Lookup request for hash

The endpoint is used to display specific information for a hash.

Request

Request method: GET

Endpoint: https://tip.kaspersky.com/api/hash/<request>

Query parameters:

Expected parameters

Parameter	Description
request	Hash that you want to investigate.
`count`	Maximum number of records in each data group to display. If this parameter is not specified, up to 1000 records will be displayed. This restriction does not apply to `DetectionsInfo` and `FileParentCertificates` groups. For these groups all records are displayed regardless of the number of records.
`sections`	Sections that you want to investigate for the requested hash. Use the comma to specify several sections.
`format`	Investigation result format. Optional parameter. Available values: `json`—Investigation results are returned in JSON format. `stix`—Investigation results are returned in STIX format. If this value is specified, the `count` and `sections` parameters are ignored: data from all groups is returned. If the `format` parameter is not specified, investigation results are returned in JSON format.

Use the question mark (?) to separate the first parameter from the request. Use the ampersand (&) to separate parameters from each other. The parameters can be specified in any order.

Dates in all sections are displayed in Coordinated Universal Time (UTC) format.

Key values are case-sensitive.

Request examples:

Investigate LicenseInfo, FilePaths, and FileNames sections for the hash E50CBDF74C1DFB6F60112D7641CEEB42:

curl --cert <file name>.pem --user <user name> https://tip.kaspersky.com/api/hash/e50cbdf74c1dfb6f60112d7641ceeb42?sections=LicenseInfo,FilePaths,FileNames&count=10&format=stix

Run the same request by using an API token:

curl -H "Authorization: Bearer <API token>" https://tip.kaspersky.com/api/hash/e50cbdf74c1dfb6f60112d7641ceeb42?sections=LicenseInfo,FilePaths,FileNames&count=10&format=stix

Responses

200 OK

Request processed successfully.

The table below contains possible sections available for a hash investigation.

Certain objects can be assigned to the suspicious status. Suspicious is the internal name that is only used to identify objects with a threat score between 50 and 74, and it means not trusted.

200 OK response parameters

Parameter	Description
LicenseInfo	Information on the license used. `AccessType`—License type ("`Commercial`" or "`Trial`"). `DayRequests`—Number of requests performed in the current day (for a commercial license). `DayQuota`—Daily limit of requests (for a commercial license). `TokenExpirationDate`—Date when an API token expires. If there is no API token requested, the `null` value is returned.
Zone	Color of the zone that a hash belongs to.
RelatedObjects	Information about the presence of malicious objects associated with the indicator. `HasRedZone`—Shows whether there are malicious objects (`zone=red`) related to the indicator: `true`—there are related malicious objects; `false`—no related malicious objects.
FileGeneralInfo	General information about the requested hash. `Md5`—MD5 hash of the file requested by hash. `Sha1`—SHA-1 hash of the file requested by hash. `Sha256`—SHA-256 hash of the file requested by hash. `FirstSeen`—Date and time when the requested hash was detected by Kaspersky expert systems for the first time, according to your computer local time zone. `LastSeen`—Date and time when the requested hash was detected by Kaspersky expert systems for the last time, according to your computer local time zone. `Signer`—Organization that signed the requested hash. `SignerZone`—Color of the zone indicating the signer's trust level (red, gray, green). `SignerStatus`—Trust level of the object signature (Discredited, Not trusted, Trusted). `Packer`—Packer name. `Size`—Size of the object that is being investigated by hash (in bytes). `Type`—Format of the object that is being investigated by hash. `HitsCount`—Number of hits (popularity) of the requested hash detected by Kaspersky expert systems. `HasApt`—Shows whether the file is related to an advanced persistent threat (APT) attack. `RelatedAptReports`—Array of objects that describe APT Intelligence reports, Crimeware Threat Intelligence reports, and ICS reports, to which the requested hash is related. Each object contains a report's ID, type, and title. The report ID can be used as an argument (`publication_id`) for the get_one endpoint, which is used to obtain specific information for a report. If the requested hash is not related to reports, an empty array is returned.
DetectionsInfo	Information about detected objects. `LastDetectDate`—Date and time when the object was last detected by Kaspersky expert systems. `DescriptionUrl`—Link to the detected object description in Kaspersky threats website (if available). `Zone`—Color of the zone that the detection object belongs to. `DetectionName`—Name of the detected object. `DetectionMethod`—Method used to detect the object.
FilePaths	Information about known paths to the file identified by the requested hash on computers using Kaspersky software. `Path`—Path to the file on user computers identified by the requested hash. `Location`—Root folder or drive where the file identified by the requested hash is located on user computers. `FilePathHitsCount`—Number of path detections by Kaspersky expert systems.
FileNames	Information about known names of the file identified by the requested hash on computers using Kaspersky software. `FileName`—Name of the file identified by the requested hash. `FileNamesHitsCount`—Number of file name detections by Kaspersky expert systems.
FileDownloadedFromUrls	Information about web addresses and domains from which the file identified by the requested hash was downloaded. `Url`—Web addresses accessed by the file identified by the requested hash. `IsUrlTruncated`—Shows whether private data was filtered in the displayed web address. `Zone`—Color of the zone that the web address belongs to. `Domain`—Upper domain of the web address accessed by the file identified by the requested hash. `LastDownloadDate`—Date and time when the file identified by the requested hash last accessed the web address. `IpsCount`—Number of IP addresses that the domain resolves to.
FileAccessedUrls	Information about web addresses that were accessed by the file identified by the requested hash. `Url`—Web addresses accessed by the file identified by the requested hash. `IsUrlTruncated`—Shows whether private data was filtered in the displayed web address. `Zone`—Color of the zone that the web address belongs to. `Domain`—Upper domain of the web address used to download the file identified by the requested hash. `LastDownloadDate`—Date and time when the file identified by the requested hash was last downloaded from the web address / domain. `IpsCount`—Number of IP addresses that the domain resolves to.
FileStartedObjects	Information about objects that started the file identified by the requested hash. `Zone`—Color of the zone that a file belongs to. `HitsCount`—Number of times the file identified by the requested hash was started as detected by Kaspersky expert systems. `Md5`—MD5 hash of the object that started the file identified by the requested hash. `Location`—Root folder or drive where the object is located on user computers. `Path`—Path to the object on user computers. `Name`—Name of the object that started the file identified by the requested hash. `LastStartDate`—Date and time when the file identified by the requested hash was last started. `DetectionName`—Name of the detected object.
FileStartedBy	Information about objects that were started by the file that was identified by the requested hash. `Zone`—Color of the zone that a file belongs to. `HitsCount`—Number of times the file identified by the requested hash started the object as detected by Kaspersky expert systems. `Md5`—MD5 hash of the started object. `Location`—Root folder or drive where the started object is located on user computers. `Path`—Path to the object on user computers. `Name`—Name of the started object. `LastStartDate`—Date and time when the object was last started by the file identified by the requested hash. `DetectionName`—Name of the detected object.
FileDownloadedObjects	Information about objects that were downloaded by the file identified by the requested hash. `Zone`—Color of the zone that a file belongs to. `HitsCount`—Number of times the object was downloaded as detected by Kaspersky expert systems. `Md5`—MD5 hash of the downloaded object. `Location`—Root folder or drive where the downloaded object is located on user computers. `Path`—Path of the downloaded object on user computers. `Name`—Name of the downloaded object. `LastDownloadDate`—Date and time when the object was last downloaded by the file identified by the requested hash. `DetectionName`—Name of the detected object.
FileDownloadedBy	Information about objects that downloaded the file identified by the requested hash. `Zone`—Color of the zone that a file belongs to. `HitsCount`—Number of times the file identified by the requested hash was downloaded as detected by Kaspersky expert systems. `Md5`—MD5 hash of the object that downloaded the file identified by the requested hash. `Location`—Root folder or drive where the object is located on user computers. `Path`—Path to the object on user computers. `Name`—Name of the object that downloaded the file identified by the requested hash. `LastDownloadDate`—Date and time when the file identified by the requested hash was last downloaded. `DetectionName`—Name of the detected object.
FileCertificates	Information about signatures and certificates of the file identified by the requested hash. `ParentMd5`—MD5 hash of the certificate. `SerialNumber`—Serial number of the certificate. `Vendor`—Owner of the certificate. `Publisher`—Publisher of the certificate. `TimeStamp`—Date and time when the certificate was signed. `Issued`—Date and time when the certificate was issued. `Expires`—Expiration date of the certificate. `IsDirectlySigned`—Shows whether a certificate is embedded into the file. `IsDiscredited`—Shows whether the certificate is discredited. `IsTrusted`—Shows whether the certificate is trusted. `IsRevoked`—Shows whether the certificate is revoked. `IsGray`—Shows whether the certificate is in a Gray zone. `IsGood`—Shows whether the certificate is in a Good zone.
FileParentCertificates	Information about container certificates of the file identified by the requested hash. `ParentMd5`—MD5 hash of the container's certificate. `SerialNumber`—Serial number of the container's certificate. `Vendor`—Owner of the container's certificate. `Publisher`—Publisher of the container's certificate. `TimeStamp`—Date and time when the container's certificate was signed. `Issued`—Date and time when the container's certificate was issued. `Expires`—Expiration date of the container's certificate. `IsDirectlySigned`—Shows whether a container's certificate is embedded into the file. `IsDiscredited`—Shows whether the container's certificate is discredited. `IsTrusted`—Shows whether the container's certificate is trusted. `IsRevoked`—Shows whether the container's certificate is revoked. `IsGray`—Shows whether the container's certificate is in a Gray zone. `IsGood`—Shows whether the container's certificate is in a Good zone.
FileUnpackedFrom	Information about parent objects of the file identified by the requested hash. `Zone`—Color of the zone that the parent object belongs to. `ParentMd5`—MD5 hash of the parent object. `ChildMd5`—MD5 hash of the child object. For direct parent objects (`level=0`), the MD5 hash of the requested object is provided. `ParentFileSize`—Size of the parent object (in bytes). `ParentFileType`—File type of the parent object. `ParentDetectionName`—Detected objects related to the parent object (for example, HEUR:Exploit.Script.Blocker). `Level`—Parent level. The direct parent of the requested object has `level=0`. The parent of the requested object's parent has `level=1`, and so on. The maximum possible level is 5.
FileUnpackedObjects	Information about child objects of the file identified by the requested hash. `Zone`—Color of the zone that the child object belongs to. `ChildMD5`—MD5 hash of the child object. `ParentMD5`—MD5 hash of the parent object. For direct child objects (`level=0`), the MD5 hash of the requested object is displayed. `ChildFileSize`—Size of the child object (in bytes). `ChildFileType`—File type of the child object. `ChildDetectionName`—Detected objects related to the child object (for example, HEUR:Exploit.Script.Blocker). `Level`—Child level. The direct child of the requested object has `level=0`. The child of the requested object's child has `level=1`, and so on. The maximum possible level is 5.

401 Unauthorized

402 License Expired

403 Forbidden

451 Unavailable For Legal Reasons

Page top