样本详情统一查询

接口说明

该接口根据输入：md5、sha1、sha256、sm3之一查询样本信息。

查询结果包括：

静态信息：静态信息包括文件基本类型、文件hash值、文件大小、文件威胁级别、文件中类型相关信息（apk、elf、pe等）。
扫描信息（含历史扫描信息和最新扫描结果）：扫描信息包括内置的扫描引擎名称、以及扫描的结果（比如命中的病毒）和威胁等级。

参数要求:

该接口需要两个必须参数(样本类型及内容类型)以及对应值:

样本参数类型: md5,sha1,sha256,sm3,该类型需要根据输入的内容进行判断
要查询的内容类型: content_list,对应的值有:样本扫描详细信息:analysis_details;样本上传信息 :upload_info;样本静态信息:static_info;最新样本信息latest_analysis_info,该值通过用户输入内容进行判断,可以用多个逗号分隔,如果没有明确说明查询哪种内容类型,则为全部 content_list和样本类型为必须参数

将获取到的两个参数和对应值映射到同一对象类型{"field":"","value":""}上,得到一个两个相同元素的数组名为keywords。

要求数组一定是两个元素,不得出现相同的
每组数组元素一个是{"field":"","value":""}类型

将这个数组给query上,最后组装后的格式类似 {"query":{"keywords":[{"field":"md5","value":"57403930e62a3e9f83f248c753b1e164"},{"field":"content_list","value":""}]}}，最后校验请求数据格式是否和示例一样,如果一样则调用工具,如果不一样,重新生成请求参数再调用工具。接口业务场景见“推荐应用场景”。

请求地址

https://api.f.360.cn/files/std/internal/v2/specimen_detail

请求方法

POST

请求参数

参数名	类型	位置	是否必填	示例值	说明
query	object	body	是
query.keywords	Array(object)	body	是		实际查询的内容
query.keywords.[0].field	string	body	是	md5	查询字段的属性。支持的key为：md5、sha1、sha256、sm3之一。
query.keywords.[0].value	string	body	是	57403930e62a3e9f83f248c753b1e164	对应属性的值
query.keywords.[1].field	string	body	是	content_list	设定返回内容，仅支持固定值content_list
query.keywords.[1].value	string	body	是	static_info	指定返回哪些内容，如有多个，以" ," 分隔。支持analysis_details、upload_info、static_info、latest_analysis_info

响应参数

data 按 content_list 请求值返回对应的内容块，可能包含的顶层内容块为 static_info、analysis_details、latest_analysis_info、upload_info；样本无对应数据的内容块不返回。

通用字段

名称	类型	示例值	描述
code	String	0	响应状态码
msg	String	success	响应消息
data	map	见响应示例	按 content_list 请求返回对应内容块

data.static_info（样本静态信息）

名称	类型	示例值	描述	应用说明
data.static_info	map	见响应示例	样本静态信息	每个样本都应有相关信息。参数里如包含符号，为正常数据，非异常
data.static_info.apk_info_v2	map	见响应示例	APK 文件提取信息；仅 APK 样本返回
data.static_info.basic_info	map	见响应示例	样本静态基本信息
data.static_info.basic_info.compressed_children	string	见响应示例	zip，tar，7z等压缩包/归档，exe等安装包解压后的子文件情况	暂未对外使用该属性
data.static_info.basic_info.crc32	string	见响应示例	校验值	从qex引擎中获取
data.static_info.basic_info.file_size	int	见响应示例	样本大小
data.static_info.basic_info.file_type	string	见响应示例	样本类型	从qex引擎中获取
data.static_info.basic_info.magic	string	见响应示例		通过file命令获取，注意magic库版本(幻数类型)
data.static_info.basic_info.md5	string	见响应示例	哈希
data.static_info.basic_info.sha1	string	见响应示例	哈希
data.static_info.basic_info.sha256	string	见响应示例	哈希
data.static_info.basic_info.sm3	string	见响应示例	国产哈希算法	sm3简介：https://cloud.tencent.com/developer/article/1634816
data.static_info.basic_info.ssdeep	string	见响应示例	模糊哈希实现	https://ssdeep-project.github.io/ssdeep/index.html(开发工具)
data.static_info.basic_info.tlsh	string	见响应示例	trend micro 模糊哈希实现	https://github.com/trendmicro/tlsh (开发工具)
data.static_info.creation_date	int	见响应示例	样本编译时间
data.static_info.exiftool	map	见响应示例	ExifTool 工具，提取出来的 object 类型信息，有多个字段，不同的文件类型产出的字段不同。	数组含有多个字段。ExifTool提取文件说明https://exiftool.org/#supported
data.static_info.file_name	string	见响应示例	样本内置文件名	部分类型样本的二进制中自带元信息，能从中提取出文件名。比如 PE 文件，能从 peinfo 中提取出 OriginalFilename，也能从签名信息中获取 name，office 文件中也能提取出一些有关联的信息
data.static_info.elf_info	map	见响应示例	elfinfo提取信息；仅 ELF 样本返回	参考说明：https://docs.virustotal.com/reference/elf_info
data.static_info.elf_info.entry	string	见响应示例	ELF 头部数据（base64 编码）
data.static_info.elf_info.header	map	见响应示例	ELF 头信息
data.static_info.elf_info.header.abi_version	int	见响应示例	应用程序二进制接口版本
data.static_info.elf_info.header.class	String	见响应示例	文件类(即"ELF32")
data.static_info.elf_info.header.data	String	见响应示例	内存中的数据对齐(即"小端序”)
data.static_info.elf_info.header.entrypoint	int	见响应示例	可执行入口点
data.static_info.elf_info.header.hdr_version	String	见响应示例	程序头版本
data.static_info.elf_info.header.machine	String	见响应示例	平台
data.static_info.elf_info.header.num_prog_headers	int	见响应示例	程序头中的条目数
data.static_info.elf_info.header.num_section_headers	String	见响应示例	节标题的数量
data.static_info.elf_info.header.obj_version	String	见响应示例	“0x1"表示原始ELF文件
data.static_info.elf_info.header.os_abi	String	见响应示例	应用程序二进制接口类型
data.static_info.elf_info.header.type	String	见响应示例	文件类型
data.static_info.elf_info.import_list	Map Array	见响应示例	导入的元素列表
data.static_info.elf_info.import_list.name	String		导入项目的名称
data.static_info.elf_info.import_list.type	String		导入项目的类型
data.static_info.elf_info.export_list	Map Array		导出的元素列表
data.static_info.elf_info.export_list.name	String		导出项目的名称
data.static_info.elf_info.export_list.type	String		导出项目的类型
data.static_info.elf_info.interpreter	String	见响应示例	动态连接器
data.static_info.elf_info.note	String Array	见响应示例	额外元数据和说明
data.static_info.elf_info.packers	String Array	见响应示例	包含可执行文件的打包程序
data.static_info.elf_info.section_list	Map Array	见响应示例	ELF文件的字典列表部分
data.static_info.elf_info.section_list.flags	String	见响应示例	指令段标志
data.static_info.elf_info.section_list.name	String	见响应示例	指令段名称
data.static_info.elf_info.section_list.phisical_offset	int	见响应示例	指令段物理偏移量
data.static_info.elf_info.section_list.section_type	String	见响应示例	指令段类型
data.static_info.elf_info.section_list.size	int	见响应示例	指令段字节大小
data.static_info.elf_info.section_list.virtual_address	int	见响应示例	指令段虚拟地址
data.static_info.elf_info.segment_list	Map Array	见响应示例	aka程序头字典列表
data.static_info.elf_info.segment_list.resources	String Array	见响应示例	该程序段所涉及的资源列表
data.static_info.elf_info.segment_list.segment_type	String	见响应示例	程序段类型
data.static_info.elf_info.segment_list.shared_libraries	String Array	见响应示例	包含此可执行文件使用的共享库
data.static_info.elf_info.shared_libraries	String Array	见响应示例	包含此可执行文件使用的共享库
data.static_info.elf_info.target_os	String	见响应示例	可运行的目标操作系统
data.static_info.elf_info.verneed	String Array	见响应示例	操作系统运行时相关版本号
data.static_info.pe_info	map	见响应示例	pe 工具提取出针对文件类型属于 pe 的样本相关信息；仅 PE 样本返回	数组含有多个字段,pe文件标准规范说明：https://learn.microsoft.com/zh-cn/windows/win32/debug/pe-format
data.static_info.signature_info	Map	见响应示例	签名信息，数字签名	数组含有多个字段正常数据，非异常
data.static_info.signature_info.algorithm	String		签名算法
data.static_info.signature_info.cert issuer	String		证书颁发者
data.static_info.signature_info.counter signers	int		副署签名证书链中的各个证书subject
data.static_info.signature_info.counter signers details	Map Array		副署签名证书链信息
data.static_info.signature_info.name	String		证书使用者
data.static_info.signature_info.serial number	String		证书序列号
data.static_info.signature_info.signers	String		样本主签名证书链各个证书subject
data.static_info.signature_info.signers details	Map Array		主签名证书链信息
data.static_info.signature_info.signing date	int		签名时间
data.static_info.signature_info.status	int		校验结果
data.static_info.signature_info.thumbprint	String		证书指纹
data.static_info.signature_info.type	String	win, mobile	样本类型，win表示pc样本，mobile表示手机样本的签名
data.static_info.signature_info.valid from	int		证书有效期开始
data.static_info.signature_info.valid to	int		证书有效期结束
data.static_info.signature_info.valid usage	int		证书用途
data.static_info.signature_info.verified	String		签名校验结果
data.static_info.signature_info.x509	Map Array		签名结构中出现的全部x509证书

data.analysis_details（历史扫描信息）

名称	类型	示例值	描述	应用说明
data.analysis_details.historical_info	Array	见响应示例	历史的扫描相关信息
data.analysis_details.historical_info[].analysis_date	int	见响应示例	历史扫描和分析的时间
data.analysis_details.historical_info[].analysis_result	map	见响应示例	历史根据所有扫描器的扫描结果，以及公司内部的研判逻辑，产出的最终研判结果。	即CloudEngine的研判结果
data.analysis_details.historical_info[].analysis_result.level	int	见响应示例	综合研判后的总level
data.analysis_details.historical_info[].analysis_result.virus_name	string	见响应示例	综合研判后的病毒名
data.analysis_details.historical_info[].scanner_results	map	见响应示例	历史不同扫描器的扫描结果；以扫描器名称为 key（如 Aries、Centaurus、Taurus 等）
data.analysis_details.historical_info[].scanner_results.<scanner>.engine_version	int	见响应示例	扫描器的引擎版本	不是所有扫描器都能获取到(暂未对外使用该属性)
data.analysis_details.historical_info[].scanner_results.<scanner>.level	int	见响应示例	扫描器检出结果的级别	详见扫描器level枚举值
data.analysis_details.historical_info[].scanner_results.<scanner>.msg	string	见响应示例	本次扫描情况具体说明	success: 扫描成功
data.analysis_details.historical_info[].scanner_results.<scanner>.original_virus_name	string	见响应示例	扫描器原始报毒名
data.analysis_details.historical_info[].scanner_results.<scanner>.QVM_score	float	见响应示例	qvm分数	qvm独有的字段
data.analysis_details.historical_info[].scanner_results.<scanner>.ret	int	见响应示例	本次扫描情况	0: 扫描成功; 1:调度跳过(比如文件类型不支持); 其他: 扫描异常
data.analysis_details.historical_info[].scanner_results.<scanner>.scanner_name	string	见响应示例	扫描器的名称	具体扫描器，详见下表；不同敏感级别，返回的扫描器类型不同
data.analysis_details.historical_info[].scanner_results.<scanner>.update_date	int	见响应示例	扫描器更新的日期	包括病毒库、底层引擎等所有更新完成时的日期(暂未对外使用该属性)
data.analysis_details.historical_info[].scanner_results.<scanner>.vendor	int	见响应示例	扫描器厂商	0: 表示自研; 1: 开源厂商; 2: 第三方商业厂商(暂未对外使用该属性)
data.analysis_details.historical_info[].scanner_results.<scanner>.virus_name	string	见响应示例	扫描器的报毒名

data.latest_analysis_info（最新扫描结果）

以扫描器名称为 key 的 map（实测出现的扫描器：AVAST、AVE、AVIRA、BITDEFENDER、KASPERSKY、MSE、QEX、QVM），每个扫描器一个结果对象：

名称	类型	示例值	描述	应用说明
data.latest_analysis_info	map	见响应示例	最新扫描结果
data.latest_analysis_info.<scanner>.engine_version	int	见响应示例	扫描器的引擎版本	不是所有扫描器都能获取到(暂未对外使用该属性)
data.latest_analysis_info.<scanner>.level	int	见响应示例	扫描器检出结果的级别	详见扫描器level枚举值
data.latest_analysis_info.<scanner>.msg	string	见响应示例	本次扫描情况具体说明	success: 扫描成功
data.latest_analysis_info.<scanner>.original_virus_name	string	见响应示例	扫描器原始报毒名
data.latest_analysis_info.<scanner>.QVM_score	float	见响应示例	qvm分数	qvm独有的字段
data.latest_analysis_info.<scanner>.ret	int	见响应示例	本次扫描情况	0: 扫描成功; 1:调度跳过(比如文件类型不支持); 其他: 扫描异常
data.latest_analysis_info.<scanner>.scanner_name	string	见响应示例	扫描器的名称	具体扫描器，详见下表；不同敏感级别，返回的扫描器类型不同
data.latest_analysis_info.<scanner>.update_date	int	见响应示例	扫描器更新的日期	包括病毒库、底层引擎等所有更新完成时的日期(暂未对外使用该属性)
data.latest_analysis_info.<scanner>.vendor	int	见响应示例	扫描器厂商	0: 表示自研; 1: 开源厂商; 2: 第三方商业厂商(暂未对外使用该属性)
data.latest_analysis_info.<scanner>.virus_name	string	见响应示例	扫描器的报毒名

data.upload_info（样本上传信息）

样本若无上传记录，则不返回该内容块。

名称	类型	示例值	描述	应用说明
data.upload_info	Map	见响应示例	样本上传相关信息
data.upload_info.client_info	Map	见响应示例	客户端上传信息
data.upload_info.client_info.client_creation_date	int:timestamp	见响应示例	客户端获取的文件创建时间（操作系统右键-属性-创建时间）
data.upload_info.client_info.client_module	string	见响应示例	客户端产品模块
data.upload_info.client_info.client_product	string	见响应示例	客户端产品
data.upload_info.client_info.get_date	int:timestamp	见响应示例	样本上传/收录时间
data.upload_info.client_info.upload_filename	string	见响应示例	从upload_path中提取出来的文件名
data.upload_info.client_info.upload_path	string	见响应示例	样本上传时在客户端的路径
data.upload_info.is_oversea	bool	见响应示例	是否为海外样本
data.upload_info.vt_has	bool	见响应示例	VT是否上传该样本	有些样本虽然VT也有收录，但是我们通过其他途径会比VT收录更早，所以无法单纯从product/module来确定需要VT增量数据来做离线更新。

请求示例

支持cUrl、Python、Java、PHP、Go语言的请求，示例如下

#!/usr/bin/env bash
set -euo pipefail

APPID=""  # apikey
SECRET=""  # salt
URL="https://api.f.360.cn/files/std/internal/v2/specimen_detail"
BODY='{"query":{"keywords":[{"field":"md5","value":"57403930e62a3e9f83f248c753b1e164"},{"field":"content_list","value":""}]}}'

NONCE=$(printf '%08d' $((RANDOM % 100000000)))
TIMESTAMP=$(date +%s)
BODY_MD5=$(printf '%s' "$BODY" | openssl dgst -md5 -hex | awk '{print $NF}')
SIGNATURE=$(printf '%s' "${BODY_MD5}${APPID}${NONCE}${TIMESTAMP}${SECRET}" | openssl dgst -md5 -hex | awk '{print $NF}')
SIGNATURE=${SIGNATURE:16}

curl --location --request POST "$URL" \
  --header "Content-Type: application/json" \
  --header "X-360-Key: ${APPID}" \
  --header "X-360-Nonce: ${NONCE}" \
  --header "X-360-Timestamp: ${TIMESTAMP}" \
  --header "X-360-Signature: ${SIGNATURE}" \
  --data "${BODY}"

# python3.6.8

# -*- coding:utf-8 -*—

import hashlib
import json
import random
import time

import requests

APPID = ""  # apikey
SECRET = ""  # salt


def make_headers(appid, secret, body):
    headers = {}
    headers["X-360-Key"] = appid
    headers["X-360-Nonce"] = str(random.randint(0, 99999999)).zfill(8)
    headers["X-360-Timestamp"] = str(int(time.time()))

    s = (
        hashlib.md5(body.encode("utf8")).hexdigest()
        + headers["X-360-Key"]
        + headers["X-360-Nonce"]
        + headers["X-360-Timestamp"]
        + secret
    )
    md5 = hashlib.md5(s.encode("utf8")).hexdigest()
    headers["X-360-Signature"] = md5[16:]
    headers["Content-Type"] = "application/json"
    return headers


def do_post(url, body):
    res = requests.post(
        url,
        data=json.dumps(body),
        headers=make_headers(APPID, SECRET, json.dumps(body)),
    )
    print(res.text)


if __name__ == "__main__":
    # 请求地址
    # 一次性最多5条参数
    url = "https://api.f.360.cn/files/std/internal/v2/specimen_detail"

    params = {
        "query": {
            "keywords": [
                {"field": "md5", "value": "57403930e62a3e9f83f248c753b1e164"},
                {"field": "content_list", "value": ""},
            ]
        }
    }
    do_post(url, params)

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.concurrent.ThreadLocalRandom;

public class Demo {
    static String md5(String input) throws Exception {
        byte[] digest = MessageDigest.getInstance("MD5")
                .digest(input.getBytes(StandardCharsets.UTF_8));
        StringBuilder sb = new StringBuilder();
        for (byte b : digest) {
            sb.append(String.format("%02x", b & 0xff));
        }
        return sb.toString();
    }

    public static void main(String[] args) throws Exception {
        String appid = ""; // apikey
        String secret = ""; // salt
        String url = "https://api.f.360.cn/files/std/internal/v2/specimen_detail";
        String body = "{\"query\":{\"keywords\":[{\"field\":\"md5\",\"value\":\"57403930e62a3e9f83f248c753b1e164\"},{\"field\":\"content_list\",\"value\":\"\"}]}}";

        String nonce = String.format("%08d", ThreadLocalRandom.current().nextInt(100000000));
        String timestamp = String.valueOf(System.currentTimeMillis() / 1000);
        String signature = md5(md5(body) + appid + nonce + timestamp + secret).substring(16);

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create(url))
                .header("Content-Type", "application/json")
                .header("X-360-Key", appid)
                .header("X-360-Nonce", nonce)
                .header("X-360-Timestamp", timestamp)
                .header("X-360-Signature", signature)
                .POST(HttpRequest.BodyPublishers.ofString(body, StandardCharsets.UTF_8))
                .build();

        HttpClient client = HttpClient.newHttpClient();
        HttpResponse<String> response = client.send(
                request, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
        System.out.println(response.body());
    }
}

<?php

// apikey
$appid = "";
// salt
$secret = "";
$url = 'https://api.f.360.cn/files/std/internal/v2/specimen_detail';
$body = json_encode([
    'query' => [
        'keywords' => [
            ['field' => 'md5', 'value' => '57403930e62a3e9f83f248c753b1e164'],
            ['field' => 'content_list', 'value' => ''],
        ],
    ],
], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);

$nonce = str_pad((string) random_int(0, 99999999), 8, "0", STR_PAD_LEFT);
$timestamp = (string) time();
$signature = substr(md5(md5($body) . $appid . $nonce . $timestamp . $secret), 16);

$ch = curl_init($url);
$options = [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Content-Type: application/json",
        "X-360-Key: {$appid}",
        "X-360-Nonce: {$nonce}",
        "X-360-Timestamp: {$timestamp}",
        "X-360-Signature: {$signature}",
    ],
];
$options[CURLOPT_POST] = true;
$options[CURLOPT_POSTFIELDS] = $body;
curl_setopt_array($ch, $options);

$response = curl_exec($ch);
if ($response === false) {
    echo curl_error($ch), PHP_EOL;
} else {
    echo $response, PHP_EOL;
}
curl_close($ch);

package main

import (
	"bytes"
	"crypto/md5"
	"encoding/hex"
	"fmt"
	"io"
	"math/rand"
	"net/http"
	"time"
)

func md5Hex(s string) string {
	sum := md5.Sum([]byte(s))
	return hex.EncodeToString(sum[:])
}

func main() {
	appid := ""  // apikey
	secret := "" // salt
	url := "https://api.f.360.cn/files/std/internal/v2/specimen_detail"
	body := []byte(`{"query":{"keywords":[{"field":"md5","value":"57403930e62a3e9f83f248c753b1e164"},{"field":"content_list","value":""}]}}`)

	nonce := fmt.Sprintf("%08d", rand.Intn(100000000))
	timestamp := fmt.Sprintf("%d", time.Now().Unix())
	signature := md5Hex(md5Hex(string(body)) + appid + nonce + timestamp + secret)[16:]

	req, err := http.NewRequest(http.MethodPost, url, bytes.NewReader(body))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("X-360-Key", appid)
	req.Header.Set("X-360-Nonce", nonce)
	req.Header.Set("X-360-Timestamp", timestamp)
	req.Header.Set("X-360-Signature", signature)

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	respBody, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(respBody))
}

响应示例

业务正常响应

业务正常响应-static_info.elf_info响应示例

{
    "entry": "Me1JidFeSIniSIPk8FBUScfAAH1AAEjHwRB9QABIx8dwaEAA6Lf7///0kJBIg+wISIsFuY4gAEiFwHQC/9BIg8QIw5CQkJCQkJCQkJCQkJBVSInlU0iD7AiAPeiRIAAAdUu7QKBgAEiLBeKRIABIges4oGAASMH7A0iD6wFIOdhzJGYPH0QAAEiDwAFIiQW9kSAA/xTFOKBgAEiLBa+RIABIOdhy4sYFm5EgAAFIg8QIW8nDZmZmLg8fhAAAAAAASIM9MIAgAABVSInldBK4AAAAAEiFwHQIv0igYADJ/+DJw5CQkJCQkJCQkJCQkJCQU0G4EH5AALkWfkAAuh9+QAC+AQAAADHASIn76FD6//+6BQAAAL7QgEAAMf/oz/z//7kufkAASInCSInfvgEAAAAxwOgo+v//ugUAAAC+M35AADH/6Kf8//9Iid9IicK5Q35AAFu+AQAAADHA6f/5//9mZmZmZmYuDx+EAAAAAACD/29TSInTD4TLAAAAfjGB/wABAAAPhJ0AAAAPH0QAAH9Og/9wD4TlAAAAMcCD/3N0BbgHAAAAW8MPH4AAAAAAg/9TdBt+UYP/Zg+E0AAAAIP/Z3QLg/9kddhmDx9EAAAxwMYFoZAgAAFbww8fRAAAgf8CAQAAD4TkAAAAfEqB/wMBAAB1rDHAxgV+kCAAAVvDDx+AAAAAAIP/Rg+EnwAAAIP/UnWMv6B+QAC5CQAAAPOmD4W4AAAAMcDGBUiQIAABW8MPH0QAADHAxgU7kCAAAVvDDx9EAABIgz0QkCAAAA+EsgAAALoFAAAAvoZ+QAAx/+iJ+///MfZIicIx/zHA6Ov8//+4FgAAAFvDDx9AADHAxgXvjyAAAVvDDx9EAABIgz3QjyAAAA+EigAAALoFAAAAvlJ+QADrtmYPH0QAAEiDPbiPIAAAdF66BQAAAL5sfkAA65pmLg8fhAAAAAAAMcDGBaKPIAABW8MPH0QAALoFAAAAvoiBQAAx/+j/+v//SInfSInGMcDoQvn//7gWAAAAW8MPHwAxwEiJNU+PIABbww8fRAAAMcBIiTVPjyAAW8MPH0QAADHASIk1N48gAFvDZmZmZi4PH4QAAAAAAEiD7AiLPd6OIACF/3hASIsFA48gAEiFwHQlSInH6J74//9Iiz3vjiAA6AL5//+LPbSOIABIxwXZjiAAAAAAAOiM9///xwWajiAA/////0iDxAjDZmZmZi4PH4QAAAAAAFVIif1TTInTSIPsWEmLejBIjXQkEOjm+f//SItVEEiJxkiJUCBIi3sw6FL4//9Ii3soSIX/dCBIi3M46LD7//8x9kiJx+hm9///SIXAdA9Ii1UQSIlQEEiDxFhbXcPoPQ==",
    "header": {
        "abi_version": 0,
        "class": "ELF64",
        "data": "2's complement, little endian",
        "entrypoint": 4202320,
        "hdr_version": "1 (current)",
        "machine": "Advanced Micro Devices X86-64",
        "num_prog_headers": 8,
        "num_section_headers": 33,
        "obj_version": "1",
        "os_abi": "UNIX - System V",
        "type": "EXEC (Executable file)"
    },
    "import_list": [
        {
            "name": "gelf_getsym",
            "type": "FUNC"
        },
        {
            "name": "gelf_getrela",
            "type": "FUNC"
        },
        {
            "name": "__fsetlocking",
            "type": "FUNC"
        },
        {
            "name": "close",
            "type": "FUNC"
        },
        {
            "name": "__gmon_start__",
            "type": "NOTYPE"
        },
        {
            "name": "_Jv_RegisterClasses",
            "type": "NOTYPE"
        },
        {
            "name": "gelf_update_symshndx",
            "type": "FUNC"
        },
        {
            "name": "gelf_getsymshndx",
            "type": "FUNC"
        },
        {
            "name": "malloc",
            "type": "FUNC"
        }
    ],
    "interpreter": "/lib64/ld-linux-x86-64.so.2",
    "note": [
        "ELF_NOTE_ABI:Linux_2.6.18",
        "NT_GNU_BUILD_ID:4143ed5750c74514519d032ef65e3362e9f9cb63"
    ],
    "section_list": [
        {
            "flags": "",
            "name": "",
            "phisical_offset": 0,
            "section_type": "NULL",
            "size": 0,
            "virtual_address": 0
        },
        {
            "flags": "A",
            "name": ".interp",
            "phisical_offset": 512,
            "section_type": "PROGBITS",
            "size": 28,
            "virtual_address": 4194816
        },
        {
            "flags": "A",
            "name": ".gnu.liblist",
            "phisical_offset": 2920,
            "section_type": "LOOS+0xffffff7",
            "size": 80,
            "virtual_address": 4197224
        },
        {
            "flags": "",
            "name": ".shstrtab",
            "phisical_offset": 49024,
            "section_type": "STRTAB",
            "size": 310,
            "virtual_address": 0
        }
    ],
    "segment_list": [
        {
            "resources": [
                
            ],
            "segment_type": "PHDR"
        },
        {
            "resources": [
                ".interp"
            ],
            "segment_type": "INTERP"
        },
        {
            "resources": [
                ".interp",
                ".note.ABI-tag",
                ".note.gnu.build-id",
                ".gnu.hash",
                ".dynsym",
                ".gnu.liblist",
                ".gnu.conflict",
                ".gnu.version",
                ".gnu.version_r",
                ".rela.dyn",
                ".rela.plt",
                ".init",
                ".plt",
                ".text",
                ".fini",
                ".rodata",
                ".eh_frame_hdr",
                ".eh_frame"
            ],
            "segment_type": "LOAD"
        },
        {
            "resources": [
                ".ctors",
                ".dtors",
                ".jcr",
                ".data.rel.ro",
                ".dynamic",
                ".got",
                ".got.plt",
                ".data",
                ".dynbss",
                ".bss",
                ".dynstr"
            ],
            "segment_type": "LOAD"
        },
        {
            "resources": [
                ".dynamic"
            ],
            "segment_type": "DYNAMIC"
        },
        {
            "resources": [
                ".note.ABI-tag",
                ".note.gnu.build-id"
            ],
            "segment_type": "NOTE"
        },
        {
            "resources": [
                ".eh_frame_hdr"
            ],
            "segment_type": "GNU_EH_FRAME"
        },
        {
            "resources": [
                
            ],
            "segment_type": "GNU_STACK"
        }
    ],
    "shared_libraries": [
        "libelf.so.1",
        "libdl.so.2",
        "libc.so.6"
    ],
    "target_os": "Linux",
    "verneed": [
        "libdl.so.2:GLIBC_2.2.5",
        "libc.so.6:GLIBC_2.7 GLIBC_2.6 GLIBC_2.4 GLIBC_2.3.4 GLIBC_2.2.5",
        "libelf.so.1:ELFUTILS_1.5 ELFUTILS_1.6 ELFUTILS_1.0"
    ]
}

业务正常响应-pe_info响应示例

{
  "pe_info": {
    "authentihash": "77692f8d7d077f8a4b08b88d953080dfbeb7cb328e5f61f5ea32170dd2d625e4",
    "compile_timestamp": 1344524209,
    "compiler_name": "VC",
    "compiler_product_versions": [
      "[ASM] VS2008 SP1 build 30729 count=16",
      "[ C ] VS2008 SP1 build 30729 count=96",
      "[IMP] VS2005 build 50727 count=5",
      "[---] Unmarked objects count=112",
      "[C++] VS2008 SP1 build 30729 count=33",
      "[LNK] VS2008 SP1 build 30729 count=1"
    ],
    "compiler_version": "9.0",
    "debug": [],
    "entry_point": 7590,
    "export_module": "",
    "imphash": "4749670ac3d28d6761142b0dcb4f5076",
    "import_list": [
      {
        "imported_functions": [
          "WriteFile",
          "DisconnectNamedPipe",
          "InterlockedIncrement",
          "InterlockedDecrement",
          "CreateProcessA",
          "WaitForSingleObject",
          "GetExitCodeProcess",
          "CreateNamedPipeA",
          "ConnectNamedPipe",
          "CreateEventA",
          "GetCurrentProcessId",
          "OpenProcess",
          "LocalAlloc",
          "LocalFree",
          "CloseHandle",
          "SetEvent",
          "ReadFile",
          "GetLastError",
          "ExitThread",
          "ResumeThread",
          "CreateThread"
        ],
        "library_name": "KERNEL32.dll"
      },
      {
        "imported_functions": [
          "SetSecurityDescriptorDacl",
          "StartServiceCtrlDispatcherA",
          "RegisterServiceCtrlHandlerA",
          "OpenProcessToken",
          "GetTokenInformation",
          "AllocateAndInitializeSid",
          "EqualSid",
          "FreeSid",
          "OpenSCManagerA",
          "OpenServiceA",
          "CloseServiceHandle",
          "DeleteService",
          "SetServiceStatus",
          "InitializeSecurityDescriptor"
        ],
        "library_name": "ADVAPI32.dll"
      }
    ],
    "machine_type": 0,
    "main_icon_crc": "00000000",
    "resource_details": [
      {
        "chi2": 3958.6473988439307,
        "entropy": 4.795973602273464,
        "filetype": "Data",
        "lang": "ENGLISH US",
        "sha256": "49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e",
        "type": "RT_MANIFEST"
      }
    ],
    "resource_langs": {
      "ENGLISH US": 1
    },
    "resource_types": {
      "RT_MANIFEST": 1
    },
    "rich_pe_hash": "b874e0014f779071f213f34cfd76641a",
    "rich_pe_header_hash": "1a01be73858d49f40a22a2e8aef1ebe9",
    "sections": [
      {
        "entropy": 6.552123720770889,
        "md5": "fda6f3f1711a920038629e88ae07536b",
        "name": ".text",
        "raw_size": 37888,
        "virtual_address": 4096,
        "virtual_size": 37828
      },
      {
        "entropy": 5.487592106381799,
        "md5": "b33fcca5333f0b6bc52efc31b12b6b19",
        "name": ".rdata",
        "raw_size": 8704,
        "virtual_address": 45056,
        "virtual_size": 8600
      },
      {
        "entropy": 2.096113143901055,
        "md5": "6c3933718603e3a01948510a829da530",
        "name": ".data",
        "raw_size": 4096,
        "virtual_address": 57344,
        "virtual_size": 11820
      },
      {
        "entropy": 5.105006099278344,
        "md5": "81195ca9b22c050f79e44175e9e7150e",
        "name": ".rsrc",
        "raw_size": 512,
        "virtual_address": 69632,
        "virtual_size": 436
      },
      {
        "entropy": 4.627610703349185,
        "md5": "a60e104d4f406aa16b549a851212d4ac",
        "name": ".reloc",
        "raw_size": 4096,
        "virtual_address": 73728,
        "virtual_size": 4004
      }
    ]
  }
}

业务正常响应

{
    "code": "0",
    "msg": "success",
    "data": {
        "upload_info": {
            "client_info": {
                "get_date": 1514736000,
                "upload_path": "/home/search/vt_scan/src/../file/upload_cloud/11603.file",
                "upload_filename": "11603.file",
                "client_creation_date": 1484570587,
                "client_module": "pc",
                "client_product": "vt"
            },
            "vt_has": true,
            "is_oversea": true
        },
        "static_info": {
            "basic_info": {
                "crc32": "d1b10c42",
                "file_size": 11264,
                "file_type": "pe_dll_x86",
                "magic": "PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit Mono/.Net assembly",
                "md5": "57403930e62a3e9f83f248c753b1e164",
                "sha1": "bb6da5c5e248afc7e753d4bd3ff950fc51743627",
                "sha256": "f8689f9e8fd1deeea80aad40f387d6d17e3ece778323738e820cb77f10046813",
                "sm3": "bd7834b9f8700b66c8f530184df64f7b27a561a3ca6c9d5497b424a3528dc9e1",
                "ssdeep": "192:akW1iMnTbGcvYeY7fvo9Am3v1Pph3v7Vpj2B:akW1iMneJeYba5p/v7Vpj2B",
                "tlsh": "T14032A405FBD84E3BF77E8BB0ACB755105AF2AC4A7805C5984DD811BE58E278C9012FA7"
            },
            "creation_date": 1484570587,
            "file_name": "ntdbsk_p.dll",
            "exiftool": {
                "AssemblyVersion": "4.2.0.2495",
                "CharacterSet": "Unicode",
                "CodeSize": "9216",
                "EntryPoint": "0x439e",
                "FileDescription": " ",
                "FileFlags": "(none)",
                "FileFlagsMask": "0x003f",
                "FileOS": "Win32",
                "FileSize": "11 KiB",
                "FileSubtype": "0",
                "FileType": "Win32 DLL",
                "FileTypeExtension": "dll",
                "FileVersion": "4.2.0.2495",
                "FileVersionNumber": "4.2.0.2495",
                "ImageFileCharacteristics": "Executable, 32-bit, DLL",
                "ImageVersion": "0.0",
                "InitializedDataSize": "1536",
                "InternalName": "ntdbsk_p.dll",
                "LanguageCode": "Neutral",
                "LegalCopyright": " ",
                "LinkerVersion": "8.0",
                "MIMEType": "application/octet-stream",
                "MachineType": "Intel 386 or later, and compatibles",
                "OSVersion": "4.0",
                "ObjectFileType": "Dynamic link library",
                "OriginalFileName": "ntdbsk_p.dll",
                "PEType": "PE32",
                "ProductVersion": "4.2.0.2495",
                "ProductVersionNumber": "4.2.0.2495",
                "Subsystem": "Windows command line",
                "SubsystemVersion": "4.0",
                "TimeStamp": "2017:01:16 20:43:07+08:00",
                "UninitializedDataSize": "0"
            },
            "pe_info": {
                "authentihash": "0595ca62b49c16fe7551fe6198806f49591ac7dad612c81cf8b3bd90b0d1ba41",
                "compile_timestamp": 1484570587,
                "compiler_name": "VB.NET",
                "compiler_version": "C#",
                "debug": [],
                "dot_net_assembly": {
                    "assembly_data": {
                        "buildnumber": 0,
                        "culture": "",
                        "flags": 0,
                        "flags_text": "afPA_None",
                        "hashalgid": 32772,
                        "majorversion": 4,
                        "minorversion": 2,
                        "name": "ntdbsk_p",
                        "pubkey": "",
                        "revisionnumber": 2495
                    },
                    "assembly_flags": 1,
                    "assembly_flags_txt": "COMIMAGE_FLAGS_ILONLY",
                    "assembly_name": "ntdbsk_p.dll",
                    "clr_meta_version": "1.1",
                    "clr_version": "v2.0.50727",
                    "entry_point_rva": 0,
                    "entry_point_token": 0,
                    "exported_types": [],
                    "external_assemblies": {
                        "Citrix.Receiver.SelfService.ConfigMgr.Communication": {
                            "version": "4.2.0.2495"
                        },
                        "System.Xml": {
                            "version": "2.0.0.0"
                        },
                        "mscorlib": {
                            "version": "2.0.0.0"
                        }
                    },
                    "external_files": [],
                    "external_modules": [],
                    "manifest_resource": [],
                    "metadata_header_rva": 11064,
                    "resources_va": 0,
                    "streams": {
                        "#Blob": {
                            "chi2": 7368.503703703704,
                            "entropy": 4.737247039964728,
                            "md5": "9e4ae3be0e44e90c6435180ac77acd07",
                            "size": 540
                        },
                        "#GUID": {
                            "chi2": 240,
                            "entropy": 4,
                            "md5": "fde11dfdf4eb0e9d5cea1120391cf067",
                            "size": 16
                        },
                        "#Strings": {
                            "chi2": 34290.942528735635,
                            "entropy": 4.842792499407349,
                            "md5": "802facdc9eb991f7d976622ebc7eb486",
                            "size": 2784
                        },
                        "#US": {
                            "chi2": 68903.8918918919,
                            "entropy": 3.4039077432812395,
                            "md5": "632d498ecd3f8892418f73893b8208e9",
                            "size": 1036
                        },
                        "#~": {
                            "chi2": 73163.46793349169,
                            "entropy": 4.793292070031326,
                            "md5": "e2e44d2e984fe028ead982dd3d8ea6ac",
                            "size": 1684
                        }
                    },
                    "strongname_va": 0,
                    "tables_present": 15,
                    "tables_present_map": "909a21557",
                    "tables_rows_map": "11e70f01c0170520500008000105500300001003000000000",
                    "type_definition_list": [
                        {
                            "namespace": "Citrix.Receiver.SelfService.ConfigMgr.Communication.Implementation.DTO",
                            "type_definitions": [
                                "InstallResponseDto",
                                "InstallResultDto"
                            ]
                        },
                        {
                            "namespace": "Citrix.Receiver.SelfService.ConfigMgr.Communication.Interfaces",
                            "type_definitions": [
                                "InstallStatus"
                            ]
                        },
                        {
                            "namespace": "System",
                            "type_definitions": [
                                "Type",
                                "Object",
                                "RuntimeTypeHandle",
                                "Exception",
                                "Int64",
                                "IFormatProvider",
                                "Boolean"
                            ]
                        },
                        {
                            "namespace": "System.Collections",
                            "type_definitions": [
                                "Hashtable",
                                "ICollection"
                            ]
                        },
                        {
                            "namespace": "System.Collections.Generic",
                            "type_definitions": [
                                "List`1",
                                "Dictionary`2"
                            ]
                        },
                        {
                            "namespace": "System.Globalization",
                            "type_definitions": [
                                "CultureInfo"
                            ]
                        },
                        {
                            "namespace": "System.Reflection",
                            "type_definitions": [
                                "AssemblyVersionAttribute"
                            ]
                        },
                        {
                            "namespace": "System.Runtime.CompilerServices",
                            "type_definitions": [
                                "CompilationRelaxationsAttribute",
                                "RuntimeCompatibilityAttribute",
                                "CompilerGeneratedAttribute"
                            ]
                        },
                        {
                            "namespace": "System.Security",
                            "type_definitions": [
                                "SecurityTransparentAttribute",
                                "AllowPartiallyTrustedCallersAttribute"
                            ]
                        },
                        {
                            "namespace": "System.Xml",
                            "type_definitions": [
                                "XmlReader",
                                "XmlNodeType",
                                "XmlQualifiedName",
                                "XmlNameTable"
                            ]
                        },
                        {
                            "namespace": "System.Xml.Serialization",
                            "type_definitions": [
                                "XmlSerializationWriter",
                                "XmlSerializationReader",
                                "XmlSerializer",
                                "XmlSerializerImplementation",
                                "XmlSerializerNamespaces"
                            ]
                        }
                    ],
                    "unmanaged_method_list": []
                },
                "entry_point": 17310,
                "export_module": "",
                "exports": null,
                "imphash": "dae02f32a21e03ce65412f6e56942daa",
                "import_list": [
                    {
                        "imported_functions": [
                            "_CorDllMain"
                        ],
                        "library_name": "mscoree.dll"
                    }
                ],
                "machine_type": 0,
                "main_icon_crc": "00000000",
                "resource_details": [
                    {
                        "chi2": 50644.88888888889,
                        "entropy": 3.327098800968482,
                        "filetype": "Data",
                        "lang": "NEUTRAL",
                        "sha256": "6d412563e9d6bdb4fd710065c00eab7c846664e4190a503a56b0c82f7af6e146",
                        "type": "RT_VERSION"
                    }
                ],
                "resource_langs": {
                    "NEUTRAL": 1
                },
                "resource_types": {
                    "RT_VERSION": 1
                },
                "sections": [
                    {
                        "entropy": 5.4158522068058295,
                        "md5": "1564fce5bd0e554fa31f2d16d29fd79d",
                        "name": ".text",
                        "raw_size": 9216,
                        "virtual_address": 8192,
                        "virtual_size": 9124
                    },
                    {
                        "entropy": 2.3383323965552765,
                        "md5": "77e2703f8ccda4eb2219f1cc24ffb22b",
                        "name": ".rsrc",
                        "raw_size": 1024,
                        "virtual_address": 24576,
                        "virtual_size": 704
                    },
                    {
                        "entropy": 0.08153941234324169,
                        "md5": "d11e3b8fffc46f60a8135115bfac986f",
                        "name": ".reloc",
                        "raw_size": 512,
                        "virtual_address": 32768,
                        "virtual_size": 12
                    }
                ]
            },
            "signature_info": {
                "data": {
                    "file_version_info": {
                        "copyright": " ",
                        "description": " ",
                        "file version": "4.2.0.2495",
                        "internal name": "ntdbsk_p.dll",
                        "original name": "ntdbsk_p.dll"
                    }
                },
                "type": "win"
            }
        }
    }
}

业务异常响应

{
    "code": "AB13201",
    "msg": "服务端内部错误，响应内容：[xxxxxx]"
}