MalwareBazaar

liveSecurity

abuse.ch malware sample metadata — search by hash, tag, family, or signature.

5tools
0msauth
free tier50 calls/day

Tools

get_sample_inforequired: hash

Metadata for a malware sample by hash (md5/sha1/sha256). Returns file type, signature, file_name, first/last seen, tags, family, intel sources.

Parameters
NameTypeDescription
hashreqstringmd5/sha1/sha256
▶Try it
search_tagrequired: tag

Look up malware samples in MalwareBazaar (the abuse.ch sample corpus) carrying a given tag, such as "emotet", "macro", "exe", or "ransomware". Returns the matching samples with sha256/md5 hashes, file

Parameters
NameTypeDescription
tagreqstringTag
limitoptnumberMax results
▶Try it
search_familyrequired: family

Look up malware samples in MalwareBazaar (the abuse.ch sample corpus) attributed to one malware family or signature name, for example "Cobalt Strike" or "AgentTesla". Returns the matching samples with

Parameters
NameTypeDescription
familyreqstringFamily name
limitoptnumberMax results
▶Try it
search_signaturerequired: signature

Find samples matching a YARA / threat-intel signature.

Parameters
NameTypeDescription
signaturereqstringSignature name
limitoptnumberMax results
▶Try it
recent_samples

Most recent samples in MalwareBazaar. Use the selector to pick a chunk size.

Parameters
NameTypeDescription
selectoroptstringtime | 100
▶Try it

Test with curl

The gateway speaks JSON-RPC 2.0 over HTTP POST. You can test any pack directly from the terminal.

List available tools
bash
curl -X POST https://gateway.pipeworx.io/malwarebazaar/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Call a tool
bash
curl -X POST https://gateway.pipeworx.io/malwarebazaar/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_sample_info","arguments":{"hash": "example"}}}'

Use with the SDK

Install @pipeworx/sdk to call tools from any TypeScript/Node project.

TypeScript
import { Pipeworx } from '@pipeworx/sdk';
const px = new Pipeworx();
const result = await px.call("get_sample_info", {"hash":"example"});
ask_pipeworx
// Or ask in plain English:
const answer = await px.ask("abuse");