curl --request POST \
--url https://api.threatbook.io/v2/file/upload \
--header 'Content-Type: multipart/form-data' \
--form file='@example-file'import requests
url = "https://api.threatbook.io/v2/file/upload"
files = { "file": ("example-file", open("example-file", "rb")) }
response = requests.post(url, files=files)
print(response.text)const form = new FormData();
form.append('file', '<string>');
const options = {method: 'POST'};
options.body = form;
fetch('https://api.threatbook.io/v2/file/upload', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.threatbook.io/v2/file/upload",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--",
CURLOPT_HTTPHEADER => [
"Content-Type: multipart/form-data"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.threatbook.io/v2/file/upload"
payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")
req, _ := http.NewRequest("POST", url, payload)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.threatbook.io/v2/file/upload")
.body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.threatbook.io/v2/file/upload")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--"
response = http.request(request)
puts response.read_body{
"data": {
"sha256": "d79c9643d76062f553f76bb20b07da88fdbf5ddf3428ffc0223bb7bf90e36deb",
"permalink": "https://ati.threatbook.io/hash/d79c9643d76062f553f76bb20b07da88fdbf5ddf3428ffc0223bb7bf90e36deb"
},
"response_code": 200,
"msg": "Success"
}{
"msg": " In Progress",
"response_code": 202
}{
"msg": "The file was uploaded successfully, but only partial analysis could be completed because of the {rate/daily/monthly/total quota} limitation.",
"response_code": 206
}{
"msg": "Required:{resource/apikey}",
"response_code": 400
}{
"msg": "Invalid account status",
"response_code": 401
}{
"msg": "Invalid API method",
"response_code": 405
}{
"msg": "Request rate limitation",
"response_code": 429
}{
"msg": "System error",
"response_code": 500
}File Upload
For potentially malicious files from office endpoints, Web/FTP/email attachments, or suspicious files on endpoints/servers, the system performs rapid detection using 22 antivirus scanning engines. Based on the file type, the system automatically selects an appropriate sandbox environment for dynamic analysis.
curl --request POST \
--url https://api.threatbook.io/v2/file/upload \
--header 'Content-Type: multipart/form-data' \
--form file='@example-file'import requests
url = "https://api.threatbook.io/v2/file/upload"
files = { "file": ("example-file", open("example-file", "rb")) }
response = requests.post(url, files=files)
print(response.text)const form = new FormData();
form.append('file', '<string>');
const options = {method: 'POST'};
options.body = form;
fetch('https://api.threatbook.io/v2/file/upload', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.threatbook.io/v2/file/upload",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--",
CURLOPT_HTTPHEADER => [
"Content-Type: multipart/form-data"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.threatbook.io/v2/file/upload"
payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")
req, _ := http.NewRequest("POST", url, payload)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.threatbook.io/v2/file/upload")
.body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.threatbook.io/v2/file/upload")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--"
response = http.request(request)
puts response.read_body{
"data": {
"sha256": "d79c9643d76062f553f76bb20b07da88fdbf5ddf3428ffc0223bb7bf90e36deb",
"permalink": "https://ati.threatbook.io/hash/d79c9643d76062f553f76bb20b07da88fdbf5ddf3428ffc0223bb7bf90e36deb"
},
"response_code": 200,
"msg": "Success"
}{
"msg": " In Progress",
"response_code": 202
}{
"msg": "The file was uploaded successfully, but only partial analysis could be completed because of the {rate/daily/monthly/total quota} limitation.",
"response_code": 206
}{
"msg": "Required:{resource/apikey}",
"response_code": 400
}{
"msg": "Invalid account status",
"response_code": 401
}{
"msg": "Invalid API method",
"response_code": 405
}{
"msg": "Request rate limitation",
"response_code": 429
}{
"msg": "System error",
"response_code": 500
}Query Parameters
Your API key. For details on how to obtain and manage your API key, please refer to the Authentication page.
Kindly note:
Please check if you have bound your access IP to the key and have the authority quotas to access this API before you interact with it.
Sandbox Execution Environment
Users can specify the sandbox environment in which the file will be executed.
Available environments include:
-
Windows:
- win7_sp1_enx64_office2013
- win7_sp1_enx86_office2013
- win7_sp1_enx86_office2010
- win7_sp1_enx86_office2007
- win7_sp1_enx86_office2003
- win10_1903_enx64_office2016
-
Linux:
- ubuntu_1704_x64
- centos_7_x64
-
Kylin:
- kylin_desktop_v10
The sandbox execution time is 60s by default and can be adjusted as needed, up to a maximum of 300s.
Body
Files to be analyzed must be no larger than 100 MB.
- Note: Do not upload files exceeding 100 MB.
- Supported file types include:
PE executables (EXE, DLL, COM, etc.), Office documents (DOC, XLS, PPT, etc.), PDF, HTML, script files, MSI, SWF, JAR, LNK, ELF, and various archive formats (ZIP, RAR, 7Z, etc.).