Response schema version 1.0
Submit a file, get a static analysis verdict with the evidence behind it. Need a key? Get one free.
POST https://obfusguard.com/api/analyze Header: X-API-Key: <your key> Body: multipart/form-data, field "file"
curl.exe -s -H "X-API-Key: YOUR_KEY" -F "file=@C:\path\to\sample.exe" https://obfusguard.com/api/analyze | ConvertFrom-Json | Select-Object -ExpandProperty verdict | Format-List
Use curl.exe, not curl — in PowerShell, curl is a
different command.
curl -s -H "X-API-Key: YOUR_KEY" -F "file=@/path/to/sample.exe" https://obfusguard.com/api/analyze
import requests
with open("sample.exe", "rb") as f:
r = requests.post("https://obfusguard.com/api/analyze",
headers={"X-API-Key": "YOUR_KEY"},
files={"file": f}, timeout=180)
result = r.json()
print(result["verdict"]["level"], result["verdict"]["score"], result["verdict"]["summary"])
Analysis is synchronous and typically takes 10–30 seconds; large installers can take over a minute. Set client timeouts to at least 180 seconds. Each successful analysis uses one credit; a failed analysis is refunded.
All fields below are stable within schema version 1: they will not be renamed or
removed. New fields may be added, so ignore fields you don't recognise.
Any field may be null when the information isn't available for a file.
| Field | Contents |
|---|---|
schema_version | "1.0" |
ok | true on success |
file | name, sha256, sha1, md5, size, type (detected), expected_type (from extension), version_info |
verdict | level (LOW / MEDIUM / HIGH), score (0–100), summary, threat_class, threat_reason, highlights (short findings) |
signature | status — see below; present, subject, issuer, digest_valid, chain_valid, code_signing, expired, self_signed, signer_sha256 |
packer | label (detected packer), ml_class, ml_confidence, ml_breakdown |
installer | is_installer, family, kind, probability |
pe | imphash, rich_hash, compile_time, timestamp_anomaly, pdb_path, requested_execution_level, tls_callbacks, exports, overlay_ratio, sections (name, entropy, size), imports (dlls, functions, flagged) |
entry_point | Entry-point code traits: anti_debug, api_resolution, mem_manipulation, xor_loop, … |
anomaly | Byte-distribution anomaly level, score, notes |
mitre | List of technique, name, reason |
yara | List of severity, description, matches (offset, preview) |
embedded | Payloads found inside the file: type, offset, size, sha256, method |
iocs | urls, domains, ips, emails, registry, paths, onion_domains, crypto_wallets, decoded_urls, decoded_ips, suspicious_apis |
duration_ms | Analysis time |
credits_remaining | Credits left on your key |
Lists are capped at 50 entries.
unsigned | No Authenticode signature. |
digest_mismatch | Signed, but the file was modified after signing. A strong tampering indicator. |
valid | Signature and certificate chain verify to a trusted root. |
untrusted_chain | The certificate can't vouch for this file: self-signed, not issued for code signing (for example a website certificate), or a chain that doesn't reach a trusted root. Takes precedence over expired. |
expired | A genuine code-signing certificate that has expired. |
unverified | Signed, but the signature couldn't be checked either way. |
Errors return "ok": false with an error code, and often a detail message.
401 unauthorized | reason is missing, unknown, revoked or expired. |
402 quota_exceeded | No credits left. Contact support@obfusguard.com. |
429 rate_limited | Too many requests in a short time. Retry after a pause. |
400 | Missing or empty file field, or an invalid parameter. |
500 analysis_failed | The file couldn't be analysed. No credit is used. |
Uploaded files are deleted within minutes of analysis and are never shared or used for training. Details in the privacy notice.