MalDatabase

About MalDatabase

MalDatabase provides an API for accessing threat intelligence data on malware samples. The API offers a single GET /download endpoint that returns a daily feed (updated at 1:00 UTC), authenticated via an API key issued after registration. Response data is gzip-encoded JSON.

Each feed entry includes sample identifiers (SHA256, SHA1, MD5 hashes), a threat level rating from 0 to 2, the detected malware family, file size and type, along with observed behavioral indicators such as contacted domains, executed processes, and dropped files.

The service is intended for building scripts and integrating malware feed data into other systems. Use in commercial services or on behalf of a third-party business is prohibited without a partnership agreement, and violations result in indefinite account suspension.

Key features

• Daily malware sample feed updated every day at 1:00 UTC
• Download endpoint accessible via simple GET request with API key authentication
• Gzip-compressed feed content for efficient downloads
• Threat level scoring from 0 (no risk) to 2 (malicious activity detected)
• Sample metadata includes SHA256/SHA1/MD5 hashes, malware family, file size, and file type
• Behavioral data including associated domains, executed processes, and dropped files

Frequently asked questions