SPI Scripts

SPI Scripts is a comprehensive command-line tool for querying all ReversingLabs Spectra Intelligence APIs. It provides a unified interface to access 20 different API endpoints, enabling security researchers and analysts to efficiently query file reputation, perform malware hunting, and gather network threat intelligence directly from the terminal.

Why did I develop this tool?

Working with ReversingLabs Spectra Intelligence often requires interacting with multiple API endpoints for different types of intelligence. Instead of writing separate scripts for each endpoint or using the web interface, I wanted a single, powerful CLI tool that could handle all common queries with consistent output formatting. This tool supports bulk queries, debug logging, and saves all results as JSON files for further processing.

Disclaimer: This project was vibecoded and created solely for personal testing purposes. It is not recommended to use this tool in a production environment.

• 20 API Endpoints - Complete coverage of Spectra Intelligence APIs
• File Threat Intelligence - Reputation, AV scans, file analysis, dynamic reports
• Malware Hunting - RHA similarity, ImpHash search, advanced search with 110+ keywords
• Network Intelligence - URL/domain/IP reports, URI indexing, network reputation
• Automation - File download, upload, re-analysis, sandbox detonation
• Bulk Queries - Process multiple hashes via comma-separated values or file input
• Debug Mode - Verbose request/response logging with --debug flag
• JSON Output - All results saved to output/ directory
• Custom Output Path - Override output location with -o flag

Important: This tool requires valid ReversingLabs Spectra Intelligence credentials!

System Requirements

• Python 3.x installed
• pip package manager
• Internet connection for API communication

ReversingLabs Requirements

• Valid Spectra Intelligence account
• API username and password
• Appropriate API quota for your use case

1. Clone and Install

git clone https://github.com/8linkz/SPI_Scripts.git
cd SPI_Scripts
pip install -r requirements.txt

2. Configure Credentials

Edit config.ini with your ReversingLabs credentials:

[reversinglabs]
host = https://data.reversinglabs.com
username = your_actual_username
password = your_actual_password

Configuration Notes

• The host value should remain as https://data.reversinglabs.com for Spectra Intelligence
• Never commit your config.ini with real credentials to version control
• Consider using environment variables for sensitive data in production

Basic Command Structure

python spi.py <command> [options]

File Reputation Queries

# Single hash lookup
python spi.py reputation --hash 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f

# Extended information with hash list
python spi.py reputation --hash <sha256> --extended --show-hashes

# Bulk queries (comma-separated)
python spi.py reputation --hash <hash1>,<hash2>,<hash3>

# Bulk queries from file
python spi.py reputation --hash-file hashes.txt

Network Threat Intelligence

# URL report
python spi.py url-report --url "http://example.com"

# Domain report
python spi.py domain-report --domain "example.com"

# IP report
python spi.py ip-report --ip "1.2.3.4"

# Network reputation
python spi.py net-reputation --network-location "http://example.com"

Malware Hunting

# Advanced search
python spi.py search --query "av-count:5 type:PE32"
python spi.py search --query "threatname:Trojan.GenericKD" --limit 50

# RHA similarity search
python spi.py rha-similarity --hash <sha256>

# ImpHash search
python spi.py imphash --hash <imphash>

File Operations

# Upload file for analysis
python spi.py upload --file sample.exe

# Download sample
python spi.py download --hash <sha1> -o downloaded_sample.bin

# Trigger re-analysis
python spi.py reanalyze --hash <sha256>

# Submit for dynamic analysis
python spi.py dynamic-analysis --hash <sha1> --platform windows10

Debug Mode

python spi.py --debug reputation --hash <sha256>

File Threat Intelligence

• reputation - File reputation (TCA-0101)
• av-scanners - Historic multi-AV scan records (TCA-0103)
• file-analysis - Full file analysis (TCA-0104)
• dynamic-report - Dynamic analysis report (TCA-0106)

Automation

• download - Download a sample binary (TCA-0201)
• upload - Upload a file for analysis (TCA-0202)
• reanalyze - Trigger re-analysis (TCA-0205)
• dynamic-analysis - Submit for sandbox detonation (TCA-0207)

Malware Hunting

• rha-similarity - RHA functional similarity search (TCA-0301)
• imphash - ImpHash similarity search (TCA-0302)
• search - Advanced search with 110+ keywords (TCA-0320)

Network Threat Intelligence

• uri-index - Find files associated with a URI (TCA-0401)
• uri-stats - Classification statistics for a URI (TCA-0402)
• url-report - URL threat intelligence report (TCA-0403)
• analyze-url - Submit URL for analysis (TCA-0404)
• domain-report - Domain threat intelligence report (TCA-0405)
• ip-report - IP address threat intelligence report (TCA-0406)
• net-reputation - Network reputation (TCA-0407)
• net-override - Override network reputation (TCA-0408)

Management

• usage - View daily/monthly API usage (TCA-9999)

Common Issues & Solutions

• Authentication failed - Verify username and password in config.ini
• Module not found - Run pip install -r requirements.txt
• Connection timeout - Check internet connection and API host URL
• Invalid hash format - Ensure you're using the correct hash type (MD5/SHA1/SHA256)
• Rate limit exceeded - Wait before making additional requests or check your API quota

Debug Mode

Use the --debug flag to see detailed request and response information:

python spi.py --debug <command> [options]

Output Directory

Results are saved to the output/ directory by default. Use -o <path> to specify a custom location.

Security Considerations

• Keep your API credentials secure and never commit them to version control
• Use environment variables or secure vaults for credential management
• Be mindful of API rate limits and quota usage
• Review ReversingLabs terms of service for acceptable use

Documentation & Support

• Full API Documentation: ReversingLabs Spectra Intelligence Docs
• OpenAPI Specification: OpenAPI YAML
• ReversingLabs Website: Spectra Intelligence Product Page

SPI Scripts provides a convenient way to interact with the full range of ReversingLabs Spectra Intelligence APIs from the command line. Whether you need quick file reputation lookups, bulk hash queries, or comprehensive network threat intelligence, this tool consolidates all functionality into a single, easy-to-use interface.

The tool is open source and available on GitHub. Contributions and feedback are welcome!