{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://api-evangelist.github.io/greynoise/json-schema/greynoise-callback-file-response-schema.json",
  "title": "CallbackFileResponse",
  "type": "object",
  "description": "Malware file associated with a callback IP.",
  "properties": {
    "sha256": {
      "type": "string",
      "description": "SHA-256 hash of the file.",
      "example": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    },
    "md5": {
      "type": "string",
      "description": "MD5 hash of the file.",
      "example": "795bc7ce13f60d61e9ac03611dd36d90"
    },
    "sha1": {
      "type": "string",
      "description": "SHA-1 hash of the file.",
      "example": "string"
    },
    "threat_name": {
      "type": "string",
      "description": "VirusTotal threat name, if available.",
      "example": "Trojan.GenericKD.46542"
    },
    "vt_detection_count": {
      "type": "integer",
      "description": "Number of VirusTotal engines that flagged the file as malicious.",
      "example": 42
    },
    "vt_engine_count": {
      "type": "integer",
      "description": "Total number of VirusTotal engines that scanned the file.",
      "example": 71
    },
    "file_name": {
      "type": "string",
      "description": "Original file name, if known.",
      "example": "payload.bin"
    },
    "size": {
      "type": "integer",
      "format": "int64",
      "description": "File size in bytes.",
      "example": 24576
    },
    "type": {
      "type": "string",
      "description": "File MIME type.",
      "example": "application/x-executable"
    }
  }
}