must be set to "get_yara_rule"
- **uuid** (string) - Required - The UUID of the YARA rule to download

### Request Example
{
  "query": "get_yara_rule",
  "uuid": "1b95ce79-6034-4740-8e45-5f0840602d1a"
}
```

--------------------------------

### Download All Available YARA Rules

Source: https://yaraify.abuse.ch/api

Download a zip archive containing all YARA rules available in YARAhub. Rules must have 'yarahub_rule_sharing_tlp' set to TLP:WHITE to be included. The archive is updated every 5 minutes.

```bash
curl https://yaraify-api.abuse.ch/download/yaraify-rules.zip --output yaraify-rules.zip
```

--------------------------------

### POST /api/v1/ (Scan a file)

Source: https://yaraify.abuse.ch/api

Submits a file to the YARAify scan engine for analysis against public and non-public YARA and ClamAV signatures.

```APIDOC
## POST /api/v1/

### Description
Submits a file to the YARAify scan engine. Supports optional malware sample unpacking and configuration of sharing preferences.

### Method
POST

### Endpoint
https://yaraify-api.abuse.ch/api/v1/

### Parameters
#### Request Body
- **file** (file) - Required - The file you want to scan.
- **identifier** (string) - Optional - Optional identifier to associate this submission with.
- **clamav_scan** (integer) - Optional - Defines whether to scan the file with ClamAV (0 or 1, default 1).
- **unpack** (integer) - Optional - Defines whether to unpack the file (0 or 1, default 0).
- **share_file** (integer) - Optional - Defines whether the file is public and may be shared with 3rd parties (0 or 1, default 1).
- **skip_known** (integer) - Optional - If 1, YARAify will not process the file if the file is already known (0 or 1, default 0).
- **skip_noisy** (integer) - Optional - If 1, YARAify skips the file if it already has been scanned at least 10 times within the past 24 hours (0 or 1, default 0).

### Request Example
```
# Using multipart/form-data
curl -H "Auth-Key: YOUR-AUTH-KEY" -F "file=@sample.exe" -F "unpack=1" https://yaraify-api.abuse.ch/api/v1/
```
```

--------------------------------

### Delete a YARA Rule

Source: https://yaraify.abuse.ch/api

This command allows you to delete your own YARA rule from YARAify. You must provide the 'query' and the 'yarahub_uuid' of the rule to be deleted. Replace 'YOUR-AUTH-KEY' and the example UUID with your specific details.

```bash
curl -H "Auth-Key: YOUR-AUTH-KEY" -X POST -d '{ "query": "delete_yara_rule" , "yarahub_uuid": "bcbf6764-19ae-44f1-adb1-db0d23c100fb"}' https://yaraify-api.abuse.ch/api/v1/
```

--------------------------------

### Download a File

Source: https://yaraify.abuse.ch/api

Allows downloading a zipped file from YARAify using its SHA256 hash. Note that files with the 'no sharing' option are not available.

```APIDOC
## Download a File

### Description
Downloads a zipped file from YARAify using its SHA256 hash. Files with the 'no sharing' option are not available.

### Method
POST

### Endpoint
https://yaraify-api.abuse.ch/api/v1/

### Parameters
#### Request Body
- **query** (string) - Required - Must be set to "get_file".
- **sha256_hash** (string) - Required - The SHA256 hash of the file to download.

### Request Example
```json
{
  "query": "get_file",
  "sha256_hash": "a638404ab71199981be143591853b713b8826a82904a1cf72675de6bb026c8f9"
}
```

### Response
#### Success Response (200)
- **query_status** (string) - Indicates the status of the query.
- **data** (object) - Contains the file data.

#### Response Example
(Binary file content, not shown here)

#### Error Handling
- Files are zipped using AES128 encryption with the password "infected". Ensure your unzipping library supports AES encryption.
```

--------------------------------

### Download a Specific YARA Rule

Source: https://yaraify.abuse.ch/api

Retrieve a specific YARA rule from YARAhub using its UUID. The rule must have its 'yarahub_rule_sharing_tlp' meta field set to TLP:WHITE for public sharing. Replace 'YOUR-AUTH-KEY' and the example UUID.

```bash
curl -H "Auth-Key: YOUR-AUTH-KEY" -X POST -d '{ "query": "get_yara_rule", "uuid": "1b95ce79-6034-4740-8e45-5f0840602d1a" }' https://yaraify-api.abuse.ch/api/v1/
```

--------------------------------

### POST /api/v1/ - Query icon dhash

Source: https://yaraify.abuse.ch/api

Retrieves a list of files associated with a specific icon dhash.

```APIDOC
## POST /api/v1/

### Description
Retrieves a list of recent files associated with a specific icon dhash.

### Method
POST

### Endpoint
https://yaraify-api.abuse.ch/api/v1/

### Parameters
#### Request Body
- **query** (string) - Required - Must be set to "get_dhash_icon"
- **search_term** (string) - Required - The dhash value to search for
- **result_max** (integer) - Optional - Max number of results to display (default: 25, max: 1000)

### Request Example
{
  "query": "get_dhash_icon",
  "search_term": "92264e9e361ccdee"
}

### Response
#### Success Response (200)
- **query_status** (string) - Status of the query
- **query_info** (object) - Metadata about the search results
- **data** (array) - List of files matching the dhash

#### Response Example
{
  "query_status": "ok",
  "query_info": {
    "search_scope": "all time",
    "result_count": 6,
    "result_max": 250
  },
  "data": [
    {
      "sha256_hash": "3d30ec7012f3477319137f7637f9879772e5ba3dcfc06dc341e8a4c14ea9598a",
      "dhash_icon": "92264e9e361ccdee"
    }
  ]
}
```

--------------------------------

### POST /api/v1/ (List Active Rules)

Source: https://yaraify.abuse.ch/api

Retrieves a list of active YARA rules deployed by the user for live hunting.

```APIDOC
## POST /api/v1/

### Description
Retrieves a list of active YARA rules deployed by the user for live hunting.

### Method
POST

### Endpoint
https://yaraify-api.abuse.ch/api/v1/

### Parameters
#### Request Body
- **query** (string) - Required - Must be set to "show_deployed_yara_rules"

### Request Example
{
  "query": "show_deployed_yara_rules"
}

### Response
#### Success Response (200)
- **query_status** (string) - Status of the request
- **data** (array) - List of deployed YARA rules
```

--------------------------------

### Download an Unpacked File using cURL

Source: https://yaraify.abuse.ch/api

This cURL command allows you to download an unpacked version of a file from YARAify, identified by its SHA256 hash. Remember to substitute 'YOUR-AUTH-KEY' with your valid authentication key.

```bash
curl -H "Auth-Key: YOUR-AUTH-KEY" -X POST -d '{ "query": "get_unpacked", "sha256_hash": "de7fa65d5cd5314ba0ce6ab19a7dcd9853639a1152447457de7efb39a9ba1f46" }' https://yaraify-api.abuse.ch/api/v1/
```

--------------------------------

### Show Active YARA Rules

Source: https://yaraify.abuse.ch/api

Use this command to retrieve a list of active YARA rules deployed on YARAify for live hunting. Ensure you replace 'YOUR-AUTH-KEY' with your actual authentication key.

```bash
curl -H "Auth-Key: YOUR-AUTH-KEY" -X POST -d '{ "query": "show_deployed_yara_rules" }' https://yaraify-api.abuse.ch/api/v1/
```

--------------------------------

### Download a File using cURL

Source: https://yaraify.abuse.ch/api

Use this cURL command to download a specific file from YARAify using its SHA256 hash. Ensure you replace 'YOUR-AUTH-KEY' with your actual authentication key.

```bash
curl -H "Auth-Key: YOUR-AUTH-KEY" -X POST -d '{ "query": "get_file", "sha256_hash": "a638404ab71199981be143591853b713b8826a82904a1cf72675de6bb026c8f9" }' https://yaraify-api.abuse.ch/api/v1/
```

--------------------------------

### POST /api/v1/

Source: https://yaraify.abuse.ch/api

Queries the API to retrieve files associated with a specific ClamAV signature.

```APIDOC
## POST /api/v1/

### Description
Retrieves a list of recent files associated with a specific ClamAV signature.

### Method
POST

### Endpoint
https://yaraify-api.abuse.ch/api/v1/

### Parameters
#### Request Body
- **query** (string) - Required - The query type, must be "get_clamav".
- **search_term** (string) - Required - The ClamAV signature to search for.
- **result_max** (integer) - Optional - Max number of results to display (default: 25, max: 1000).

### Request Example
{
  "query": "get_clamav",
  "search_term": "Win.Dropper.Gh0stRAT-9789290-0"
}

### Response
#### Success Response (200)
- **query_status** (string) - Status of the query.
- **query_info** (object) - Metadata about the search results.
- **data** (array) - List of file objects matching the signature.

#### Response Example
{
  "query_status": "ok",
  "query_info": {
    "search_scope": "all time",
    "result_count": 13,
    "result_max": 500
  },
  "data": [
    {
      "sha256_hash": "5e3834ebbd42dbdbe6251efbf12869b3a70880f3535765ad8109b458543c8b2e",
      "file_size": 792412,
      "mime_type": "application/x-dosexec",
      "first_seen": "2022-04-15 08:24:20 UTC"
    }
  ]
}
```

--------------------------------

### POST /api/v1/ (get_telfhash)

Source: https://yaraify.abuse.ch/api

Retrieve a list of recent files associated with a specific telfhash.

```APIDOC
## POST /api/v1/

### Description
Retrieve a list of recent files associated with a specific telfhash.

### Method
POST

### Endpoint
https://yaraify-api.abuse.ch/api/v1/

### Parameters
#### Request Body
- **query** (string) - Required - The query type, must be "get_telfhash".
- **search_term** (string) - Required - The telfhash to search for.
- **result_max** (integer) - Optional - Max number of results to display (default: 25, max: 1000).

### Request Example
{
  "query": "get_telfhash",
  "search_term": "t1dd211d716b2195266ea0cd9088eca7b2512c97072349df33cf31849c24140aeea3ac4f"
}

### Response
#### Success Response (200)
- **query_status** (string) - Status of the query.
- **query_info** (object) - Metadata about the search results.
- **data** (array) - List of file objects matching the telfhash.

#### Response Example
{
  "query_status": "ok",
  "query_info": {
    "search_scope": "all time",
    "result_count": 9,
    "result_max": 250
  },
  "data": [
    {
      "sha256_hash": "56c438f5a581a639f3f3853f2a01d850f51faf0fdd50f4f07bbc0826a0aabe55",
      "file_size": 134572,
      "mime_type": "application/x-executable",
      "telfhash": "t1dd211d716b2195266ea0cd9088eca7b2512c97072349df33cf31849c24140aeea3ac4f"
    }
  ]
}
```
Tokens:
Raw