> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Search Malware

Search ZeroFox's CTI feed of malware for a specified file hash.

To search for a specific file, provide one of `MD5`, `SHA1`, `SHA256`, or `SHA512`.

> [!NOTE]
>
> External Documentation
>
> To learn more, visit the [ZeroFox documentation](https://api.zerofox.com/cti/docs/).

## Basic Parameters

| Parameter | Description |
| - | - |
| Created After | The date and time to return malware found from. |
| MD5 | The MD5 hash of the file to search for. |
| Return All Pages | Automatically fetch all resources, page by page. |
| SHA1 | The SHA1 hash of the file to search for. |
| SHA256 | The SHA256 hash of the file to search for. |
| SHA512 | The SHA512 hash of the file to search for. |

## Advanced Parameters

| Parameter | Description |
| - | - |
| Cursor | The cursor of the results page to return. You can get it from the `next` URL of a previous response. |

## Example Output

```json theme={"dark"}
{
	"next": null,
	"results": [
		{
			"created_at": "2023-06-30T17:44:35Z",
			"family": null,
			"md5": "e89b43d57a67a3f4d705028cfbd7b6fb",
			"sha1": "332c39d5130752b8c32d3b7275a05c13e874db84",
			"sha256": "****",
			"sha512": "809e3b6e2eb34a7a061bb8de610baef25f91c0dee5fe1d2e42d04a0ac42e43b40b1ee4e42352cc7d59322aa5cf4b2645c85fed7f36906d68e22e400d48e437ef",
			"tags": [
				"evasion",
				"themida",
				"trojan"
			],
			"botnet": [],
			"c2": []
		}
	]
}
```

## Workflow Library Example

[Search Malware with Zerofox and Send Results Via Email](https://library.blinkops.com/workflows/search-malware-with-zerofox-and-send-results-via-email)

![Workflow Library](https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max\&auto=format\&n=ojHYuDeYX5FWuN8a\&q=85\&s=b8af968e71438a9499c3223c9bd29fb2)

Preview this Workflow on desktop

[https://library.blinkops.com/workflows/search-malware-with-zerofox-and-send-results-via-email/canvas](https://library.blinkops.com/workflows/search-malware-with-zerofox-and-send-results-via-email/canvas)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.