Obtain file detection results by calling GetFileDetectResult - Security Center - Alibaba Cloud - Security Center

Retrieves file detection results in batches by HashKey.

Operation description

You can retrieve detection results only for files that have been submitted for detection. Detection results are retained for 5 hours and can be queried repeatedly within this period. For the detection submission operation, refer to CreateFileDetect.

File unique identifier

All file detection operations include the HashKey parameter, which represents the unique identifier of the file being detected and is used to query detection results. Only the MD5 or SHA-256 hash of the complete file content is supported.

Query detection results

You can filter file properties by using the FileLabel in the Ext extension field. For example, combine the encrypted and Zip properties to filter encrypted archives. Supported file labels for compressed file types: Zip, RAR, 7-Zip, XAR, ZLib, GZip, and tar. You can locate malicious code segments in web shell files by using the Highlight field in the Ext extension field. The Highlight field is a list type, where each element corresponds to a code range. The numbers represent the offset in characters relative to the file header.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request parameters

Parameter	Type	Required	Description	Example
SourceIp	string	No	The source IP address of the request.	183.46.XX.XX
HashKeyList	array	Yes	The list of file identifiers. A maximum of 100 elements can be specified.
	string	No	The unique identifier of the file.	0a212417e65c26ff133cfff28f9c****
Type	integer	Yes	The type of file to detect. Valid values: 0: malicious file detection	0

Response elements

Element	Type	Description	Example
	object	The response parameters.
RequestId	string	The request ID, which is a unique identifier generated by Alibaba Cloud for this request. You can use it to troubleshoot issues.	24A20733-10A0-4AF6-BE6B-E3322413BB68
ResultList	array<object>	The list of detection results.
	object	The file detection result information.
HashKey	string	The file identifier.	0a212417e65c26ff133cfff28f6c****
Result	integer	The file detection result. Valid values: 0: Safe file. 1: Suspicious file. 3: Detection in progress. Wait for the result.	0
Score	integer	The file detection score. The mapping between score ranges and risk levels is as follows: 0-60: Safe. 61-70: Risky. 71-80: Suspicious. 81-100: Malicious. Important A higher score indicates a more suspicious file.	100
VirusType	string	The virus type. Valid values: Trojan: trojan WebShell: web shell Backdoor: backdoor RansomWare: ransomware Scanner: scanner Stealer: credential stealer Malbaseware: contaminated base software Hacktool: hacking tool Engtest: DPI engine test program Downloader: downloader trojan Virus: file infector virus Miner: mining programs Worm: worms DDoS: DDoS Trojan Malware: malware RiskWare: riskware Proxytool: proxy tool Suspicious: suspicious program MalScript: malicious script Rootkit: rootkit Exploit: vulnerability exploits Note This parameter is not supported when Result is 0 or 3.	WebShell
Code	string	The result code. A value of 200 indicates success. Any other value indicates failure. You can use this field to determine the cause of failure.	200
Message	string	The detailed information of the error code.	successful
Ext	string	The extended information of the detection result.	{ "HighLight": [ [ 23245, 23212 ] ], "FileLabel": [ "PE32", "Zip", "SFX", "encrypted" ] }
Compress	boolean	Indicates whether the file is identified as a compressed archive. true: Yes. false: No. Note This parameter is not supported when Type is 6.	false

Examples

Success response

JSON format

{
  "RequestId": "24A20733-10A0-4AF6-BE6B-E3322413BB68",
  "ResultList": [
    {
      "HashKey": "0a212417e65c26ff133cfff28f6c****",
      "Result": 0,
      "Score": 100,
      "VirusType": "WebShell",
      "Code": "200",
      "Message": "successful",
      "Ext": "{\n    \"HighLight\":\n    [\n        [\n            23245,\n            23212\n        ]\n    ],\n    \"FileLabel\":\n    [\n        \"PE32\",\n        \"Zip\",\n        \"SFX\",\n        \"encrypted\"\n    ]\n}",
      "Compress": false
    }
  ]
}

Error codes

HTTP status code	Error code	Error message
400	RequestTooFrequently	Request too frequently, please try again later
400	GetResultFail	Get result fail, found no detect record for this file or result has been expired
400	InvalidApiDetectType	Unsupported Api Detect Type.
500	ServerError	ServerError
500	SystemBusy	System busy, please try again later.
403	NoPermission	caller has no permission

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.