VirusTotal · Schema
FileBehaviourObject
A file's behaviour report from one of VirusTotal's sandboxes.
Anti MalwareThreat IntelligenceSecurityFile AnalysisURL AnalysisYARAIOCSandboxMITRE ATT&CKGoogle Cloud
Properties
| Name | Type | Description |
|---|---|---|
| id | string | Object identifier. |
| type | string | Object type discriminator. |
| links | object | Hypermedia links. |
| attributes | object | Type-specific attributes for FileBehaviourObject. |
| relationships | object | Pre-expanded relationships, keyed by relationship name. |
JSON Schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://raw.githubusercontent.com/api-evangelist/virustotal/refs/heads/main/json-schema/FileBehaviourObject-schema.json",
"title": "FileBehaviourObject",
"description": "A file's behaviour report from one of VirusTotal's sandboxes.",
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Object identifier."
},
"type": {
"type": "string",
"description": "Object type discriminator."
},
"links": {
"type": "object",
"description": "Hypermedia links.",
"properties": {
"self": {
"type": "string",
"format": "uri"
}
}
},
"attributes": {
"type": "object",
"description": "Type-specific attributes for FileBehaviourObject.",
"properties": {
"sandbox_name": {
"type": "string",
"example": "VirusTotal Jujubox"
},
"analysis_date": {
"type": "integer"
},
"behash": {
"type": "string"
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"processes_tree": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": true
}
},
"processes_created": {
"type": "array",
"items": {
"type": "string"
}
},
"processes_injected": {
"type": "array",
"items": {
"type": "string"
}
},
"processes_killed": {
"type": "array",
"items": {
"type": "string"
}
},
"command_executions": {
"type": "array",
"items": {
"type": "string"
}
},
"registry_keys_opened": {
"type": "array",
"items": {
"type": "string"
}
},
"registry_keys_set": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": true
}
},
"files_opened": {
"type": "array",
"items": {
"type": "string"
}
},
"files_written": {
"type": "array",
"items": {
"type": "string"
}
},
"files_deleted": {
"type": "array",
"items": {
"type": "string"
}
},
"files_dropped": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": true
}
},
"modules_loaded": {
"type": "array",
"items": {
"type": "string"
}
},
"mutexes_created": {
"type": "array",
"items": {
"type": "string"
}
},
"mutexes_opened": {
"type": "array",
"items": {
"type": "string"
}
},
"dns_lookups": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": true
}
},
"ip_traffic": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": true
}
},
"http_conversations": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": true
}
},
"tls": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": true
}
},
"mitre_attack_techniques": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": true
}
},
"verdicts": {
"type": "array",
"items": {
"type": "string"
}
}
}
},
"relationships": {
"type": "object",
"description": "Pre-expanded relationships, keyed by relationship name.",
"additionalProperties": true
}
},
"required": [
"id",
"type",
"attributes"
]
}Work with this as data
Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for schemas
4 MCP tools reach this
find_json_schemasBrowse and filter every JSON Schema in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This JSON Schema
curl "https://apis.io/api/v1/json-schemas/virustotal-file-behaviour-object"
All schemas
curl "https://apis.io/api/v1/json-schemas?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.