---
title: "Lookup a Malware entity by id"
method: GET
path: "/malware/{id}"
tags: ["Malware"]
---

# Lookup a Malware entity by id

`GET /malware/{id}`

## Request

- Base URL: `https://api.recordedfuture.com/v2`
- URL: `https://api.recordedfuture.com/v2/malware/{id}`
- Auth: API key in header `X-RFToken`

Get full malware enrichment including classification, MITRE ATT&CK mappings, and threat actor associations.

## Path parameters

- `id` string, required

## Query parameters

- `fields` string
- `metadata` unknown
- `taggedText` boolean
- `comment` string

## Response `200`

Result of operation

- MalwareLookupResponse: Malware enrichment response. Note: Malware entities do NOT have risk scores — use the categories field for classification. The response includes only the fields specified in the `fields` query parameter.
  - `data` object, required: Malware entity data with requested enrichment fields. Unlike other entity types, malware entities do not have risk scores.
    - `entity` Entity: Recorded Future entity identification.
      - `id` string, required: Recorded Future entity ID. Format varies by type: ip:1.2.3.4, idn:example.com, hash:<value>, url:https://..., or opaque alphanumeric IDs for vulnerabilities, malware, and companies.
      - `name` string, required: Human-readable entity name.
      - `type` 'IpAddress' | 'InternetDomainName' | 'Hash' | 'URL' | 'CyberVulnerability' | 'Malware' | 'Company', required: Entity type classification.
      - `description` string: Entity description (present for vulnerabilities and some other types).
    - `categories` object[]: Malware classification labels. Each category is an entity with id, name, and type. This is the primary classification mechanism for malware — there is no risk score.
      - `id` string: Category entity ID.
      - `name` string: Category name (e.g., 'Remote Access Trojan', 'Ransomware', 'Backdoor').
      - `type` string: Entity type.
    - `aiInsights` AiInsights: AI-generated threat analysis. Included when the fields parameter contains 'aiInsights'. Text is null when fewer than 3 risk rules are triggered.
      - `text` string, nullable: AI-generated threat analysis paragraph. Null when fewer than 3 risk rules are triggered.
      - `numberOfReferences` integer: Number of intelligence references used to generate the insight.
      - `comment` string, nullable: Explanatory comment (e.g., why insights are not available).
    - `links` LinksData: Validated intelligence relationships to threat actors, malware, MITRE ATT&CK techniques, and other entities. Included when the fields parameter contains 'links'. Unlike relatedEntities, these are editorially validated relationships.
      - `hits` object[]: Intelligence hits containing sectioned relationship data.
        - `start_date` string: Start date of the intelligence hit time window.
        - `stop_date` string: End date of the intelligence hit time window.
        - `total_count` integer: Total number of entity relationships in this hit.
        - `sample_reference_ids` string[]: Sample reference IDs supporting this hit.
        - `counts` object[]: Breakdown counts by entity type.
          - `count` integer: Number of entities.
          - `type` object: Entity type metadata.
            - `id` string
            - `name` string
            - `type` string
        - `event_count` integer: Number of events in this hit.
        - `sections` object[]: Relationship sections grouped by category.
          - `section_id` object: Section identifier.
            - `id` string: Section ID.
            - `name` string: Section category name (e.g., 'Actors, Tools & TTPs', 'Victims & Exploit Targets', 'Indicators & Detection Rules').
            - `type` string: Section type (e.g., 'Category').
          - `total_count` integer: Total entities in this section.
          - `lists` object[]: Entity lists within this section, grouped by entity type.
            - `entities` LinksEntity[]
              - …
            - `total_count` integer: Total entities in this list.
            - `type` object: Entity type metadata for this list.
              - …
      - `method_aggregates` object[]: Aggregated counts of linked entities by analysis method.
        - `count` integer: Number of links found by this method.
        - `type` string: Analysis method type.
      - `counts` object[]: Summary counts of linked entities by type.
        - `count` integer: Number of linked entities of this type.
        - `type` object: Entity type metadata.
          - `id` string
          - `name` string
          - `type` string
          - `description` string
    - `intelCard` string, uri: URL to the Recorded Future Intelligence Card for this malware.
    - `timestamps` Timestamps: First and last seen timestamps for the entity in Recorded Future data.
      - `firstSeen` string, date-time: ISO 8601 timestamp of first observation.
      - `lastSeen` string, date-time: ISO 8601 timestamp of most recent observation.
    - `sightings` Sighting[]: Intelligence sightings from various source types. Each item's `type` field indicates the category (recentDarkWeb, recentPaste, recentInfoSec, recentSocialMedia, mostRecent, first). Included when the fields parameter contains 'sightings'.
      - `source` string: Source name (e.g., 'GitHub', 'PasteBin', 'Turk Hack Team Forum').
      - `url` string, uri: URL to the original source.
      - `published` string, date-time: ISO 8601 timestamp of when the sighting was published.
      - `fragment` string: Text fragment from the source mentioning the entity.
      - `title` string: Title of the source document.
      - `type` 'recentDarkWeb' | 'recentPaste' | 'recentInfoSec' | 'recentSocialMedia' | 'mostRecent' | 'first': Sighting category.
    - `analystNotes` object[]: Insikt Group analyst notes. Can be very large.
    - `relatedEntities` object[]: Co-occurrence relationships (not editorially validated).
    - `counts` object[]: Daily reference count time-series. Can contain 2,000+ entries.
  - `metadata` object: Request metadata. Included when the metadata query parameter is set to true.

---

[API](https://skmtc.dev/recordedfuture/apis/connect-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/connect-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/connect-api/revisions/ca0276d265f0?raw)