Files | VirusSign API Documentation

This reference covers the indicator object in a lookup response. See request parameters, response metadata and response conventions. Pro fields provide additional context where available; compact views contain fewer fields.

Fields are conditional unless stated otherwise. Types below describe populated values; optional values may also be null. Access labels describe capability, not guaranteed data for every indicator.

File fields

indicator

Fields in indicator
Field	Type	Meaning
`type`	string	File record.
`value`	string	Canonical indicator value. File records normally use SHA-256; URL records use an opaque identifier.
`analysis`	object	Threat assessment. Field reference →
`first_seen`	string	First observation time. ISO 8601 timestamp with timezone.
`last_seen`	string	Latest observation time. ISO 8601 timestamp with timezone.
`tags`	array<string>	Descriptive indicator labels.
`crowd_context`	object · Pro	Community and actor context, where available. Field reference →
`relations`	object	Related object groups when requested with full+relations and authorized. See Relationships. Field reference →
`md5`	string	MD5 digest.
`sha1`	string	SHA-1 digest.
`sha256`	string	SHA-256 digest.
`ssdeep`	string	ssdeep fuzzy hash.
`tlsh`	string	TLSH similarity hash.
`imphash`	string	PE import hash.
`richhash`	string · Pro	Rich PE header hash.
`filename`	string · Pro	Representative filename.
`filenames`	array<string>	Observed filenames.
`filesize`	integer	File size in bytes.
`filetype`	string	File format/type label.
`mime`	string · Pro	MIME media type.
`compile_time`	string · Pro	Compilation time recorded in the file metadata. ISO 8601 timestamp with timezone.

indicator.contextobject

Context for an object returned through a relationship.

Fields in indicator.context
Field	Type	Meaning
`relationship`	string	Relationship connecting this object to the source indicator.

indicator.linksobject

Optional navigation links.

Fields in indicator.links
Field	Type	Meaning
`self`	string	Canonical resource link, when provided.

Signatures

indicator.signature_info[]array<object> · Pro

Signing certificate details.

Fields in indicator.signature_info[]
Field	Type	Meaning
`signature_subject`	string	Certificate subject.
`signature_issuer`	string	Certificate issuer.
`signature_valid_from`	number	Certificate validity start, as Unix time in seconds.
`signature_valid_to`	number	Certificate validity end, as Unix time in seconds.
`signature_algorithm`	string	Certificate signature algorithm.
`signature_thumbprint`	string	Certificate fingerprint.
`signature_serial_number`	string	Certificate serial number.

PE structure

indicator

Fields in indicator
Field	Type	Meaning
`export_table`	array<string> · Pro	Exported function names.

indicator.pe_header_infoobject · Pro

Portable Executable (PE) header information.

Fields in indicator.pe_header_info
Field	Type	Meaning
`pe_platform`	string	Target machine/platform.
`pe_compile_timestamp`	string	Compilation timestamp recorded in the PE header. ISO 8601 timestamp with timezone.
`pe_entry_point_oep`	integer	Original entry point value from the PE header.
`pe_number_of_sections`	integer	Number of PE sections.

indicator.pe_section_table[]array<object> · Pro

PE section details.

Fields in indicator.pe_section_table[]
Field	Type	Meaning
`section_name`	string	Section name.
`virtual_address`	integer	Virtual address recorded for the section.
`virtual_size_byte`	integer	Virtual section size in bytes.
`raw_size`	integer	Section size on disk in bytes.
`section_permissions`	string	Section characteristics or permission flags.
`section_hash`	string	MD5 of the section contents.
`section_entropy`	number	Byte entropy on a 0–8 scale, not a percentage.

indicator.import_table[]array<object> · Pro

Imported libraries and functions.

Fields in indicator.import_table[]
Field	Type	Meaning
`library`	string	Imported library name.
`functions`	array<string>	Imported function names.

indicator.pe_resources[]array<object> · Pro

Embedded PE resources.

Fields in indicator.pe_resources[]
Field	Type	Meaning
`resource_type`	string	Resource type.
`resource_language`	string	Resource language identifier or label.
`resource_hash`	string	SHA-256 of resource contents.

Behavior

indicator

Fields in indicator
Field	Type	Meaning
`behavior_tags`	array<string> · Pro	Combined behavior labels.

indicator.behaviors[]array<object> · Pro

Behavioral observations, MITRE ATT&CK and MBC mappings.

Fields in indicator.behaviors[]
Field	Type	Meaning
`type`	string	Observation category: signature_match, mitre_attack or mbc.
`description`	string	Human-readable behavior or technique description.
`threat_level`	string	Threat level associated with this observation.
`tags`	array<string>	Labels and taxonomy identifiers. MITRE ATT&CK and Malware Behavior Catalog (MBC) mappings appear here when available.

indicator.behaviors[].match_data[]array<object> · Pro

Structured supporting details. Keys vary with the behavior; treat entries as extensible objects.

Fields in indicator.behaviors[].match_data[]
Field	Type	Meaning
`file_path`	string	Path of an observed file.
`file_name`	string	Observed file name.
`binary_path`	string	Executable path.
`image_path`	string	Process image path.
`process_name`	string	Observed process name.
`command_line`	string	Observed command line.
`registry_key`	string	Observed registry key path.
`mutex_name`	string	Observed mutex name.
`api`	string	Observed API function name.
`arguments`	string	Recorded function arguments.
`ip`	string	IP address associated with the observation.
`source_ip`	string	Source IP address.
`target_ip`	string	Destination IP address.
`pid`	integer	Observed process identifier.
`port`	integer	Port associated with the observation.
`target_port`	integer	Destination port.

Network activity

indicator.outbound_connections[]array<object> · Pro

Observed network communications.

Fields in indicator.outbound_connections[]
Field	Type	Meaning
`protocol`	string	Network protocol.
`destination_ip`	string	Destination IP address.
`destination_domain`	string	Destination domain.
`destination_url`	string	Destination URL.
`destination_port`	integer	Destination port.
`http_method`	string	HTTP request method, when applicable.
`http_status_code`	integer	Observed HTTP response status.
`response_size`	integer	Observed response size in bytes.
`response_body_sha256`	string	SHA-256 of the response body.
`content_type`	string	Response content type.
`threat_level`	string	Threat level for this observation.
`tags`	array<string>	Descriptive labels.

indicator.dns_requests[]array<object> · Pro

Observed DNS activity.

Fields in indicator.dns_requests[]
Field	Type	Meaning
`query_domain`	string	Queried domain.
`query_type`	string	DNS record type requested.
`response_ip`	array<string>	IP addresses returned by the DNS response.
`dns_server`	string	DNS server address.
`response_code`	string / integer	DNS response code or label.
`threat_level`	string	Threat level associated with the observation.
`tags`	array<string>	Descriptive labels.

indicator.c2_communications[]array<object> · Pro

Potential C2 connections and supporting reasons.

Fields in indicator.c2_communications[]
Field	Type	Meaning
`c2_ip`	string	Associated IP address.
`c2_domain`	string	Associated domain.
`c2_port`	integer	Associated port.
`protocol`	string	Communication protocol.
`threat_level`	string	Threat level.
`source_type`	array<string>	Categories of observations supporting the connection.
`reasons`	array<string>	Reasons for the potential C2 association.

Illustrative response

Illustrative data showing the response structure. Optional fields may be omitted.

JSON · illustrative files

{
  "meta": {
    "request_id": "example-request",
    "timestamp": "2026-01-15T12:00:00Z",
    "quota_remaining": 100,
    "took_ms": 12
  },
  "indicator": {
    "type": "file",
    "value": "84c103791b26ce9eb82f57e5a181fb30374b0f111626b85cf8e0becfd319a674",
    "md5": "c40a3b78e504b61e2c07700501c05ca7",
    "sha1": "ac6ce98b81fc6236acda25986854969b96fa7d33",
    "sha256": "84c103791b26ce9eb82f57e5a181fb30374b0f111626b85cf8e0becfd319a674",
    "filesize": 40960,
    "filetype": "peexe",
    "mime": "application/vnd.microsoft.portable-executable",
    "filenames": [
      "service-agent.exe"
    ],
    "analysis": {
      "malicious": true,
      "severity": "medium",
      "confidence": 60,
      "detections": "28/32",
      "family": "ExampleFamily",
      "has_actor": false
    },
    "first_seen": "2026-01-15T12:00:00Z",
    "last_seen": "2026-01-15T12:00:00Z",
    "pe_header_info": {
      "pe_platform": "x86",
      "pe_entry_point_oep": 4096,
      "pe_number_of_sections": 1
    },
    "pe_section_table": [
      {
        "section_name": ".text",
        "virtual_address": 4096,
        "virtual_size_byte": 8192,
        "raw_size": 8192,
        "section_entropy": 6.2
      }
    ],
    "import_table": [
      {
        "library": "KERNEL32.dll",
        "functions": [
          "CreateFileW"
        ]
      }
    ],
    "behaviors": [
      {
        "type": "mitre_attack",
        "description": "Application Layer Protocol",
        "tags": [
          "T1071"
        ]
      },
      {
        "type": "signature_match",
        "description": "Observed process and file activity.",
        "match_data": [
          {
            "process_name": "service-agent.exe",
            "pid": 2480,
            "image_path": "C:\\ProgramData\\ServiceAgent\\service-agent.exe"
          },
          {
            "file_path": "C:\\ProgramData\\ServiceAgent\\cache.dat"
          }
        ]
      }
    ],
    "dns_requests": [
      {
        "query_domain": "beacon.example",
        "query_type": "A",
        "response_ip": [
          "192.0.2.10"
        ]
      }
    ],
    "outbound_connections": [
      {
        "protocol": "tcp",
        "destination_ip": "192.0.2.10",
        "destination_port": 443
      }
    ]
  }
}

Appearance

File intelligence

Search results

File fields

Signatures

PE structure

Behavior

Network activity

Illustrative response

A quick security check