MalShare

About MalShare

MalShare is a repository of malware samples that provides an API for registered users to access files and metadata within its dataset. The API supports listing recently submitted hashes and sample sources, downloading files by hash, retrieving file details, searching by hash, source, or filename, and looking up file types, with output in JSON or raw text depending on the endpoint. It also supports uploading files and submitting URLs for the service to download and add to its sample collection, with status checks via a GUID for queued download tasks.

Community-maintained client libraries and tools exist for the API in Python, .NET, Go, and Java, developed by third-party contributors and hosted on GitHub. Access requires an API key, and the service exposes an endpoint for checking a key's daily request limit and remaining quota.

The service is aimed at malware researchers and developers building tools that need programmatic access to malware samples and related metadata.

Key features

• Search and download malware samples by hash, source, or file name
• Retrieve lists of sample hashes and sources from the past 24 hours
• Look up multiple hashes in bulk via a POST hashlookup endpoint
• Upload files or submit a URL for MalShare to download and analyze
• Query file type breakdowns and per-key API request quotas
• Official client libraries available in Python, .NET, Go, and Java

Frequently asked questions