API Documentation

API Sandbox

Analysis

Analysis - Get history

get
/analysis/
curl -H 'Authorization: Basic ZW1haWw6cGFzc3dvcmQ=' -i 'https://api.any.run/v1/analysis/?skip=25'

Authorization

Field Type Description
Authorization String

Basic Authorization Header.

"Authorization": "Basic ZW1haWw6cGFzc3dvcmQ="

Parameter

Field Type Description
team optional Boolean

Leave this field blank to get your history or specify to get team history

Default value: false

skip optional Number

Skiping

Default value: 0

limit optional Number

Limits

Default value: 25

Size range: 1-100

Success 200/201

Field Type Description
error Boolean

Must be false.

message String

History data

HTTP/1.1 200 OK
{}

Error 4XX/5XX

Name Type Description
error Boolean

Must be true.

message String

Error message

HTTP/1.1 403 Forbidden
{
  "error": true,
  "message": "Wrong authorization data"
}

Send a Sample Request

url

Headers

Authorization

String

Parameters

Parameter

Boolean
Number
Number

Analysis - Get report

get
/analysis/{taskId}
curl -H 'Authorization: Basic ZW1haWw6cGFzc3dvcmQ=' -i 'https://api.any.run/v1/analysis/0cf223f2-530e-4a50-b68f-563045268648'

Authorization

Field Type Description
Authorization String

Basic Authorization Header.

{
    "Authorization": "Basic ZW1haWw6cGFzc3dvcmQ="
}

Path parameter

Field Type Description
taskId String

Task UUID

Success 200/201

Field Type Description
error Boolean

Must be false.

data Object

Report data

HTTP/1.1 200 OK
{
  • "error": false,
  • : {10 items}
}

Error 4XX/5XX

Name Type Description
error Boolean

Must be true.

message String

Error message

HTTP/1.1 403 Forbidden
{
  "error": true,
  "message": "Wrong authorization data"
}

Send a Sample Request

url

Headers

Authorization

String

Parameters

Path parameter

String

Analysis - Run new analysis

post
/analysis/
curl -XPOST -H 'Authorization: Basic ZW1haWw6cGFzc3dvcmQ=' -F 'file=@malware.exe' -F 'env_os=windows' -F 'env_bitness=64' -F 'env_version=10' -i 'https://api.any.run/v1/analysis'
curl -XPOST -H 'Authorization: Basic ZW1haWw6cGFzc3dvcmQ=' -F 'obj_type=rerun' -F 'task_rerun_uuid=0cf223f2-530e-4a50-b68f-563045268648' -i 'https://api.any.run/v1/analysis'

Authorization

Field Type Description
Authorization String

Basic Authorization Header.

{
    "Authorization": "Basic ZW1haWw6cGFzc3dvcmQ="
}

Environment

Field Type Description
env_os optional String

Operation System.

Default value: windows

Allowed values: "windows", "linux"

env_bitness optional Number

Bitness of Operation System.

Default value for Windows: 64

Allowed values for Windows: 32, 64

Default value for Linux: 64

Allowed values for Linux: 64

env_version optional String

Version of OS.

Default value for Windows: 10

Allowed values for Windows: "7", "10", "11"

Default value for Linux: 22.04.2

Allowed values for Linux: "22.04.2"

env_type optional String

Environment preset type.

Default value for Windows: complete

Allowed values for Windows: "clean", "office", "complete"

Default value for Linux: office

Allowed values for Linux: "office"

env_locale optional String

Operation system's language.
Use locale identifier or country name (Ex: "en-US" or "Brazil").
Case insensitive.

Default value: en-US

Options

Field Type Description
opt_network_connect optional Boolean

Network connection state.

Default value: true

opt_network_fakenet optional Boolean

FakeNet feature status.

Default value: false

opt_network_tor optional Boolean

TOR using.

Default value: false

opt_network_geo optional String

Tor geo location option.

Allowed values: "fastest", "AU", "BR", "DE", "CH", "FR", "KR", "US", "RU", "GB", "IT"

opt_network_mitm optional Boolean

HTTPS MITM proxy option.

Default value: false

opt_network_residential_proxy optional Boolean

Residential proxy using.

Default value: false

opt_network_residential_proxy_geo optional String

Residential proxy geo location option.

Allowed values: "fastest", "AF", "AL", "DZ", "AD", "AO", "AG", "AR", "AM", "AU", "AT", "AZ", "BS", "BH", "BD", "BB", "BY", "BE", "BZ", "BJ", "BT", "BO", "BA", "BW", "BR", "BN", "BG", "BF", "BI", "CV", "KH", "CM", "CA", "KY", "CF", "TD", "CL", "CN", "CO", "CG", "CD", "CR", "CI", "HR", "CU", "CW", "CY", "CZ", "DK", "DJ", "DM", "DO", "EC", "EG", "SV", "GQ", "EE", "ET", "FJ", "FI", "FR", "GF", "PF", "GA", "GM", "GE", "DE", "GH", "GR", "GD", "GP", "GU", "GT", "GN", "GW", "GY", "HT", "HN", "HK", "HU", "IS", "IN", "ID", "IR", "IQ", "IE", "IM", "IL", "IT", "JM", "JP", "JE", "JO", "KZ", "KE", "KR", "KW", "KG", "LA", "LV", "LB", "LS", "LR", "LY", "LT", "LU", "MO", "MK", "MG", "MW", "MY", "ML", "MT", "MQ", "MR", "MU", "YT", "MX", "MD", "MN", "ME", "MA", "MZ", "MM", "NA", "NP", "NL", "NZ", "NI", "NE", "NG", "NO", "OM", "PK", "PS", "PA", "PG", "PY", "PE", "PH", "PL", "PT", "PR", "QA", "RE", "RO", "RU", "RW", "LC", "SA", "SN", "RS", "SC", "SL", "SG", "SX", "SK", "SI", "SO", "ZA", "SS", "ES", "LK", "SD", "SR", "SZ", "SE", "CH", "SY", "TW", "TJ", "TZ", "TH", "TG", "TT", "TN", "TR", "UG", "UA", "AE", "GB", "US", "UY", "UZ", "VE", "VN", "VI", "YE", "ZM", "ZW", "AL"

opt_kernel_heavyevasion optional Boolean

Heavy evasion option.

Default value: false

opt_privacy_type optional String

Privacy settings.

Default value: bylink

Allowed values: "public", "bylink", "owner", "byteam"

opt_timeout optional Number

Timeout option.

Default value: 60

Size range: 10-660

opt_automated_interactivity optional Boolean

Automated Interactivity (ML) option.

Default value: true

obj_ext_startfolder optional String

Start object from.

Default value: temp

Allowed values: "desktop", "home", "downloads", "appdata", "temp", "windows", "root"

Object

Field Type Description
file optional File

File to analyze

obj_type optional String

Type of new task.
Option obj_type: rerun must be used with the parameter task_rerun_uuid

Default value: file

Allowed values: "file", "url", "download", "rerun"

task_rerun_uuid optional String

UUID of the task to be restarted. Use with the parameter obj_type: rerun

obj_url optional String

URL, used only if "obj_type" is "url" or "download".

Size range: 5..512

Required format: (http/https)://(your-link)

obj_ext_cmd optional String

Optional command line. Used only with "file" and "download" task types

Size range: 2..256

obj_ext_browser optional String

Browser name, used only for "url" type.

Default value for Windows: Microsoft Edge

Allowed values for Windows: "Google Chrome", "Mozilla Firefox", "Internet Explorer", "Microsoft Edge"

Default value for Linux: Google Chrome

Allowed values for Linux: "Mozilla Firefox", "Google Chrome"

obj_ext_useragent optional String

User agent, used only for "download" type

Size range: 2..256

obj_force_elevation optional Boolean

Forces the file to execute with elevated privileges and an elevated token (for PE32, PE32+, PE64 files only). Not applicable for Linux.

Default value for Windows: false

Allowed values for Windows: true, false

auto_confirm_uac optional Boolean

Auto confirm Windows UAC requests. Not applicable for Linux , use run_as_root instead.

Default value for Windows: true

Allowed values for Windows: true, false

run_as_root optional Boolean

Run file with superuser privileges. Not applicable for Windows, use auto_confirm_uac instead. Used only for file type.

Default value for Linux: false

Allowed values for Linux: true, false

obj_ext_extension optional Boolean

Change extension to valid.

Default value for Windows: true

Default value for Linux: false

Allowed values for obj_ext_extension: true, false

opt_privacy_hidesource optional Boolean

Option for hiding of source URL, used only for "download" type.

Default value: false

Success 200

Field Type Description
error Boolean

Must be false.

data Object

Success 201

Field Type Description
  taskid String

UUID of created task

HTTP/1.1 201 Created
{
  "error": false,
  "data" : {
     "taskid": "0cf223f2-530e-4a50-b68f-563045268648"
  }
}

Error 4XX/5XX

Name Type Description
error Boolean

Must be true.

message String

Error message

HTTP/1.1 403 Forbidden
{
  "error": true,
  "message": "Wrong authorization data"
}
HTTP/1.1 422 No content
{
  "error": true,
  "message": "No content"
}

Send a Sample Request

url

Headers

Authorization

String

Parameters

Environment

String
Number
String
String
String

Options

Boolean
Boolean
Boolean
String
Boolean
Boolean
String
Boolean
String
Number
Boolean
String

Object

File
String
String
String
String
String
String
Boolean
Boolean
Boolean
Boolean
Boolean

Analysis - Add time to task

Add 60 seconds of execution time to an active task. The task must belong to the current user.

patch
/analysis/addtime/{taskId}
curl -X PATCH -H 'Authorization: Basic ZW1haWw6cGFzc3dvcmQ=' -i 'https://api.any.run/v1/analysis/addtime/0cf223f2-530e-4a50-b68f-563045268648'

Authorization

Field Type Description
Authorization String

Basic Authorization Header.

{
    "Authorization": "Basic ZW1haWw6cGFzc3dvcmQ="
}

Path parameter

Field Type Description
taskId String

Task UUID

Success 200/201

Field Type Description
error Boolean

Must be false.

message String

Success message

HTTP/1.1 200 OK
{
  "error": false,
  "data": Request to add time in task {uuid} successful 
}

Error 4XX/5XX

Name Type Description
error Boolean

Must be true.

message String

Error message

HTTP/1.1 403 Forbidden
{
  "error": true,
  "message": "Wrong authorization data"
}

Send a Sample Request

url

Headers

Authorization

String

Parameters

Path parameter

String

Analysis - Stop task

Stop task. The task must belong to the current user.

patch
/analysis/stop/{taskId}
curl -X PATCH -H 'Authorization: Basic ZW1haWw6cGFzc3dvcmQ=' -i 'https://api.any.run/v1/analysis/stop/0cf223f2-530e-4a50-b68f-563045268648'

Authorization

Field Type Description
Authorization String

Basic Authorization Header.

{
    "Authorization": "Basic ZW1haWw6cGFzc3dvcmQ="
}

Path parameter

Field Type Description
taskId String

Task UUID

Success 200/201

Field Type Description
error Boolean

Must be false.

message String

Success message

HTTP/1.1 200 OK
{
  "error": false,
  "data": "Request to stop task {uuid} successful" 
}

Error 4XX/5XX

Name Type Description
error Boolean

Must be true.

message String

Error message

HTTP/1.1 403 Forbidden
{
  "error": true,
  "message": "Wrong authorization data"
}

Send a Sample Request

url

Headers

Authorization

String

Parameters

Path parameter

String

Analysis - Delete task

Delete task. The task must belong to the current user.

delete
/analysis/delete/{taskId}
curl -X DELETE -H 'Authorization: Basic ZW1haWw6cGFzc3dvcmQ=' -i 'https://api.any.run/v1/analysis/delete/0cf223f2-530e-4a50-b68f-563045268648'

Authorization

Field Type Description
Authorization String

Basic Authorization Header.

{
    "Authorization": "Basic ZW1haWw6cGFzc3dvcmQ="
}

Path parameter

Field Type Description
taskId String

Task UUID

Success 200/201

Field Type Description
error Boolean

Must be false.

message String

Success message

HTTP/1.1 200 OK
{
  "error": false,
  "data": "Request to delete task {uuid} successful" 
}

Error 4XX/5XX

Name Type Description
error Boolean

Must be true.

message String

Error message

HTTP/1.1 403 Forbidden
{
  "error": true,
  "message": "Wrong authorization data"
}

Send a Sample Request

url

Headers

Authorization

String

Parameters

Path parameter

String

Analysis - Status task

Get the status of a task.
For a completed task, the response will be provided once.
For an active task, the response will be sent in server-sent-events mode.

get
/analysis/status/{taskId}
curl -H 'Authorization: Basic ZW1haWw6cGFzc3dvcmQ=' -i 'https://api.any.run/v1/analysis/status/0cf223f2-530e-4a50-b68f-563045268648'

Authorization

Field Type Description
Authorization String

Basic Authorization Header.

{
    "Authorization": "Basic ZW1haWw6cGFzc3dvcmQ="
}

Path parameter

Field Type Description
taskId String

Task UUID

Success 200/201

Field Type Description
error Boolean

Must be false.

{
  • : {11 items},
  • "completed": true,
  • "error": false
}

Error 4XX/5XX

Name Type Description
error Boolean

Must be true.

message String

Error message

HTTP/1.1 403 Forbidden
{
  "error": true,
  "message": "Wrong authorization data"
}

Send a Sample Request

url

Headers

Authorization

String

Parameters

Path parameter

String

Environment

Environment - Request available environment

get
/environment/
curl -H 'Authorization: Basic ZW1haWw6cGFzc3dvcmQ=' -i 'https://api.any.run/v1/environment'

Authorization

Field Type Description
Authorization String

Basic Authorization Header.

{
    "Authorization": "Basic ZW1haWw6cGFzc3dvcmQ="
}

Success 200

Field Type Description
error Boolean

Must be false.

data Object
  environments Object[]
    os String
    version String
    bitness Number
    variant String
    build Number
    type String
    software Object
      ie Object
        version String
      apps Object[]
        version String
        name String
      upps String[]
HTTP/1.1 200 OK
{
  "error": false,
  "data": {
    "environments": [
      {
        "os": "windows",
        "version": "7",
        "bitness": 32
        "variant": "professional",
        "build": 7601,
        "type": "complete",
        "software": {
          "ie": {
            "version": "8.0.7601.17514"
          },
          "upps": [
            "KB976902",
            "KB2999226",
            "KB2534111",
            ...
          ],
          "apps": [
            {
              "name": "Adobe Acrobat Reader DC MUI"
              "version": "15.023.20070",
            },
            {
              "name": "Google Chrome"
              "version": "68.0.3440.106",
            },
            {
              "name": "Microsoft Office Professional 2010"
              "version": "14.0.6029.1000",
            },
            ...
          ]
        },
      },
      ...
    ]
  }
}

Error 4XX/5XX

Name Type Description
error Boolean

Must be true.

message String

Error message

HTTP/1.1 403 Forbidden
{
  "error": true,
  "message": "Wrong authorization data"
}

Send a Sample Request

url

Headers

Authorization

String

User

User - Request user's limits

get
/user/
curl -H 'Authorization: Basic ZW1haWw6cGFzc3dvcmQ=' -i 'https://api.any.run/v1/user'

Authorization

Field Type Description
Authorization String

Basic Authorization Header.

{
    "Authorization": "Basic ZW1haWw6cGFzc3dvcmQ="
}

Success 200

Field Type Description
error Boolean

Must be false.

data Object
  limits Object
    web Object

Limits for interactive using (-1 if unlimited)

    api Object

Limits for API using (-1 if unlimited)

    parallels Object

Limits for parallel runs

{
    "error": false,
    "data": {
        "limits": {
            "web": {
                "minute": -1,
                "hour": -1,
                "day": -1,
                "month": -1
            },
            "api": {
                "minute": -1,
                "hour": -1,
                "day": -1,
                "month": 250
            },
            "parallels": {
                "total": 1,
                "available": 1
            }
        }
    }
}

Error 4XX/5XX

Name Type Description
error Boolean

Must be true.

message String

Error message

HTTP/1.1 403 Forbidden
{
  "error": true,
  "message": "Wrong authorization data"
}

Send a Sample Request

url

Headers

Authorization

String

Environment - Get user presets

get
/user/presets
curl -H 'Authorization: Basic ZW1haWw6cGFzc3dvcmQ=' -i 'https://api.any.run/v1/user/presets'

Authorization

Field Type Description
Authorization String

Basic Authorization Header.

{
    "Authorization": "Basic ZW1haWw6cGFzc3dvcmQ="
}

Success 200

Field Type Description
error Boolean

Must be false.

HTTP/1.1 200 OK 
 [
  {
    "_id": "hKDchxPjhB7oPfraQ",
    "name": "Default"
    ...
  }
 ]

Error 4XX/5XX

Name Type Description
error Boolean

Must be true.

message String

Error message

HTTP/1.1 403 Forbidden
{
  "error": true,
  "message": "Wrong authorization data"
}

Send a Sample Request

url

Headers

Authorization

String

API TI Lookup

Request

Request - Get TI data

post
/intelligence/api/search
curl --location --request POST 'https://api.any.run/v1/intelligence/api/search'  --header 'Authorization: API-Key <Your API-Key here>'  --header 'Content-Type: application/json'  --data '{ "query": "SuricataClass:\"Potential Corporate Privacy Violation\""}' 
curl --location --request POST 'https://api.any.run/v1/intelligence/api/search'  --header 'Authorization: API-Key <Your API-Key here>'  --header 'Content-Type: application/json'  --data '{ "query": "ThreatLevel:\"malicious\" AND TaskType:\"url\""}' 

Authorization

Field Type Description
Authorization String

API Key authentication

Content-Type

Field Type Description
Content-Type String

Content-Type

Default value: application/json

"Authorization": "API-Key <Your API-Key>"

Parameter

Field Type Description
query String

Lookup string that can be concatinated with AND operator

startDate optional String

Indicating the beginning of the period for which events is requested.
Format: YYYY-MM-DD

endDate optional String

Indicating the end of the period for which events is requested.
Format: YYYY-MM-DD

Hashes

Field Type Description
sha256 optional String

Sha256

sha1 optional String

Sha1

md5 optional String

MD5

Task

Field Type Description
threatName optional String

Name of threat

threatLevel optional String

Threat level

Allowed values: "suspicious", "malicious", "info"

taskType optional String

Task run type

Allowed values: "file", "url"

submissionCountry optional String

Submission country

Environment

Field Type Description
os optional String

Operation system

Allowed values: "Windows 7", "Windows 10", "Windows 11"

osSoftwareSet optional String

Operation system software

Allowed values: "clean", "office", "complete"

osBitVersion optional String

Operation system bitness

Allowed values: "32", "64"

Registry

Field Type Description
registryKey optional String

Registry key

registryName optional String

Registry name

registryValue optional String

Registry value

Module

Field Type Description
moduleImagePath optional String

Module image path

Detection

Field Type Description
ruleThreatLevel optional String

Rule threat level

Allowed values: "suspicious", "malicious", "info"

ruleName optional String

Rule name

MITRE optional String

MITRE

Allowed values: T1550, T1547.004, T1547, T1109, T1484.002, T1560, T1052, T1060, T1137.006, T1562.004, T1546.001, T1176, T1141, T1103, T1114, T1072, T1083, T1494, T1555.005, T1056.003, T1185, T1606.001, T1132, T1546.011, T1496, T1130, T1204.001, T1004, T1132.001, T1560.003, T1173, T1561.001, T1497, T1564.006, T1561.002, T1552, T1573, T1574.011, T1211, T1075, T1621, T1218.007, T1546.012, T1037, T1090, T1145, T1055.015, T1495, T1543, T1071, T1029, T1110.002, T1552.006, T1077, T1137.005, T1606.002, T1065, T1101, T1133, T1134.002, T1036.001, T1110.001, T1197, T1055.012, T1059.001, T1547.008, T1205.002, T1542.002, T1082, T1562.003, T1571, T1044, T1497.001, T1614, T1546.015, T1221, T1564, T1213, T1027, T1137.001, T1055.011, T1069, T1554, T1558.004, T1567.002, T1021.005, T1036.007, T1498.001, T1566.003, T1218.013, T1138, T1562.002, T1568.002, T1098, T1546.002, T1574.001, T1569.002, T1070.001, T1038, T1548, T1116, T1218, T1497.003, T1558.001, T1091, T1032, T1505.004, T1059.007, T1114.002, T1035, T1100, T1070.003, T1565.001, T1499, T1555, T1119, T1070.004, T1566.002, T1564.005, T1078.001, T1560.001, T1087.002, T1542.003, T1003.005, T1546.009, T1567.001, T1218.010, T1218.004, T1483, T1074, T1547.012, T1552.001, T1114.001, T1212, T1102.003, T1111, T1550.003, T1558.003, T1030, T1218.008, T1088, T1555.004, T1095, T1136, T1098.005, T1218.012, T1053, T1187, T1218.003, T1531, T1488, T1505.003, T1193, T1500, T1143, T1115, T1175, T1550.002, T1090.001, T1087.003, T1071.001, T1136.001, T1025, T1002, T1222.001, T1614.001, T1546.013, T1121, T1034, T1058, T1492, T1559, T1547.010, T1019, T1061, T1048.003, T1562.009, T1562.010, T1218.002, T1498.002, T1079, T1110.003, T1027.008, T1566.001, T1558, T1195.002, T1036.005, T1003.006, T1546.016, T1052.001, T1216, T1502, T1480.001, T1069.002, T1055.005, T1003.001, T1078.003, T1568.003, T1559.001, T1055.002, T1553, T1574.008, T1015, T1564.007, T1024, T1198, T1563.002, T1124, T1192, T1499.002, T1181, T1218.005, T1014, T1547.009, T1059.005, T1036, T1553.004, T1218.011, T1136.002, T1179, T1090.004, T1178, T1553.002, T1218.014, T1074.002, T1134.005, T1553.006, T1056.001, T1054, T1205.001, T1182, T1087.001, T1069.001, T1027.007, T1204, T1122, T1076, T1497.002, T1001.001, T1055.003, T1137, T1036.004, T1134.003, T1553.003, T1027.005, T1556.007, T1547.005, T1606, T1574.002, T1027.009, T1499.001, T1041, T1062, T1070, T1570, T1126, T1491.002, T1021, T1073, T1556.002, T1188, T1090.002, T1053.002, T1099, T1499.004, T1003.003, T1611, T1172, T1183, T1177, T1011, T1043, T1134.004, T1059, T1216.001, T1546.007, T1574.009, T1055.004, T1205, T1564.002, T1195.003, T1505, T1090.003, T1557.002, T1112, T1199, T1546.010, T1011.001, T1027.001, T1050, T1218.001, T1574, T1485, T1006, T1558.002, T1569, T1016.001, T1504, T1170, T1081, T1180, T1207, T1070.006, T1118, T1021.001, T1055, T1067, T1056.004, T1190, T1480, T1016, T1096, T1059.006, T1557.003, T1214, T1186, T1037.001, T1071.002, T1223, T1505.001, T1505.002, T1484.001, T1222, T1518.001, T1191, T1129, T1565.002, T1158, T1123, T1021.002, T1204.002, T1552.002, T1071.004, T1036.002, T1200, T1001.003, T1089, T1055.001, T1543.003, T1213.002, T1140, T1560.002, T1070.005, T1102.001, T1137.002, T1005, T1171, T1012, T1189, T1557.001, T1218.009, T1059.003, T1547.014, T1055.013, T1042, T1070.008, T1553.005, T1559.002, T1027.002, T1490, T1534, T1556, T1574.010, T1127.001, T1047, T1039, T1080, T1201, T1131, T1486, T1108, T1033, T1546.008, T1564.003, T1491, T1097, T1556.001, T1518, T1105, T1547.003, T1021.006, T1110.004, T1542.001, T1568.001, T1503, T1074.001, T1003.002, T1027.003, T1048, T1027.004, T1615, T1539, T1574.005, T1529, T1563, T1498, T1196, T1110, T1547.001, T1493, T1564.008, T1556.006, T1195.001, T1092, T1562.006, T1040, T1573.002, T1574.007, T1120, T1220, T1491.001, T1565.003, T1567, T1568, T1056.002, T1001, T1068, T1084, T1620, T1117, T1078.002, T1487, T1125, T1028, T1087, T1008, T1552.004, T1018, T1557, T1546.003, T1565, T1564.004, T1094, T1134.001, T1037.003, T1102.002, T1566, T1070.009, T1013, T1021.003, T1564.001, T1489, T1548.002, T1086, T1482, T1555.003, T1051, T1574.013, T1046, T1093, T1505.005, T1010, T1098.002, T1562, T1562.001, T1107, T1127, T1102, T1564.010, T1202, T1017, T1048.002, T1045, T1561, T1031, T1070.007, T1078, T1546, T1113, T1063, T1217, T1023, T1003, T1009, T1106, T1057, T1208, T1056, T1053.005, T1135, T1036.003, T1003.004, T1622, T1542, T1573.001, T1210, T1194, T1001.002, T1049, T1026, T1064, T1195, T1071.003, T1574.012, T1137.004, T1085, T1649, T1007, T1020, T1203, T1027.006, T1048.001, T1219, T1114.003, T1572, T1104, T1499.003, T1137.003, T1547.002, T1128, T1556.005, T1066, T1022, T1132.002, T1134, T1209, T1484, T1174

Process

Field Type Description
imagePath optional String

Process image path

commandLine optional String

Command line

injectedFlag optional String

Injected flag

Allowed values: "true", "false"

Connection

Field Type Description
destinationIP optional String

Destination ip

destinationPort optional String

Destination port

destinationIpasn optional String

Destination IPASN

destinationIPgeo optional String

Destination IP Geo

domainName optional String

Domain name

File

Field Type Description
fileName optional String

File name

Suricata

Field Type Description
suricataClass optional String

Suricata class

Allowed values: Potential Corporate Privacy Violation, Misc Attack, Attempted Administrator Privilege Gain, Not Suspicious Traffic, unknown, A Network Trojan was detected, Misc activity, Attempted Information Leak, Generic Protocol Command Decode, Potentially Bad Traffic

suricataMessage optional String

Suricata message

suricataThreatLevel optional String

Suricata message

Allowed values: malicious, suspicious, info

suricataID optional String

Suricata ID

URL

Field Type Description
url optional String

URL

httpRequestContentType optional String

HTTP request content type

httpResponseContentType optional String

HTTP response content type

httpRequestFileType optional String

HTTP request file type

httpResponseFileType optional String

HTTP response file type

Success 200/201

Field Type Description
HTTP/1.1 200 OK
{}

Error 4XX/5XX

Name Type Description
code String

Error code

Allowed values: "INVALID_REQUEST_ERROR", "WRONG_QUERY_ERROR", "API_KEY_ERROR", "UNRECOGNIZED_USER_ERROR", "AUTH_REQUIRED_ERROR", "WRONG_AUTH_DATA_ERROR", "QUOTA_EXCEEDED_ERROR", "LIMIT_EXCEEDED_ERROR", "EXPIRED_LICENSE_ERROR", "NO_TI_LICENSE_ERROR", "NO_API_KEY_ERROR", "TRIAL_IS_OVER_ERROR"

message String

Error message

HTTP/1.1 403 Forbidden 
 {
  "message": "Your trial limit has ended. Please acquire a valid license from support@any.run.",
  "code": "TRIAL_IS_OVER_ERROR" 
 } 
HTTP/1.1 400 Forbidden 
 {
  "message": "The query syntax is incorrect.",
  "code": "INVALID_REQUEST_ERROR" 
 } 

Send a Sample Request

url

Headers

Authorization

String

Content-Type

String

Parameters

Parameter

String
String
String

Hashes

String
String
String

Task

String
String
String
String

Environment

String
String
String

Registry

String
String
String

Module

String

Detection

String
String
String

Process

String
String
String

Connection

String
String
String
String
String

File

String

Suricata

String
String
String
String

URL

String
String
String
String
String