API Reference

List Recent Malware Samples

Return recently observed malware samples from the malware sample corpus, optionally filtered by file type and look-back window.

GET

/v1/malware/recent

Cost: 1 credit per successful call

Query parameters

file_typestringoptional

Filter results to a single file type (for example, exe, dll, pdf). Maximum 32 characters.

daysintegeroptionaldefault: 1

Look-back window in days. Accepted range: 1–7.

limitintegeroptionaldefault: 25

Maximum number of samples to return. Accepted range: 1–100.

Request

curl "https://api.precursorintelligence.com/functions/v1/malware/recent?file_type=exe&days=1&limit=25" \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "count": 3,
    "items": [
      {
        "sha256_hash": "a3f1d2e4b5c6789012345678abcdef901234567890abcdef1234567890abcdef",
        "file_name": "invoice-may-2026.exe",
        "file_type": "exe",
        "signature": "Emotet",
        "first_seen": "2026-05-29T07:33:00Z"
      },
      {
        "sha256_hash": "b7e8f9a0c1d2345678901234567890abcdef1234567890abcdef1234567890ab",
        "file_name": "updater.exe",
        "file_type": "exe",
        "signature": "AgentTesla",
        "first_seen": "2026-05-29T05:12:00Z"
      },
      {
        "sha256_hash": "c9d0e1f2a3b4567890123456789012abcdef567890abcdef567890abcdef56cd",
        "file_name": "setup32.exe",
        "file_type": "exe",
        "signature": "RedLine",
        "first_seen": "2026-05-29T02:47:00Z"
      }
    ],
    "generated_at": "2026-05-29T10:24:31.118Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.countintegeroptional

Number of samples returned (equals items.length).

data.itemsarrayoptional

Malware samples first observed within the window, ordered most recent first. Each object contains the fields below.

data.items[].sha256_hashstringoptional

SHA-256 hash of the sample.

data.items[].file_namestringoptional

Reported file name for the sample.

data.items[].file_typestringoptional

Short file-type identifier, for example exe or dll.

data.items[].signaturestring | nulloptional

Detected malware signature or family name. null when unattributed.

data.items[].first_seenstringoptional

ISO 8601 timestamp when the sample was first observed.

data.generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Status	`error`	When
400	`invalid_file_type`, `invalid_days`, `invalid_limit`	A parameter failed validation.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, or IP not allowlisted.
402	`insufficient_credits`	Organisation credit balance is below 1.
404	`not_found`	The route or entity does not exist.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.